CQC and GP Practices: Build an Evidence Folder With AI

A GP practice can organise its CQC evidence by building a folder with one section for each of the five key questions (safe, effective, caring, responsive, well-led), one sub-folder for each quality statement, and an index that says what each document shows. AI can sort, label and summarise practice documents; the practice manager chooses what counts as evidence.

Guides from the regulator explain what inspectors look at. They do not tell a practice manager where a clinical audit, a significant-event review or a complaints summary should live so it can be found in two minutes. That is the job here: a folder structure, an evidence index, a policy review log and a mock-inspection summary, with AI doing the boring sorting and a person doing the judging.

Follow me on Instagram@sagnikteaches

Which framework to build around

CQC regulates health and social care in England, so this folder is for practices there. Its assessment framework, as the pages stood in late October 2026, asks five key questions (is the service safe, effective, caring, responsive and well-led?) and sets quality statements under each, written as "we" statements: 34 in all, with 8 under safe, 6 effective, 5 caring, 7 responsive and 8 well-led. The older key lines of enquiry, the KLOEs last published for healthcare services in 2018, are not part of that framework, so a folder still filed by KLOE codes is out of date.

Connect on LinkedInSagnik Bhattacharya

The twist is that key lines of enquiry are coming back in a new form. In 2026 CQC consulted on four draft sector-specific frameworks, including one for primary care and community services, the draft that would cover general practice; the consultation closed on 12 June 2026. In the drafts each key question has between three and seven key lines of enquiry that replace the quality statements, alongside rating characteristics and "I statements", and ratings are made at key-question level without scoring. I found no start date on CQC's pages, so check the framework page at each quarterly review. Build the folder on the five key questions, which stay, and keep the statement sub-folders easy to rename or regroup.

Subscribe on YouTube@sagnikteaches

The folder structure: five top levels, then statements

Keep the structure boring and identical across every practice document system. A layout that works in a shared drive:

CQC evidence/
  00 Index and review log/
  01 Safe/
    S1 Learning culture/
    S2 Safe systems, pathways and transitions/
    S3 Safeguarding/
    S4 Involving people to manage risks/
    S5 Safe environments/
    S6 Safe and effective staffing/
    S7 Infection prevention and control/
    S8 Medicines optimisation/
  02 Effective/
  03 Caring/
  04 Responsive/
  05 Well-led/
  06 Mock inspections and action plans/
  07 Archive (superseded versions)/

The safe sub-folders above use CQC's statement names in the order its safe page lists them; the S1 to S8 numbers are your own codes, not CQC's. Copy the names for the other four questions from the site in the same way, because names can change. Every file name follows one pattern: statement code, short title, date, version. For example "S8 Medicines reconciliation audit 2026-09 v1". A consistent name lets AI, and a human under pressure, sort by name alone.

What counts as evidence, and the six categories to think in

CQC groups the evidence it uses into six categories: people's experience of health and care services, feedback from staff and leaders, feedback from partners, observation, processes and outcomes. A practice folder holds mostly "processes" and "outcomes" documents, because those can be filed. The rest happens on the day. Still, you can prepare for them by keeping a short list of where each can be found: the patient survey summary and the Friends and Family comments (experience), the staff survey or meeting notes (staff feedback), minutes of meetings with the primary care network or community teams (partners).

Most documents could sit under more than one statement. File the original once, under the statement it evidences best, and list it in the index against any other statement it supports, rather than saving copies in several folders. The first column is a document you already have. The point of the folder is to show the loop, not just the document: a finding, an action, a re-check. A document that stands alone tells an inspector very little.

Step one: inventory what you already hold

Start by listing every candidate file. Export the file names, folders and last-modified dates of your shared drive into a spreadsheet, with no file contents. That list contains no patient data, so it is a safe thing to give an AI tool if your policy allows pasting file names. A realistic practice might produce 1,400 rows, most of them irrelevant: old rotas, letters, scans.

Ask the AI to sort the list, not to read the documents:

Below is a list of file names and last-modified dates from a GP practice shared drive. Tag each file with the most likely CQC key question (safe, effective, caring, responsive, well-led, or none) and the document type (policy, audit, minutes, training record, survey, complaint summary, other). If you cannot tell from the name, tag it "unclear". Do not guess content. Output a table: file name, key question, document type, confidence (high, medium, low).

Sample output, illustrative:

Infection control audit Q3 2026.xlsx | Safe | audit | high
PPG minutes Sept.docx | Responsive | minutes | medium
Staff stuff.docx | none | other | low
Complaints themes 2025-26.docx | Responsive | complaint summary | high

Treat low-confidence rows as questions for a person. The result is a first-pass map, not a decision, and it takes minutes rather than days. A file called "Staff stuff" might contain nothing or a sensitive HR matter, so a human opens it.

Step two: the evidence index, one line per document

The index is the heart of the folder. One row per piece of evidence, so anyone can find it and understand why it is there. Columns:

The "what it shows" column is the one AI helps most with, as long as the document contains no patient data. Give it the text of a policy or audit summary and ask for a single sentence stating what the document demonstrates, in plain words, with any number kept exactly. Then read the sentence against the document. If the AI says "demonstrates excellent governance", cut it; evidence should state what happened, not rate itself.

