AI in Private Clinics: Your Responsibilities Now, and What the Commission Proposes Next

Existing responsibilities apply when a clinic introduces AI. The following areas deserve review before deployment.

Registration and governance. CQC-registered providers in England must meet the fundamental standards, including safe care and treatment under Regulation 12 and good governance under Regulation 17. Regulation 17 requires systems to assess, monitor and improve quality and safety, and accurate records. A tool that shapes a clinical record or patient correspondence sits inside that scope whether or not anyone filed it as a governance matter. This article focuses on England. Providers elsewhere in the UK need to check their own regulatory arrangements. See CQC’s Regulation 17 guidance.

Data protection. Where material from a consultation identifies a patient and contains or reveals information about their health, it is special category data under UK GDPR Article 9 and needs an Article 9 condition alongside a lawful basis. The common law duty of confidentiality also needs to be addressed. The clinic’s adviser should review the proposed use against applicable data protection principles, including minimisation, accuracy, retention and security.

Do not assume your AI supplier is your processor. Whether a supplier acts as processor, independent controller or joint controller turns on who determines the purposes and means, and it can differ between activities inside one product. Returning a draft note to you, and using consultation content to improve the supplier’s own model, do not necessarily sit in the same category. Article 28 contract terms apply where the supplier is a processor. Establish and document the status for each activity before go-live; contractual labels alone do not settle it. See the ICO’s controller and processor guidance.

DPIA. A DPIA is required where processing is likely to result in a high risk to individuals. The ICO’s published list requires a DPIA for innovative technology, including AI, when combined with another specified criterion, such as sensitive data. Large-scale processing of special category data also requires a DPIA. Document the screening decision and complete any required DPIA before processing starts. The clinic retains responsibility for that decision, supported by its DPO or data protection adviser. See the ICO’s DPIA guidance.

MHRA guidance published on 29 July 2026 gives examples of administrative transcription, summarisation and letter drafting for clinician review that do not qualify as medical devices. Its non-device coding example matches explicitly stated clinical terms; it does not infer diagnoses from implicit information.[1]

Products intended for diagnosis, treatment or other medical purposes require a different assessment. The manufacturer’s intended purpose, including its instructions, labelling and promotional claims, matters. Calling a feature “administrative” does not settle the position if other claims and functions indicate a medical purpose.

The guidance clarifies existing law. Non-device status does not establish that a product is safe to deploy in your clinic. Confirm the intended use, human review arrangements and supplier evidence, and obtain specialist determination where the position is unclear.[1][2]

Using AI to prepare a draft does not remove professional responsibilities for accurate records, confidentiality and communication with patients. The clinic needs a defined review and approval process. GMC Good medical practice, paragraphs 69–71 and GDC Principle 4 set out record-keeping and information responsibilities.

One more that gets missed. Ask your indemnity provider directly whether AI-assisted documentation changes anything about your cover, and get the answer in writing before rollout.

The MHRA-established National Commission published 44 recommendations on 10 September 2026. Professor Alastair Denniston chaired it, with Professor Henrietta Hughes OBE as Deputy Chair. It proposes lifecycle regulation, system-wide responsibility, and greater trust and transparency.[3]

The proposals create no new duties by themselves. The report says a separate government response will follow.

For providers, Recommendation 24 addresses responsibility across the lifecycle; Recommendation 28 addresses contractual allocation of required risk controls and regulatory commitments; Recommendation 35 addresses patient transparency, including opt-out where possible or appropriate. See Chapter 2 sections 2.1 and 2.2, and Chapter 3’s Recommendation 35.[3]

The report also describes perceived “liability sinks”, where clinicians and providers can bear responsibility without sufficient recognition of product and system design. This supports clarifying responsibilities and escalation arrangements before deployment.[3]

Read Recommendation 28 as a signal about your next contract renewal. A clinic that already knows which risk controls it holds will have a shorter conversation than one working it out at the table.

Each question below ends in a decision with a named role.

In a small practice, the registered manager, practice manager and clinical lead may share these responsibilities or one person may hold several roles. Record who performs each task and where specialist advice is needed.

ELSA AI works with private healthcare providers that procure and use third-party AI. We review governance evidence, identify gaps and prepare decisions for accountable leaders and their advisers. The Diagnostic does not include model testing or patient-record sampling.

GenAI Assure v2.1, authored by Faisal Ali and owned by ELSA AI LTD, contains 115 individually testable controls across 17 domains. It is publicly available under CC BY-ND 4.0 and addresses control applicability, ownership and evidence.

ELSA AI applies relevant framework requirements within agreed engagements. The clinic Diagnostic uses its own controlled 13-domain assessment; it does not apply every cross-industry control to every clinic or establish operating effectiveness through documents alone.

Clinical AI Exposure Diagnostic, Standard route: £5,500 + VAT. The nine-part pack is delivered by the end of Working Day 4 from the confirmed Evidence-Ready Start Date. The Standard scope covers one site, up to 60 staff, five AI tools or use cases, five suppliers and 25 evidence documents, across one clinical specialty. It excludes ambient scribe, AI transcription or consultation note-generation use, trial or plans, and NHS contractual or data-sharing arrangements in scope.

Diagnostic with Ambient Scribe Assessment: £8,500 + VAT. This is a separate six-working-day engagement from the confirmed Evidence-Ready Start Date. The scribe assessment runs through the evidence pack and reviews reported workflow, patient information and objection arrangements, retention and supplier evidence, clinician review and specialist referral needs.

Larger or more complex engagements are scoped and priced in writing before work begins. See full pricing and scope.

Your clinic completes the leadership intake and interview, supports and closes the confidential role-level Staff AI Use Survey, and supplies available evidence or formally confirms what is unavailable. Evidence can include supplier documents, policies, configuration records and workflow descriptions. Do not submit identifiable patient records, consultation audio or transcripts.

The Evidence-Ready Start Date is confirmed in writing after the engagement letter and initial payment requirements are satisfied, intake and interview are complete, the survey has closed with the required non-disciplinary assurance recorded, and evidence is submitted or formally confirmed unavailable. ELSA AI also confirms the route, scope, fixed fee and delivery dates in writing.

The four- or six-working-day period begins at that confirmed date, not at first enquiry. Missing documents do not have to delay the start indefinitely: confirmed absence becomes part of the evidence position. A 60-minute remote leadership readout follows pack delivery at a mutually agreed time.

Clinical AI Safe Usage Launchpad develops the agreed governance baseline from accepted findings. Work can include policies, registers, staff guidance, patient information and incident processes; the fixed fee and timeline are confirmed before commitment.

AI Exposure Sentinel maintains an adequate governance baseline through quarterly review on an annual agreement. It addresses changes in tools, supplier information and reported use. A baseline created elsewhere requires an adequacy review before maintenance begins.

Record both a review date and the changes that require earlier reconsideration.

Set the triggers: a new AI function, changed supplier terms, use with a different patient group, altered information flows, or an incident. Add a standing review of corrections, complaints and staff concerns, to identify emerging problems in practice.

Assign a person to assess each material change and record the resulting decision.