A care home's AI policy should cover six things: which tools are approved, what data may and may not go into them, UK GDPR duties including a data protection impact assessment, consent and transparency for residents, rules for staff phones, and human checking with named accountability. Keep evidence that you apply it: CQC judges AI use against its existing standards.
Policy writing goes wrong when it copies a generic template. A care home's risks are particular: residents who cannot easily object, staff who use their own phones, agency workers who never saw the induction, and records that other professionals rely on. The checklist and template below are written for that setting, and every item says why it is there and how you would prove it.
What CQC says, and what it does not
On 21 May 2026 the Care Quality Commission published Artificial intelligence in health and social care: CQC's role, expectations and plans. Read the current page yourself: CQC says it will keep the need for AI-specific guidance under review and may publish guidance tailored to different settings. As we read it on 4 November 2026, the principles that matter for a provider are these.
- AI supports and does not replace human decision-making. CQC says AI can enhance but not replace human decision making.
- Human oversight. Outputs and processes should be continuously monitored and evaluated.
- Transparency and choice. People should be given information about the role of AI in their care pathways, with non-digital routes offered where needed.
- Safety, reliability and fairness. Providers should be able to show that AI use gives safe, equitable care, and that known biases are mitigated.
- Security and data protection. Sensitive information is stored and processed securely to comply with data protection law (for a care home, UK GDPR), and a Data Protection Impact Assessment is listed as the way to assess and document risks to privacy.
- Readiness and training. Staff should be trained and confident.
- Governance and accountability. Systems to recognise, report and investigate when something goes wrong, and clear mechanisms for harm.
- Procurement. Tools procured in line with relevant regulatory standards.
Equally important is what the statement does not do. It does not set out a list of specific evidence providers must hold, it does not describe a separate notification process for AI incidents, and CQC says it does not assess or approve specific technologies. AI use is judged against the fundamental standards and other regulations, whatever the technology. So the policy's job is to produce evidence under the headings you already know: safe, effective, caring, responsive and well-led.
DHSC guidance, the Oxford Statement and the care workers' view
Three other documents are worth citing in your policy, because they say more than CQC about day-to-day use. The first is the Department of Health and Social Care's Using AI in adult social care, first published on 29 September 2026. It calls itself best-practice guidance, not a new rule, and four of its points map straight onto the checklist below.
- Have a policy, even a strict one. It says all organisations should consider having an AI policy, even one that bans staff from using AI for work, and that staff should be consulted on it.
- A human reviews every output. It recommends human review of any AI-generated output for accuracy, fairness and fit with your standards, and deciding who is responsible and accountable.
- No identifiable information in free tools. It advises against putting personally identifiable information into free or online AI tools, because without a contract with the supplier you cannot know how it will be kept or used.
- Choose tools against a written aim. It suggests defining what you want to achieve first, writing a specification, asking staff and the people you support, and weighing benefits against risks before you choose.
The same guidance suggests digital champions: staff who become the in-house point of contact for questions about a system. In a care home that can be one senior carer per shift, which also helps with the agency-worker gap described later.
The second is the Oxford Statement on the responsible use of generative AI in adult social care. It came out of a roundtable on 1 February 2024 at Reuben College, convened with the University of Oxford's Institute for Ethics in AI, the Digital Care Hub and Casson Consulting. It calls for a definition of care that recognises human rights and trusting human relationships, and for co-produced guidance. That work has since produced a set of "I" and "We" statements, published on the Digital Care Hub's Oxford Project pages. The provider statements commit to clear policies on how data is collected, stored and shared, to training staff, to giving staff the skills to overrule a system where needed, to monitoring for bias and to being open about when technology is used. Read those lines next to your draft: each one should have a matching clause.
The third is the care workers' own statement, published in September 2024 by the Care Workers' Charity with the Oxford institute and developed by frontline care workers. It asks employers for clear policies, proper training and transparent practices, and says responsibility for AI use should not rest on care workers alone. That makes a good test for any draft. If every rule puts the burden on the carer and none on the home (no approved tool, no training, no named owner), the policy fails the people it is meant to protect.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowThe checklist, with why and how to prove it
Use these as the headings of your policy. Each has a short reason and an evidence line, because an inspector asks "how do you know?"
1. Purpose, and who the policy covers
Why: staff need to know what the policy covers. Say: it applies to every employee, bank and agency worker, volunteer and contractor, on any device, for any AI tool (chat assistants, note-takers, translation, scheduling, image tools, AI features inside existing software). Evidence: signed acknowledgement in each staff file.