Step three: the policy review log

Inspectors and partners often ask whether policies are current and whether staff know them. A log answers both. One row per policy:

Policy | Owner | Last reviewed | Next review | Changes at last review | Staff briefed (date) | Location
Chaperone policy | Practice manager | 2026-05-12 | 2027-05-12 | Added signage wording | 2026-06-02 | /Policies/Chaperone v3
Safeguarding children | Safeguarding lead | 2026-08-30 | 2027-02-28 | Updated contact route | 2026-09-14 | /Policies/Safeguarding-C v5
Complaints | Practice manager | 2025-11-04 | 2026-11-04 | None | 2025-12-01 | /Policies/Complaints v4

That third row shows today's date as a review due date, which the log should flag in red. Ask the AI to read your log and list anything overdue or within 30 days. It can also compare a revised policy with the previous version and summarise the changes in three lines for the briefing, as long as both versions are free of patient data. For the list of which policies a practice needs, see what policies should a GP practice have: checklist and AI drafts.

Step four: summarise a mock inspection against the folder

A mock inspection tests whether the evidence exists and whether practice matches it. Walk the five key questions with a short template, capture findings in a fixed shape (code, area, what you checked, what you found, sample size) and then have AI cluster the findings into themes. The full method, with an action-plan prompt, is in CQC mock inspection template: run one and summarise findings with AI; it was written for care homes but the capture format and prompts apply to a surgery.

GP-specific checks to add to the template: a sample of repeat-prescription reviews, a sample of two-week-wait referrals followed up, safeguarding registers, cold-chain records for vaccine fridges, emergency drug and equipment checks, and the last three significant events with learning shared. File the summary in the "Mock inspections and action plans" folder and link each action to the statement it affects in the index. De-identify before using AI on anything: the findings should be counts and themes such as "3 of 10 reviews overdue", not patients.

A worked example: a six-GP practice builds the folder in four weeks

Say a practice with six GP partners, a practice manager and 11,500 registered patients wants an evidence folder. Illustrative plan and numbers:

• Week 1: the practice manager exports 1,380 file names from the shared drive. AI tags them in ten minutes; she reviews the tags for 3 hours and finds 212 candidate documents, 40 "unclear".
• Week 2: she and a partner choose the best 74 documents across the five questions and drop duplicates. They create the folder tree and rename files to the pattern.
• Week 3: she writes the evidence index. AI drafts the "what it shows" line for 52 documents that contain no patient details; she rewrites 14 of them because they were vague or boastful. Policy log built from the 38 policies, with 9 overdue.
• Week 4: a mock inspection by a manager from another practice, a summary and an action plan of 19 actions, each tied to a statement code.

Ongoing time: about 90 minutes a month. These numbers are an illustration, and the real ratio of useful to unusable files varies hugely. What is reliable is the pattern: AI speeds sorting and first drafts, and the person decides what is evidence.

What not to upload, and how to keep patient data out

The safest rule is to keep patient data and staff HR material out of general AI tools entirely. File names, policies, templates, audit summaries and minutes that contain no personal data are the working material. Before using any document, scan for names, patient identification numbers, dates of birth, initials with dates and small-number figures that could identify someone (such as "one patient aged 17 at this address"). A complaint summary should show themes and counts; the underlying letters stay in the complaints system.

Your practice's own AI policy decides which tools staff may use and what goes into them. If you do not have one yet, an AI policy for staff that says what they may do with patient data gives a starting point, and the notice you give patients about AI use covers the patient-facing side. If your practice uses a scribe or other AI tool, record the checks you did (data protection impact assessment, supplier assurance) in the folder under well-led, because that is evidence of governance.

Turning patient and complaint feedback into evidence

Caring and responsive evidence often sits in feedback that nobody has summarised. Two sources are worth setting up properly. Free-text comments from a patient survey or the Friends and Family Test can be summarised by theme with AI once names and any identifying details are removed; summarising Friends and Family Test comments with AI shows the method. The same applies to complaints: keep the letters in the complaints system and file a quarterly theme summary in the folder, with counts, the changes you made and the date you made them. A starting point for the response side is complaints policy for a GP practice: letters and deadlines with AI.

An illustrative theme summary line: "Q2: 11 complaints; 5 about phone access, 3 about test-result communication, 2 about prescription delays, 1 other. Action: call-back option added in June; result-message wording changed in July; re-count in Q3." Notice that it says what was done and when it will be re-checked. That closing loop is more valuable as evidence than the count.

Before and after: an index line that proves something

Index lines written in a hurry describe the document rather than what it shows. A before and after, illustrative:

Before: "Patient survey 2026 - results and comments."

After: "Patient survey, Aug 2026, 312 responses. Phone access scored lowest (44% rated good). Actions: call-back option from 1 Oct, queue message reworded. Re-survey due Feb 2027."

The second tells an inspector the sample size, the weak spot, what changed and when you will check again. When you ask AI to draft index lines, include an instruction such as: "State the numbers, the action taken and the next check date if present. Do not use adjectives that rate the practice." Then compare each line to the source.

