AI governance and adoption in UK healthcare
Healthcare has the tightest constraints of any sector adopting AI in the UK. Clinical safety, patient confidentiality and medical device regulation all apply before a tool reaches a ward or a triage queue. This hub sets out where AI is genuinely useful in healthcare, the risks that stop deployments, and the governance evidence organisations are expected to hold.
Who regulates this: MHRA, CQC, ICO, NHS England, NICE
Last reviewed: 18 August 2026
Where the risk sits
Clinical safety and patient harm
Any AI that informs clinical decisions can contribute to harm. Whether DCB0129 (manufacturers) or DCB0160 (deploying organisations) applies, and how, depends on the specific system and who is putting it into use — organisations should confirm applicability for each deployment rather than assume a blanket requirement.
Medical device classification
Software with a medical purpose — diagnosis, prevention, monitoring or treatment — may be regulated as a medical device, which changes what evidence and conformity marking is required before use. Classification depends on the product's intended purpose.
Patient data and special category processing
Health data is special category personal data under UK GDPR. A Data Protection Impact Assessment is required where the processing is likely to result in a high risk to individuals — for example novel AI processing of identifiable patient data — not automatically for every use of patient data. Organisations should assess each use case rather than assume a DPIA is always needed.
Bias and health inequality
Models trained on unrepresentative populations can perform unevenly across ethnicity, age and deprivation, creating equity risk as well as clinical risk.
Controls that make a rollout defensible
- Clinical safety assurance appropriate to the system, with a named responsible clinical safety officer where DCB0160 applies
- DPIA screening for each new AI use case involving patient data, completed in full where high risk is identified
- Human clinician review retained for any output that influences care
- Documented evidence of model performance on a population comparable to yours
- Incident reporting route that treats AI failures as clinical incidents
This page is guidance, not legal, clinical, financial or other professional advice. It is general information about UK regulatory context and does not account for your specific circumstances. Take professional advice before acting. See our editorial policy.
Sources
Frequently asked questions
Can NHS organisations use general-purpose AI assistants?
Non-clinical administrative use is common where no patient-identifiable data is entered and local information governance approval is in place. Clinical use carries medical device and clinical safety considerations that need to be assessed for the specific product before use.
Does AI scribing need medical device approval?
It depends on function. Transcription and note drafting with clinician sign-off is usually not a medical device, but anything that interprets findings or suggests diagnoses may be. Take regulatory advice on the specific product claim.