2. Approved tools register
Why: the biggest risk is unapproved use. Say: only tools on the register may be used for work; nothing else, even if free. The register lists each tool, its owner, its approved purposes, the data it may touch, the account type, the date of the DPIA and the review date. Evidence: the register itself, version-dated.
| Tool (example fields) | Approved for | Never for | Owner | Review |
|---|---|---|---|---|
| Business-plan chat assistant | Drafting newsletters, menus, rota notices, policies | Resident names, care records, medication, photos | Registered manager | Every 6 months |
| Care planning software's AI feature | Summarising notes, as the software supplier documents | Anything outside the care system | Deputy manager | On each supplier update |
| Free consumer chatbots | Nothing for work | All work use | Not approved | n/a |
3. Data rules: what may go in
Why: UK GDPR treats health information as special category data and sets conditions on how it is processed. Say: no resident or staff personal data in any tool that is not approved for it; for approved tools, only the data listed on the register. Nothing identifying a resident goes into a general chat tool, including first names, room numbers, descriptions or photographs. Evidence: the register, the DPIA and spot checks.
4. Data protection impact assessment
Why: CQC lists a DPIA among its AI principles, and UK GDPR requires one before processing that is likely to result in a high risk to people's rights, particularly with new technology. Say: a DPIA is completed and reviewed by your data protection lead before any tool that could touch personal data is approved. It covers what data, where it is processed, who the supplier is, retention, access, what happens when the tool is wrong, and alternatives. Evidence: a signed DPIA per tool, linked to the register.
5. Consent and transparency
Why: residents and families are entitled to know how information about them is used, and CQC's principles include transparency and non-digital alternatives. Say: where AI is used in connection with a resident's care or records, residents and, where appropriate, their representatives are told in plain words, and can ask for a non-AI route. Where the resident lacks capacity, follow your mental capacity and best-interest processes. Evidence: privacy notice wording, resident and family information sheet, a record of conversations.
6. Human checking and accountability
Why: AI can be wrong in fluent language. Say: a named, trained member of staff checks every AI output before it enters a record, a care plan, a letter or a message to a family. Nothing generated is used for a clinical, safeguarding, medication or capacity decision. The registered manager is accountable for the policy. Evidence: a short log of AI-assisted documents, with the checker's initials.
7. Staff phones and personal devices
Why: a carer pasting a handover note into a phone app is the most likely breach in a care home. Say: personal phones are not used for AI tools in connection with work, residents or colleagues. No photographing or recording residents. No dictation of care notes into personal apps. Approved apps on work devices only. This matches the DHSC advice to keep personally identifiable information out of free or online tools. Evidence: induction record, device policy, a quick check in supervision.
8. Procurement and supplier checks
Why: CQC expects tools procured in line with relevant standards. Say: no tool is bought or switched on until the owner has checked the supplier's data processing terms, where data is stored, whether data is used for training, retention and deletion, security certification, and what the contract says about errors. Evidence: a supplier questionnaire on file. The tutorial on care home software and AI questions lists what to ask.
9. Training and induction
Why: CQC says staff should be trained and confident. Say: a 20-minute induction module for every new starter and a yearly refresher, covering what is approved, what is banned, how to check output, and how to report a problem. Evidence: training records.
10. Incidents, errors and near misses
Why: CQC expects systems that recognise, report and investigate when something goes wrong. Say: any suspected AI error, unapproved use or data leak is reported the same day to the manager, logged like any other incident, and reviewed for learning. A suspected personal data breach follows your data breach procedure. Evidence: incident log entries and learning notes.
11. Monitoring and review
Why: outputs should be monitored and evaluated continuously. Say: the manager reviews the register, the log and any incidents quarterly, and the whole policy every six months or when a tool, law or CQC guidance changes. Evidence: dated review minutes.
A template wording you can adapt
This is illustrative wording to adapt with your data protection lead, your governance team and, if you wish, an adviser. It is not legal advice.
AI use policy. This policy applies to everyone who works at [home name], including bank, agency and volunteer staff. AI means any tool that generates text, images, summaries, translations or recommendations, including features inside software we already use.
1. You may use only tools on the Approved AI Register, for the purposes listed there.
2. You must never enter a resident's or colleague's name, details, photograph, voice recording or care record into any tool that is not approved for that data.
3. You must not use AI on a personal phone or account for work involving residents.
4. AI output is a draft. You must check it, correct it and take responsibility for it before it goes into any record or message. AI must never be used to make a clinical, medication, safeguarding or capacity decision.
5. Residents and families will be told where AI is used and may ask for a non-AI alternative.
6. Report any error, unapproved use or data leak to the manager on the day.
7. The Registered Manager is accountable for this policy, which is reviewed every six months.
Notice how short it is. A policy that staff cannot remember is not followed. Keep the policy to one page and put the detail in the register and the DPIAs.
