Patient data. A regulator that expects a named person to answer for AI.
Clinicians and care staff use AI scribes and consumer tools for notes and admin. The Care Quality Commission (CQC) has set out its role and expectations on AI, and the NHS has issued fresh rules for ambient voice tools.
of GPs use AI scribes; most started without practice-level support
npj Digital Medicine, 2026of health and social care providers use AI, second lowest of twelve industries
Access, 2025, vendor surveyMHRA and NHS England clarified which scribe tools are medical devices
MHRA and NHS England, 2026AI supports people. It does not replace their judgement.
The CQC has published a paper on AI in health and social care covering its role, expectations and plans. Our reading, which you should check at source, is that it adds no separate AI rule book but expects providers to manage risk, protect data and keep clear accountability. On 29 July 2026 the Medicines and Healthcare products Regulatory Agency (MHRA) and NHS England said that tools used only to transcribe, summarise or draft letters for a clinician to review are not medical devices, while tools that support diagnosis or treatment, or act without clinician review, are. NHS organisations remain responsible for deploying them safely, with a clinical safety officer and a data protection impact assessment.
Summarised from MHRA and NHS England guidance (29 July 2026) and the CQC paper on AI (2026). Not legal or clinical advice.
Six problems that keep coming back.
Drawn from the regulators' guidance and from surveys of the sector.
Many clinicians started using scribes on their own. The practice or provider carries the duty of care for safety, consent and data, whoever bought the tool.
Notes, letters and referrals pasted into free assistants put special-category health data outside any agreement or record.
Whether a scribe is a medical device depends on what it is intended and marketed to do. Features added later can change the answer, and the provider has to notice.
Patients and families should know when AI listens or drafts. Few providers can show what they said and when.
When an AI output is wrong, there is rarely an incident record that links the tool, the version and the person who relied on it.
Hazard logs, safety cases and data protection impact assessments are needed for each tool. Small providers have no time to maintain them.
If something goes wrong, you will be asked what you knew.
A wrong summary in a patient record, a letter sent to the wrong person or a data breach involving health information brings the CQC, the Information Commissioner and the patient's family into the conversation. Providers that can show which tool was used, what consent existed and who reviewed the output are in a different position from those that cannot. For smaller providers, the cost is also staff time spent reconstructing events.
Governance can sit behind the tool, not in front of the clinician.
Clinicians will not add steps to a busy day. Rules, redaction and records can run in the background of the approved tool, and flag only what needs a person. That keeps scribes useful while giving the registered manager, the data protection officer and the clinical safety lead the evidence they need.
- Consultation notes and letters
- Rota, admission and resource planning
- Patient and family communications
- Referral and triage support
- Health data in consumer tools without consent
- Unregulated scribes in clinical use
- No incident record when an output is wrong
The audit produces a data-flow map for special-category data. Guard rules block health data from unapproved tools on connected, routed integrations and name where AI must not be used. The log serves as the incident record. People make clinical decisions, not the tool and not GenWA.
Four agents, trained for this sector.
The rules, as controls.
- CQC expectations on AI in health and social care (2026)
- MHRA and NHS England ambient voice guidance (29 July 2026)
- NHS Data Security and Protection Toolkit and Caldicott principles
- Clinical safety standards DCB0129 and DCB0160
- UK GDPR (special-category data)
- Data (Use and Access) Act 2025
Built around clinical governance in your setting.
GP practices, care homes and community providers govern differently. We shape each route to yours, and keep clinical decisions with clinicians.
An independent audit that maps where health data goes, with first findings in 48 hours and a plan for your governance meeting.
Start the health checkAdvice: policy and trainingAn AI policy, consent wording and staff training that fit your clinical governance, written for registered managers and data protection officers.
See advisoryProduct: control toolkitRegister, Guard rules, log and Evidence Packs, hosted in your AWS or Azure account, or GenWA AWS as agreed.
Find the right productProduct: agents at workPatient communications, referral summaries and invoices, with a named owner and staff approval.
Meet the teamIncubator: one admin functionWe define, build and run one controlled non-clinical function, such as appointment correspondence, in twelve weeks. You own the intellectual property.
See the incubatorAccelerator: for health and care technology foundersBy application only, ten places a year. Senior AI leadership time, advisory and platform access, paid for by equity, project, retainer or licence.
See the acceleratorWhat Guard and Evidence typically hold for this sector.
Control-mapped, not certified. We prepare the evidence; regulators and accredited bodies decide.
Safe, well-led and effective care questions, mapped to risk assessment, oversight and accountability records.
Device status, supplier checks and deployment duties for scribes.
NHS data security self-assessment and patient information principles.
Safety case duties for manufacturers and deploying organisations. Evidence feeds your clinical safety officer's file.
Special-category data, consent and automated-decision safeguards.
AI management and baseline cyber standards. Readiness evidence; accredited bodies certify.
Three role holders, three different problems.
Answers for safe, well-led care and has little time. GenWA gives a list of tools, a rule set and an incident record that stand up at inspection.
Must know where health data goes and on what lawful basis. GenWA maps data flows, blocks unapproved tools on connected systems and keeps redaction records.
Owns clinical risk. GenWA records which tool produced which output and who reviewed it, so safety learning and device-status checks have a trail.
From this sector.
What does GenWA do for care and healthcare providers using AI?
The audit produces a data-flow map for special-category data, and Guard rules block health data from unapproved tools on connected, routed integrations. Rules name where AI must not be used. The log serves as the incident record. People make clinical decisions.
Is GenWA a medical device?
No. GenWA controls, records and evidences the AI tools you use. It makes no clinical decisions or claims. Check your own device and safety obligations with the right adviser.
What do the MHRA and NHS England say about AI scribes?
On 29 July 2026 they said tools that only transcribe, summarise or draft for clinician review are not medical devices, while tools that support diagnosis or treatment, or act without review, are. NHS organisations remain responsible for safe deployment. Read the guidance at source.
What does the CQC expect?
The CQC has published a paper on its role and expectations on AI. We read it as asking for risk management, data protection and clear accountability, not a separate rule book. Check it at source. Compliance Mapping supports your own evidence and is not legal advice.
Will clinicians accept more admin?
Rules and monitoring run behind the approved tool, not in front of the clinician. We have no clinical workflow-impact evidence yet, so we quote no figure. Share your workflow and we will show the path.
Where is patient data stored if we use GenWA?
Hosting is your AWS or Azure account, or GenWA AWS as agreed. Personal data is redacted before approved external model calls. Coverage for health data and NHS data security requirements are confirmed in the security review.
How does a provider start?
Begin with the AI health check and the data-flow map. A usage-export check runs locally in the browser. First findings arrive within 48 hours and the audit with a 90-day plan within ten working days. The audit fee is credited in full against year one of a platform plan.
Do you know which tools hold your patients' data?
First findings within 48 hours of the health check. Audit fee credited in full against year one of a platform plan.