# AI in general practice: what CQC will look at

Published 1 October 2026 in Evidence and compliance by CQC AI Auditor team. Source: https://www.cqcaudit.ai/blog/ai-general-practice-cqc-inspection-preparation

**In short:** CQC does not assess or approve AI products, and it has said that "the absence or presence of AI does not predict a specific rating." What it does assess is how your practice governs the tools it uses. For AI in general practice, CQC's GP mythbuster 109 lists ten areas inspectors will look at, from procurement and hazard logs to human oversight, consent and digital exclusion, and CQC's May 2026 position sets out eleven principles providers "must follow". This guide takes both apart and turns them into a list of what to have ready.

AI is arriving in general practice in several forms: ambient scribes that write up the consultation, online triage that sorts requests before a clinician sees them, and tools that process results and draft letters. In July 2026 NHS England began rolling out an AI triage tool inside the NHS App, which it says will reach more than 200,000 patients within twelve months and all NHS App users by April 2028.

Two questions follow for any practice. Will CQC mark us down for using AI? And what does it want to see? On the first, CQC says it is "committed to encouraging the use of innovative technology in health and care where it benefits people who use services." The second is the point of this guide to CQC's AI guidance.

## What CQC has published

Two documents matter.

[**GP mythbuster 109: Use of artificial intelligence (AI) in GP services**](https://www.cqc.org.uk/guidance-regulation/gps/gp-mythbusters/gp-mythbuster-109-artificial-intelligence-gp-services), published 14 July 2025, is written for general practice and is the one an inspector will have in mind. One line at the top is easy to miss: "This guidance applies to IT-based and digital solutions used in a practice as well as AI tools." If your practice has an online consultation or triage platform, the same expectations apply whether or not the supplier calls it AI.

[**Artificial intelligence in health and social care: CQC's role, expectations and plans**](https://www.cqc.org.uk/about-us/transparency/artificial-intelligence-health-social-care-cqcs-role-expectations-plans), updated 21 May 2026, is CQC's position on artificial intelligence across all sectors. It lists the benefits and risks CQC sees, links AI to the regulations it enforces, and sets out eleven principles.

CQC's opening line in the mythbuster: "Using artificial intelligence (AI) in general practice has potential benefits for delivering care, but its use must align with regulatory requirements and good clinical governance to ensure safe and compliant implementation in healthcare delivery."

## What CQC means by AI

The mythbuster defines AI as "Technologies that simulate human intelligence to perform complex tasks by learning from data on how to complete those tasks", as distinct from rules based automation that produces "the same outcome for a given input every time". It lists the tools it expects in general practice: ambient voice technology, or AI scribes; AI triage tools; results processing; clinical documentation tools; diagnosis and treatment planning tools; chatbots and generative AI; and predictive modelling for things like missed appointments and rostering. One aside worth passing to clinicians: on using general purpose chatbots to support diagnosis and treatment planning, CQC notes that "this is not recommended."

## The ten things CQC will look at

CQC's own framing in the AI mythbuster: "We may not look at every quality statement and associated regulation under a key question when we assess your practice. But our assessments will focus on your systems and processes to ensure the safe and compliant use of AI. We will look for evidence of this in the following areas."

**1. Procurement and governance.** Any AI tool "must have been procured in line with relevant evidence and regulatory standards (DCB0160, DTAC, MHRA registration (if applicable)." CQC will check it is used appropriately "by reviewing your clinical governance arrangements." For a tool from an NHS procurement list, it is reasonable to assume developer standards were met, "but there is still the need to ensure that it is deployed in line with its intended purpose and evidence of regulatory standards reviewed."

**2. Risk assessment.** "Your practice should have a hazard log and risk assessments completed in relation to AI tools."

**3. Responsibilities.** "There should be a responsible CSO and digital lead for AI technologies and related clinical governance. They should have completed relevant training." CSO means clinical safety officer. To comply with DCB0160, a GP practice adopting new digital technology must nominate one: a senior clinician with current registration with a professional body such as the General Medical Council or the Nursing and Midwifery Council, trained in digital clinical safety. If the practice does not have that expertise, CQC says it may be appropriate to ask the commissioning organisation, the primary care network or a third party for advice.

**4. Human oversight.** "You need to demonstrate that AI is being used as a support tool – not a replacement for human oversight. We will check that this is happening through your audits, a significant incident log or other quality improvement activity." CQC is telling you which evidence it will use.

**5. Learning from errors.** "If something goes wrong, we will check for established systems to report and investigate occurrences. This includes reporting to software developers as well as through the MHRA Yellow Card system." Lessons should be shared internally, with the CSO, and externally, including through the Learn From Patient Safety Events (LFPSE) service where patient safety is at risk.

