🎬 Overview
You can use AI tools in general practice right now – legally, safely, and confidently – if you’ve done the governance properly. This page walks you through exactly what your practice must do and which documents you need to have in place before and after using an AI tool like Heidi, Tortus, Lexacom, or Medloop, etc.
📂 The 7 Core Documents You Must Prepare
Each of these is essential for legal and safe deployment. We’ve explained them simply, with examples from real practice. You can use Dr Dave Triska’s amazing Data Compliance Advisor Tool to generate these documents for you and then customise them to your own practice.
1. 🧭 AI Implementation Policy
What it is:
Your internal plan that explains how your practice chooses, approves, and introduces AI tools.
Why it matters:
It proves that you’re not just trying out shiny tech—you have a proper governance process.
What to include:
- Who makes decisions about AI tools in your practice
- How new tools are assessed before going live
- How you involve your team and provide training
- When tools are reviewed or removed
2. 🛡️ Risk Management and Monitoring Policy
What it is:
Your commitment to ongoing safety checks after the AI tool is switched on.
Why it matters:
It shows that you’re not “fit and forget”—you’re actively monitoring for issues.
What to include:
- How often you’ll review the AI tool’s outputs (e.g. quarterly)
- How you’ll check for bias (e.g. annually across gender, ethnicity, age)
- How staff report problems or risks (e.g. shared folder, MS Teams log)
- How you escalate concerns
3. 🔐 Privacy and Data Protection Policy
What it is:
Your practice’s written approach to handling patient data safely and in line with UK data protection law.
Why it matters:
AI tools often process sensitive personal data—this document shows you’re handling it lawfully.
What to include:
- What data the tool collects (e.g. clinical notes, demographic info)
- How you minimise data use (only what’s needed)
- Who can access the data and how it’s protected
- How long you keep data and how it is deleted
4. 📋 Data Protection Impact Assessment (DPIA)
What it is:
A legal requirement under the UK General Data Protection Regulation. This is your formal risk assessment.
Why it matters:
It helps you identify any risks to patient privacy before the tool goes live—and how you’ll manage them.
What to include:
- What the AI tool does and what data it uses
- Whether that data is identifiable, pseudonymised, or anonymised
- Risks to patients or staff
- How those risks are mitigated (e.g. encryption, staff training)
- Whether the data stays in the UK or goes overseas
Template available from NHS England:
➡️ Complete a DPIA
5. 🧪 Clinical Safety Case (NHS Software Deployment Standard)
What it is:
A document that shows how your practice is making sure the AI tool is clinically safe to use with patients.
Why it matters:
This is part of a mandatory NHS safety process (called DCB0160). It applies every time you use software that can influence patient care.
What to include:
- Name a Clinical Safety Officer (usually a GP or senior nurse)
- Run a risk workshop with your team
- List all potential risks (hazard log)
- Document how you’ll prevent or manage each risk
- Make it clear how staff can raise concerns
🧠 Hint: Start small—add the AI tool to your next practice meeting agenda and map risks together as a team.
6. 📎 Supplier’s Clinical Safety Case (NHS Development Standard DCB0129)
What it is:
A safety document created by the AI company themselves. It proves they’ve built the tool safely and tested it properly.
Why it matters:
If they don’t have this, they haven’t met NHS digital safety requirements. This standard is known as DCB0129.
What to ask for:
- Their clinical safety case (usually a PDF)
- A hazard log or risk assessment
- A signed statement from their own Clinical Safety Officer
If they don’t have this—walk away.
7. ✅ AI Procurement Checklist
What it is:
A checklist of safety, legal, and ethical requirements to tick off before choosing a supplier.
Why it matters:
It helps you ask the right questions before committing to a contract.
What to ask:
- Is the company GDPR compliant?
- Do they have cyber security certification (e.g. Cyber Essentials PLUS)?
- Where is the data stored?
- Have they tested for bias and safety?
- Can they show their clinical safety case?
✅ What You Must Do After the AI Goes Live
Putting AI into use isn’t the end of the road. Here’s what you must keep doing:
🔁 Regular Output Audits
Review the notes created by the AI – are they accurate, safe, and appropriate?
Tip: Do this quarterly, and include it as a standing item in clinical meetings.
🌐 Bias Monitoring
Check for fairness. Is the tool performing equally well across different patient groups (e.g. ethnicity, age, gender)?
Tip: Log any findings and raise them with your supplier. Make this part of your regular audit cycle.
📉 Incident Logging
Create a way for staff to quickly report errors or safety concerns.
Example: Set up a shared folder in Microsoft Teams, or use a central reporting template that covers AI issues alongside safeguarding and near misses.
