An example to adapt to your practice. Your partners approve the final version.
Practice AI policy · Prepare stage
AI policy
Oakfield Surgery (a made-up practice)
| Practice | Oakfield Surgery |
|---|---|
| Version | 2.0 |
| Owner | Jo Reid, practice manager and digital lead |
| Approved | Partners’ meeting, 14/10/2026 |
| Next review | October 2027 |
1. Purpose and scope
Say what the policy is for and who it covers. Include AI added to software you already use, and apps on personal devices.
What this policy is for, and who it covers
This policy sets out how Oakfield Surgery chooses, approves and uses tools that use artificial intelligence (AI), so they are safe for patients and protect their information. It applies to everyone who works here, including locums, trainees, students and contractors. It covers any AI tool used for practice work: tools we buy, tools the ICB or NHS England provides, AI features added to software we already use, and apps on personal devices.
2. Who is responsible
| Role | Name | What they do |
|---|---|---|
| Digital lead | Jo Reid, practice manager | Keeps the AI tool register and answers questions |
| Clinical Safety Officer (CSO) | Dr Helen Marsh, GP partner | Signs off the clinical safety work for each tool |
| Data Protection Officer (DPO) | ICB DPO service | Advises on the DPIA and data protection |
| Caldicott Guardian | Dr Tom Hughes, GP partner | Advises on confidentiality |
| Senior Information Risk Owner (SIRO) | Dr Helen Marsh, GP partner | Accepts the remaining information risk |
| All staff | Everyone | Follow this policy and report problems |
3. Our AI tools
A summary of your AI tool register: each tool, its status, and what it is and isn’t used for. The full register is a spreadsheet kept by the digital lead.
| Tool | Status | Used for | Not for |
|---|---|---|---|
| Kestrel Consult (online consultation and triage) | Approved | Patients send requests through the website and NHS App; it suggests urgency and which team | Closing or turning down a request. A care navigator reads every one and can change the urgency |
| Wren Scribe (AI scribe) | Approved | Drafting consultation notes and referral letters, for trained clinicians | When a patient says no. Nothing saved until the clinician has read and corrected it |
| Microsoft 365 Copilot (NHS.net) | Admin only | Summarising email chains, drafting practice documents, notes of non-clinical meetings | Patient-identifiable information, or anything to do with a clinical decision |
| Linnet Voice (AI phone receptionist) | Being assessed | Nothing yet. Hazard log and DPIA in progress; decision due January 2027 | Any live calls until approved |
| Free public chatbots | Not approved | Nothing involving patients or practice information | Any patient details, on any device, even with names removed |
4. Rules for everyone
- Use only tools on the register, and only for what the register allows.
- Never put patient details into a tool that isn’t approved for them, including free or personal accounts.
- Read and correct anything AI writes before you save it, send it or act on it. You are responsible for what you sign.
- Don’t switch on a new AI feature in existing software. Tell the digital lead and wait for it to be reviewed.
- Use practice devices and accounts. Don’t bring your own AI apps into clinic.
5. Bringing in a new tool
- Ask the digital lead, who checks the register and whether the ICB has already assessed it.
- Get the supplier’s evidence: DCB0129 safety documents, DTAC, DSPT, and medical device registration where it applies.
- The CSO completes a hazard log and clinical safety case report (DCB0160).
- The DPO reviews a data protection impact assessment (DPIA), and the privacy notice is updated.
- The partners approve it at a practice meeting, and the register is updated.
- Staff are trained before they use it, and the first three months are checked closely.
6. Telling patients
How patients are told, and how they can say no
Our privacy notice, website and waiting room posters explain which AI tools we use and why. For Wren Scribe, the clinician tells the patient at the start, respects a no, and records the answer. Patients can always contact us by phone or in person: AI is never the only way to get care here.
7. Checking it works
How you check the tools, and how often
For the first three months of a new tool, the CSO checks a sample of its output each month. After that, each tool is audited at least once a year. We check whether tools work equally well for all our patients, including people with strong accents, disabilities or limited English.
8. When something goes wrong
How problems are reported and learned from
Report any problem or near miss through our incident process the same day. The CSO reviews it and decides whether to pause the tool. If patient information went somewhere it shouldn’t, tell the DPO straight away: it’s a data breach. We report to the supplier and, where relevant, Learn from Patient Safety Events and the MHRA Yellow Card scheme. Incidents and what we learned are discussed at our monthly clinical governance meeting.
9. Training
Training and induction
Staff are trained on each tool before they use it, and training is recorded. New staff, locums and trainees are shown this policy and the register at induction.
10. Review and sign-off
This policy and the register are reviewed every year alongside the DSPT, or sooner if a tool, national guidance or the law changes.
| Role | Name | Signature | Date |
|---|---|---|---|
| Digital lead | |||
| Clinical Safety Officer | |||
| Partner (SIRO) |