Worked example: a 40-bed home deciding its first approved tool
Say a 40-bed residential home wants AI to help with newsletters, activity programmes and staff rota notices. The manager lists three candidate uses and scores each for risk. Newsletter drafting and activity ideas need no personal data at all. Rota notices use staff names. Handover note summaries use resident information.
The manager approves the first two for a business-plan chat assistant, with a rule that the prompt contains no names. The third is deferred until a DPIA is done and the care software supplier's own feature is assessed, because that tool already sits inside the care record. Illustrative time: drafting the register entry and DPIA for the first tool takes about 4 hours, an induction module another 3 hours to write, and a quarterly review about 1 hour. In return the newsletter and activity pack drop from about 3 hours to 1 hour 15 minutes a week. These are illustrative numbers, and the home should count its own.
The important feature of this approach is the order: low-risk uses first, because they let staff learn the habits (check the output, keep names out) before any resident data is involved. The 90-day implementation plan for care homes develops this staged approach.
Four examples of the policy at work
A carer wants to translate a message for a resident's relative
The policy says no resident details in a non-approved tool. The approved route is a translation service on the register, or an interpreter, with the manager's approval. The carer asks; the manager decides; the message is checked by someone who speaks the language where possible.
An agency worker uses a note-taking app on their phone
The induction pack, signed on day one, says no personal apps. The manager spots it at handover, stops it, records an incident, checks whether any resident data was captured, deals with deletion and follows the breach procedure if needed. The learning point goes into induction.
The care software releases an AI summary feature
The tool is on the register as "not yet approved". The deputy manager asks the supplier the questions in the checklist, completes a DPIA, pilots it with two senior carers for a month, and records what was wrong in outputs. Only then does the register change.
A relative asks whether AI wrote the care plan review
The manager can answer plainly: where AI helped, a named member of staff checked and owns every statement, and the relative can ask for a non-AI route. That answer is credible because the log exists.
A DPIA outline for the first tool, filled in
If you have never written a data protection impact assessment, a one-page structure makes it manageable. Illustrative entries for a chat assistant approved only for newsletters and activity ideas:
| Question | Illustrative answer |
|---|---|
| What will the tool be used for? | Drafting newsletters, activity programmes, menu descriptions |
| What personal data may enter it? | None. Staff are told never to type resident or colleague details |
| Who is the supplier and where is data processed? | Recorded from the supplier's current terms, with the date checked |
| Is data used to train models? | Per the plan terms on the check date; business plan chosen for that reason |
| How long is data kept? | Per the plan settings; history switched off where possible |
| What could go wrong? | A carer pastes a name; output contains an invented fact |
| What controls reduce the risk? | Induction, a no-names rule, manager check before publication |
| Residual risk and decision | Low; approved for six months, then review |
The strength of a DPIA like this is that it can say "none" honestly. The harder DPIAs are for tools that do touch resident data, such as voice note-takers, and those need a data protection adviser and a close look at supplier terms.
A one-page card for the staff room
Staff will not read the policy, but they will read a card. Illustrative wording:
AI at [home name]: the four rules. 1. Only use the approved tools on the list. 2. Never put a resident's or colleague's details, photo or voice into any AI tool. 3. No AI apps on your own phone for work. 4. Check everything AI writes, and own it. Not sure? Ask [manager name] before you try. Made a mistake? Tell us the same day. Nobody is in trouble for reporting.
That last sentence matters. A blame culture hides incidents, and CQC's expectation is that you recognise, report and investigate when something goes wrong.
Gaps to watch in your first version
- The policy covers chat tools but not AI built into existing software. Many products now add AI features after an update. Ask suppliers to tell you, and keep the register current.
- Agency and bank staff miss induction. Put a one-page summary in the staff room and in the agency welcome pack.
- No owner per tool. A tool with no named owner is a tool nobody checks.
- The policy bans everything and gets ignored. Give staff an approved route for common needs, such as drafting.
- Evidence lives only in someone's head. Save the register, DPIAs, training records and logs where an inspector can see them.
To test whether your evidence holds up, run a mock inspection and see what you can show. For the data protection basics behind the policy, see GDPR and AI tools. For a first low-risk use case, AI for facility management in a care home is a good start. The overall picture is in the AI guide.
Spot checks that show staff follow the policy
- Ask three staff, at random, to tell you which tools are approved and what they must never type. If they cannot, simplify and retrain.
- Check the AI log against the register once a quarter. Any use outside the register is a finding.