📅 Annual Policy Reviews
Once a year, dust off your policies and update them. Do this sooner if:
- You change AI tools
- The supplier updates their system significantly
🧠 Staff Training
Before go-live, all users must be trained.
And if the tool changes or expands, run refresher sessions.
🙋♀️ Common Questions
❓ Do I need sign-off from the Data Protection Officer (DPO)?
Not legally required – but it’s wise to keep them informed and get their input on your DPIA.
❓ What about indemnity?
The position statements on AI for the MDU, MPS and MDDUS can be found at the bottom of this page.
All the major indemnity providers have said this:
You, the clinician, are responsible for every entry in the patient record—AI or not. Always read and check AI-generated notes carefully.
❓ Do patients need to know?
Yes. It’s their right under data protection law. You should:
- Update your privacy notice
- Put up posters in waiting rooms
- Mention it in consultations
- Speak to your Patient Participation Group
- Add information to your website and social media
⚠️ Final Reminder – This Is Your Legal Duty
You are the Data Controller and clinical decision-maker. That means:
- You must assess risk
- You must put in safeguards
- You must check every AI-generated note
Even if your supplier is compliant, your practice remains legally responsible for how the tool is used.
📥 Tools to Help
We’ve linked to Dr Dave Triska’s free AI Governance Generator. Just select your AI provider, and it’ll generate all the key documents for you.
Use it. Tweak it. Make it your own. But most importantly—implement what you write.
AI Scribes in NHS General Practice: Position Statements from Medical Defence Organisations (March 2025)
Medical Defence Union (MDU)
The MDU takes a guarded, conditional approach to the use of AI scribes in face-to-face NHS GP consultations. While acknowledging administrative benefits, the MDU emphasises the following:
- Governance & Responsibility: AI scribes must only be used within approved NHS/practice frameworks. Clinicians are personally accountable for the accuracy of all records, even if AI generates the initial draft.
- Confidentiality & GDPR Compliance: Consultation data fed into external AI tools could breach data laws. Proper consent and governance must be in place. Public tools like ChatGPT pose a risk if used without safeguards.
- Accuracy & Reliability: The MDU warns that AI-generated notes may include errors or misleading content ("hallucinations"). Clinicians must review and correct any AI output before finalising the record.
- Ethical Use & Oversight: The MDU supports innovation but stresses ethical use, patient transparency, and compliance with GMC/NHS guidance. Doctors should inform patients when AI tools are in use and obtain consent where appropriate.
Summary: AI scribes may assist with documentation, but the GP must maintain oversight, secure patient data, and remain responsible for the final record.
Medical Protection Society (MPS)
MPS adopts a "safety-first" approach, supporting AI scribes only under strict conditions:
- Assist, Not Replace: AI should augment—not replace—clinical judgment. AI-generated notes should be reviewed and approved by the GP. Passive reliance is discouraged.
- Medico-Legal Liability: If an AI tool produces an error, the developer—not the doctor—is liable. However, doctors are liable for their use of such tools and must ensure systems are reliable and up to date.
- Confidentiality & Consent: Patients must be informed and give consent if an AI tool is recording or transcribing a consultation. The platform must comply with NHS data protection standards.
- Regulatory Compliance: Clinicians must follow GMC guidance, local policies, and remain aware of evolving regulatory frameworks. MPS encourages staying up to date and using vetted systems only.
Summary: AI scribes are acceptable tools if used transparently, with appropriate consent and human oversight.
Medical and Dental Defence Union of Scotland (MDDUS)
MDDUS focuses on consent, transparency, and data security as prerequisites for using AI scribes:
- Patient Consent: AI scribes functionally record consultations. Clinicians must obtain and document explicit patient consent before use. Without this, doctors risk breaching GDPR.
- Transparency & Trust: Doctors must openly explain the use of AI tools during consultations. Patients should never feel they are being covertly recorded.
- Data Security: AI tools must meet NHS standards for data protection. Practices should consult Caldicott Guardians or Data Protection Officers before adoption.
- Clinical Oversight: Doctors must validate the AI’s notes, correct errors, and ensure nothing clinically relevant is missed. MDDUS warns against assuming AI outputs are reliable by default.
Summary: MDDUS does not oppose AI scribes outright but urges that they are used with clear patient consent, robust data protection, and full clinical oversight.
View MDDUS advice on recordings
Final Note: All three defence organisations highlight that AI scribes must not undermine patient safety, trust, or clinical accountability. GPs are advised to ensure any use of AI complies with ethical, legal, and professional standards.
Legal disclaimer: This content is for general information only and does not constitute formal legal or clinical advice. Each practice is responsible for ensuring it meets NHS England standards, UK data protection law, and clinical safety obligations. Please consult your DPO, CSO, and legal advisers where necessary.