**6. Data protection.** "All practices should be able to demonstrate how third-party venders have met assurances on how data is shared, stored or used." CQC's examples: UK GDPR compliance including a record of processing activities, data protection impact assessments, cybersecurity arrangements and the Data Security and Protection Toolkit.

**7. Consent.** "The type of consent required (implied or explicit) will be determined by the type of AI technology and its intended use." But "as AI technologies are new, you do need to tell people that you are using them. This is about being transparent and allowing people to object, rather than asking for explicit consent." For an AI scribe in a GP practice, implied consent under the common law duty of confidentiality is appropriate, "But, as AI scribes are new, you do need to tell patients they're being used."

**8. Staff training.** "Staff should have received appropriate training to be competent to use AI tools."

**9. Equity in access.** "People should not be digitally excluded. It is essential that practices offer a non-digital route to access care, along with digital ways."

**10. Managing bias.** "There may be possible bias in AI around certain population groups, based on the quality of data that was used to develop it. You should seek assurance on mitigating that risk."

## The medical device question

One paragraph catches practices out: "If you use an AI tool in your practice that influences clinical decision-making, it is likely to be qualified as a medical device under MHRA regulations." CQC says to ask AI companies for evidence of MHRA registration, UKCA or CE marking, and device classification and clinical safety documentation, and that the manufacturer "must know and disclose this information if the product is regulated." Registered devices can be searched on the MHRA's public access registration database, PARD. The practical step: for every tool that touches clinical decisions, keep the supplier's regulatory documents in the same folder as your DPIA and hazard log.

## CQC's eleven principles

CQC's May 2026 position connects AI to the [regulations](https://www.cqc.org.uk/guidance-regulation/providers/regulations) it enforces: Regulation 9 (person-centred care), 10 (dignity and respect), 11 (consent), 12 (safe care and treatment, "ensuring equipment, for example AI is safe") and 17 (good governance). It then says using AI in line with the regulations "means providers must follow the following principles":

1. **AI to support, not to replace.** "AI can enhance, but not replace human decision making."
2. **Human oversight.** "AI outputs and processes are continuously monitored and evaluated."
3. **Transparency and choice.** Information for people "including the role of AI in care pathways. Non-digital routes to care are offered if needed".
4. **Safety and reliability.**
5. **Security.** Resilient to cyber attack, with sensitive information stored and processed in line with GDPR.
6. **Fairness and impartiality.** Accurate results across population groups, with known biases mitigated.
7. **AI readiness and training.**
8. **Effective governance.** Risk assessments, and "established systems to recognise, report and investigate when something goes wrong".
9. **Data Protection Impact Assessment.**
10. **Accountability.** "There are clear mechanisms for addressing issues or harm caused by AI."
11. **Procurement.** "AI tools are procured in line with relevant regulatory standards."

> Read together, the ten areas and the eleven principles are the same expectations from two angles: a clinical safety framework around each tool, a named person responsible, humans checking outputs, patients told, a non digital route kept open, and evidence that you learn when something goes wrong. The same document carries the line practices most want to hear: "the absence or presence of AI does not predict a specific rating."

## The risks on CQC's mind

Among the risks CQC lists: AI "can make mistakes, and lead to misdiagnoses, which can be difficult to spot"; it "can hallucinate and present untrue information, authoritatively as fact"; and "if things go wrong, accountability and liability can be unclear". GPs share the worry. In the [Nuffield Trust and RCGP survey](https://www.nuffieldtrust.org.uk/research/how-are-gps-using-ai-insights-from-the-front-line) published in December 2025, 89% of GPs not using AI raised professional liability and medico legal issues as a concern, and 88% raised lack of regulatory oversight. CQC's two documents do not regulate the tools themselves. They set out what CQC expects from a practice that uses them.

## The NHS App triage rollout does not change the rules

On 4 July 2026 [NHS England announced](https://www.england.nhs.uk/2026/07/nhs-accelerates-artificial-intelligence-rollout-to-cut-waiting-times-and-improve-care-for-millions/) that the NHS App's AI triage tool "is being rolled out following a successful trial. It is due to reach more than 200,000 patients within the next 12 months and be available to all NHS App users by April 2028." The tool adapts its questions to the patient's answers, then "either directs them to the most appropriate service or provides clinicians with the information they need to prioritise care." NHS England reported a 29% reduction in people queuing on the phone at the Sussex practice that ran the trial, and said patients "will continue to have the option of using traditional methods to contact their GP practice".

For a practice, two things follow. AI triage that arrives through the NHS App is still an AI tool your practice uses, so the ten areas apply: who is the CSO, where is the hazard log, how are outputs checked, how do patients who do not use the app get in. And the non digital route is not optional; it is in NHS England's announcement and it is number nine on CQC's list. The GP whose practice ran the trial put the oversight point well: "It hasn't replaced our judgement – it's given us back the time to use it."