Who owns each key question

A folder with no owner for each section decays. Give each key question a named lead and a deputy, and write them into the index header. A common split in a mid-sized practice: safe to a lead GP with the nurse lead, effective to a partner who runs audits, caring and responsive to the practice manager, well-led to the managing partner. The owner's job is small: review their section monthly, chase missing evidence and be able to talk through it. Ask AI to draft each owner a one-page "section card": the quality statements in their area, the evidence held for each, and the gaps. It is a useful briefing for an inspection day, because the person who will be asked questions has already read their own section.

Staff briefing: make sure people can explain the evidence

Evidence in a folder helps less if staff cannot describe how it works in practice. Use the folder for short team briefings: one key question per month, ten minutes at a team meeting, with questions such as "How would you report a safeguarding concern here?" or "What happens when a patient complains at the desk?". Reception and administrative staff are often asked such questions first. Training role-plays for front-desk staff are covered in AI for GP reception: signposting scripts and role-play training.

Gaps: asking AI which statements look thin

Once the index exists, use it for a gap check. Paste the index (document titles and one-line summaries, no patient data) along with the list of quality statements you copied from CQC's page, and ask which statements have no evidence, only one piece or only old evidence.

Below is a CQC evidence index and the list of quality statements for a GP practice. For each statement, count the documents mapped to it and the newest document date. List statements with zero documents, one document, or no document newer than 12 months. Do not suggest evidence that is not in the index. Output a table: statement, count, newest date, status (none, thin, old, ok).

A realistic result: six statements flagged, among them "Freedom to speak up", where the practice has a policy but no record of staff being told how to use it. The fix is a short staff briefing note and a log of when it was given, not a new policy. The AI found the gap; the practice manager chose the proportionate fix. Re-run the check each quarter and keep the output in the folder as a record of how you track your own evidence.

One limit worth stating: a statement with plenty of documents may still be weak in practice, because the folder shows paper, not what staff do. The mock inspection and the staff briefings are how you test the second half.

Four mistakes a folder can hide

1. Quantity over story. Fifty audit reports with no re-audit show activity, not improvement. Pair each finding with its follow-up.
2. Stale evidence. A 2022 policy with no review dates reads as neglect. Use the review log and fix overdue items first.
3. Evidence with no owner. If nobody is responsible for a folder section, it decays. Give each key question a named lead.
4. AI-written claims. An index line saying "excellent patient feedback" is a claim, not evidence. Replace adjectives with numbers and dates.

A realistic example of the third: a practice's responsive folder held a patient survey from two years earlier and nothing since, because the practice manager who ran it had left and nobody had taken it on. The review-due column in the index showed the date in red, which is the point of having the column.

Keeping the folder alive: a 30-minute monthly slot

1. Add anything new from the month (audits, minutes, training, a closed complaint theme) to the index.
2. Run the overdue check on the policy log and the index review dates.
3. Pick one key question and read its folder as an inspector would; note one gap.
4. Update the action list and tick closed items with evidence.

Rotate the key question each month, so every one is read twice a year. A comparable monthly routine for a different sector is described in how to run a monthly AI quality review in 30 minutes. If you would like to map the folder structure and decide which sorting steps are safe to automate in your practice, that is what my AI implementation consultation covers, through the contact page.

Evidence folder questions from practice managers

How many documents should the evidence folder hold?

Fewer than you think. Aim for the best one to three pieces of evidence per quality statement, each with a one-line note on what it shows. A folder of two hundred unlabelled files is harder to use under pressure than sixty well-labelled ones.

Can I upload practice documents to an AI tool for sorting?

Only policies and records your tool and agreement allow. Policies, minutes and audit summaries without patient details are the lower-risk material. Never upload patient records, complaints that name people or staff HR files to a general AI tool.

Are the old KLOEs still used?

Not the old ones. The current framework uses five key questions and 34 quality statements. CQC's 2026 draft frameworks, including one for primary care and community services, would replace the statements with new key lines of enquiry, three to seven per key question. Until CQC confirms a start date, file by the current statements and keep sub-folders easy to regroup.

How often should the folder be updated?

Review it monthly in a short slot and fully every quarter. Add new evidence when something happens (an audit, a significant event review, a training day) rather than saving it for a preparation panic.

Further reads

• How Can AI Help GP Practices? Eight Admin Jobs Beyond the Scribe — Eight further admin jobs for a GP practice.
• AI in General Practice UK: Telling Patients and Updating Privacy Notices — Telling patients about AI and updating privacy notices.
• AI Scribe for an NHS Practice: Registry, DTAC and DPIA Checklist — Registry, DTAC and DPIA checks for a scribe.
• GP Practice DNA Policy: Wording, Reminders and Letters With AI — A policy-and-letters job that needs evidence of review.
• Automated Onboarding for Doctors: A Practice Manager's AI Checklist — Onboarding evidence for new clinicians.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: CQC assessment framework, key-question and evidence-category pages, CQC consultation pages on the 2026 draft sector-specific frameworks (archived copies, June to October 2026) and CQC's 2018 key lines of enquiry for healthcare services, read November 2026. Check CQC's site for the framework in force on the day.