- Count reports of errors and near misses. Zero for a year can mean good practice or that nobody is reporting.
- Look at the register for tools used but not listed, by asking the team what they use on the job.
- Re-read CQC's current statement, the DHSC guidance and the Oxford Project pages twice a year, and note the date you did.
Questions care home managers ask about an AI policy
Does CQC require a written AI policy?
CQC judges AI use against the fundamental standards it already applies, not a separate rulebook, and says it may publish more tailored guidance. Its statement does not demand a written AI policy, but the DHSC guidance on AI in adult social care says all organisations should consider having one, and a policy is the clearest evidence of governed use.
Do we need a DPIA before staff use an AI tool?
CQC lists a Data Protection Impact Assessment among its principles for AI, and UK GDPR requires one before processing that is likely to result in a high risk to people's rights, especially with new technology. If any resident or staff personal data could reach a tool, do one first, and ask your data protection officer or adviser to review it.
Can carers use ChatGPT on their own phones?
The safe default is no for anything touching residents. Unapproved tools on personal phones bypass your controls, your retention rules and your contracts, and the DHSC guidance advises against putting personally identifiable information into free or online AI tools at all. State this plainly in the policy, and give staff an approved alternative so the rule is realistic.
Do residents and families need to be told?
CQC's principles include transparency: people should have information about the role of AI in their care pathways and a non-digital route where needed. Tell residents, relatives and staff where AI is used, in plain words, and record how and when.
Who is accountable if an AI tool gets something wrong?
The registered provider and manager remain accountable. A tool cannot take responsibility. Name an owner for each approved tool, require a named person to check outputs, and keep a route for staff to report errors and near misses.
Further reads
- AI Consultant for a Care Home: Do You Need One, and What to Ask — Whether you need outside help and what to ask.
- Are ChatGPT, Claude, Gemini and Copilot GDPR-Compliant? — How the main chat assistants stand on GDPR.
- How to Roll Out an AI Policy So Staff Actually Follow It — Getting staff to follow a policy once it is written.
- What to Check in an AI Tool's Privacy Policy and Terms — What to read in a vendor's privacy policy and terms.
- Home Care Agency AI: A 90-Day Plan for the Owner — A staged plan for a home care provider.
- Telling Patients You Use AI Note-Taking: Consent Wording That Works — Consent wording for AI in notes.
- Home Care Agency Software Pricing: What the AI Features Add — What home care software costs on its own, what the AI features add on top, and how to price a 15-person agency three ways.
- AI Answering Service for Home Care Agencies: After-Hours Call-Outs — How a home care agency can use an AI answering service for sickness call-outs and urgent calls: scripts, escalation timers, message log and monthly costs.
- AI Tools for Nurses Who Run a Team: Rotas, Handover and Audits — A nurse manager's guide to AI for rotas, handover templates and audit write-ups, with a clear list of what must never go into a prompt.
- AI for Dementia Care Providers: Life-Story Profiles and Activity Plans — A provider-side workflow for dementia care: life-story profiles, activity plans and family updates drafted by AI, then consented, checked and filed by staff.
- CQC Statement of Purpose Template: Draft Yours With AI and Check It — Draft a CQC statement of purpose with AI from facts you supply, then check every line against your registration, sign it off and set review dates.
- Care Home Activities Calendar: Plan a Month With AI and Resident Input — Turn coded resident interest sheets into a monthly activities calendar with group and one-to-one slots, a printable version and a staff check.
- Care Home Audit Checklist: A Monthly Round Logged and Actioned With AI — A monthly care home audit checklist with scoring, an AI summary built from counts only, and an action log with owners and dates.
- Care Home Daily Notes: Better Wording With AI, Checked by Staff — Before-and-after wording for care home daily notes, and the manager's sampling routine that keeps AI from adding anything that did not happen.
- Care Home Enquiry Form Template: Capture and Answer Leads With AI — A care home enquiry form template with field-by-field reasoning, fee and funding questions, tour booking and AI-drafted first replies.
- Care Home Medication Audit: A Monthly Template and AI Action Log — A monthly medication audit checklist for care homes: records and counts only, anonymous summaries and a signed action log.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: CQC, Artificial intelligence in health and social care: CQC's role, expectations and plans (21 May 2026) and its five key questions page; DHSC, Using AI in adult social care (29 September 2026); Institute for Ethics in AI, Oxford Statement on the responsible use of generative AI in adult social care; Digital Care Hub, Oxford Project guidance (I and We statements) and Care Workers' statement; UK GDPR Articles 9 and 35 (legislation.gov.uk); OpenAI business data and Anthropic privacy centre pages. All checked 4 November 2026; check each for the current version.