## What to have ready

For each AI or digital tool in the practice:

- The procurement record, with DTAC and DCB0160 evidence, and the supplier's MHRA registration, marking and classification where the tool influences clinical decisions.
- A hazard log and clinical risk assessment, with the clinical safety case report and risk management plan where the standard requires them.
- A named clinical safety officer and digital lead, with training recorded.
- Evidence of human oversight: an audit of the tool's outputs, significant event entries, or quality improvement work showing outputs being checked.
- An incident route that includes the supplier and the MHRA Yellow Card scheme, and a record of lessons shared.
- A DPIA, the record of processing activities and the supplier's data assurances, alongside your DSPT.
- The patient notice: how patients are told the tool is in use and how they can object.
- Staff training records for the tool.
- The non digital route, written down and working, with what you have done about digital exclusion.
- The assurance you sought on bias.

> These records are processes evidence under quality statements CQC already assesses: safe environments covers equipment and technology, safe and effective staffing covers training, learning culture covers incidents, equity in access covers the non digital route, and governance, management and sustainability covers the lot. Our [guide to the 34 quality statements](https://www.cqcaudit.ai/blog/cqc-quality-statements-gp-practices-evidence-examples) shows what CQC usually looks at under each.

## One supplier's answer

We build an AI tool for GP practices, so it is fair to ask how we answer the same questions. Our [Trust and data](https://www.cqcaudit.ai/trust-and-data) page sets out what happens to the documents a practice uploads: stored so the audit can read them, deleted automatically 60 days after the audit completes, and processed by our AI provider through its API. The Auditor writes out the reasoning behind every score, so you can see why it reached each one and check it against what you know. It supports a consultant and your own professional judgement rather than replacing them, and it is independent of CQC and not endorsed by it.

If you want to know where your practice stands before anyone asks, the free self check covers every quality statement, and the [AI assisted audit](https://www.cqcaudit.ai/how-it-works) reads the documents you actually hold, such as a hazard log, a DPIA or a training record, and scores what you can show. [Start your free self check](https://www.cqcaudit.ai/) at cqcaudit.ai.

## Frequently asked questions

**Will CQC mark my practice down for using AI?**

> CQC says it is committed to encouraging innovative technology where it benefits people, and that "the absence or presence of AI does not predict a specific rating." What it assesses is how the tool is governed.

**Do we need a clinical safety officer to use an AI scribe?**

CQC's mythbuster says DCB0160 requires adopters of new digital technologies to nominate a clinical safety officer, a senior registered clinician trained in digital clinical safety, and that inspectors will look for a responsible CSO and digital lead. If the practice lacks the expertise, CQC suggests asking the commissioning organisation, the primary care network or a third party.

**Do patients have to consent to an AI scribe?**

CQC says implied consent under the common law duty of confidentiality is appropriate for an AI scribe used to deliver individual care, but because the technology is new you do need to tell patients it is being used and allow them to object.

**Is an AI triage tool a medical device?**

CQC says an AI tool that influences clinical decision making "is likely to be qualified as a medical device under MHRA regulations", and that you should ask the supplier for its registration, marking and classification.

## Ask us

We do not run comments on Insights. If there is a tool or a scenario you want us to cover, ask on [our LinkedIn page](https://www.linkedin.com/showcase/cqc-ai-auditor/) or reply to the newsletter.

## Sources

- CQC, [GP mythbuster 109: Use of artificial intelligence (AI) in GP services](https://www.cqc.org.uk/guidance-regulation/gps/gp-mythbusters/gp-mythbuster-109-artificial-intelligence-gp-services) (14 July 2025). Read 1 October 2026.
- CQC, [Artificial intelligence in health and social care: CQC's role, expectations and plans](https://www.cqc.org.uk/about-us/transparency/artificial-intelligence-health-social-care-cqcs-role-expectations-plans) (21 May 2026). Read 1 October 2026.
- NHS England, [NHS accelerates artificial intelligence rollout to cut waiting times and improve care for millions](https://www.england.nhs.uk/2026/07/nhs-accelerates-artificial-intelligence-rollout-to-cut-waiting-times-and-improve-care-for-millions/) (4 July 2026). Read 1 October 2026.
- Nuffield Trust with RCGP, [How are GPs using AI? Insights from the front line](https://www.nuffieldtrust.org.uk/research/how-are-gps-using-ai-insights-from-the-front-line) (3 December 2025). Read 1 October 2026.
- CQC, [Regulations for service providers and managers](https://www.cqc.org.uk/guidance-regulation/providers/regulations) (7 July 2025). Read 1 October 2026.
- cqcaudit.ai, [Trust and data](https://www.cqcaudit.ai/trust-and-data). Read 1 October 2026.