The Chartered Society of Physiotherapy's AI principles ask a clinic to be open about using AI, get informed consent, offer a non-AI option, protect patient data, test for bias, stay clinically accountable and assess risk before use. For each principle you adopt, name an owner, keep evidence and set a review date.
There are 46 principles in the CSP's guidance, grouped by setting: AI in general, service delivery, practice, research, education, leadership and work. They are written as ethics and good practice, not as a compliance form, and the CSP says plainly that not all will apply in every setting. That leaves a small clinic with a practical question: which ones are ours, and how would we show we are meeting them? For a single-site private clinic the honest answer is usually about 30 of the 46 (the general, service-delivery, in-practice and workforce groups), plus a written reason for setting the other 16 aside.
What the CSP page actually is, and what it is not
The page is titled "Artificial Intelligence (AI) principles in action" on the CSP website. The version checked on 4 November 2026 lists 46 numbered principles and shows a last-reviewed date of 15 November 2025, and the CSP says the principles will be reviewed every six months over two years. A revision could therefore land at any time, so check the live version before you rely on a number or a wording; if the count or numbering has changed, keep your checklist's own labels (a short name for each item) and update the references.
Three points from the CSP's own framing shape how to use it. First, it is guidance for members across clinical, education, workforce and research roles, and it describes itself as something you can use as a checklist or reference point. Second, it says it does not set separate policy for AI but applies existing principles for appraising and buying technology, so you are not learning a new regime. Third, it notes that its professional liability insurance policy does not currently specifically address AI, and that liability for AI-related harm is emerging and not fully settled. That last point is why the insurance item is on the checklist below.
The CSP is a professional body. Your statutory regulator, your data-protection duties and any medical-device rules sit alongside it, not underneath it. Physiotherapists are registered by the Health and Care Professions Council (HCPC), and its standards of conduct, performance and ethics bind you whatever any professional body says. When checked on 4 November 2026, the HCPC had no dedicated AI guidance for registrants among its "meeting our standards" topics. In July 2026 it said it would publish information this autumn on using AI safely and ethically in line with those standards, and that it had commissioned independent research into how registrants use AI. Until that guidance appears, apply the standards you already work to (confidentiality, record keeping, scope of practice) to every AI tool, and check the HCPC's site before you finalise your policy. The CSP's reference list also cites a 2024 HCPC document on AI for education providers, which matters only if you take students.
One more line on the CSP page deserves a place in your file: it treats AI use as within the scope of physiotherapy practice, and it lists app developers, clinicians, patients and manufacturers as parties who may carry liability when something goes wrong. For a clinic, the clinician part is the one you control: assessing whether a patient is suitable for an AI tool and giving proper guidance on its safe use.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowOwners, evidence and review dates in a five-person clinic
Each row below has a short name for the item, what it asks of a clinic in plain words, the evidence you would keep, an owner and a review interval. In a clinic of five or six people, owners are people, not departments: the clinic director, the practice manager, a senior clinician acting as clinical safety lead, and whoever looks after your IT or data protection. Where there is no one, say so and decide who it will be.
Each row is phrased as a check that can come out yes, no or not applicable. A "no" is not a failure; it is a task. A "not applicable" needs a reason written down, which is how you show you considered the principle and set it aside deliberately.
The general principles: apply to every AI tool you use
| Principle (CSP number) | The clinic check | Evidence to keep | Owner / review |
|---|---|---|---|
| Transparency (1) | Patients, staff and referrers can find out which AI tools we use and what each one does | One-page AI register; patient information sheet; a line on the website | Practice manager / every 6 months |
| Effectiveness (2) | We know why we adopted each tool, what it should achieve and how we will tell | Short purpose statement with one measure, such as minutes saved per note | Clinic director / at 3 months, then yearly |
| Avoid vendor lock-in (3) | We can export our data and switch provider | Export test done; contract terms on data return | Practice manager / at renewal |
| Equity (4) | We have asked whether the tool works for all our patients, including accents, languages and disabilities | Notes from a trial with varied voices or cases; vendor answers | Clinical lead / yearly |
| Accountability (5) | A named clinician reviews and owns every output used in care | Policy sentence; sign-off step in the note workflow | Clinic director / yearly |
| Confidentiality (7) | We know where data goes, how long it is kept and who can see it, and a data-protection impact assessment is done where needed | Impact assessment; data-processing agreement; retention setting screenshot | Data-protection lead / yearly and on any change |
| Risk management (8) | We assessed risks before use and review them as the tool changes | Risk register entry with the clinical, privacy and reputational risks | Clinical safety lead / quarterly at first |
Two principles in this group, intellectual property (6) and sustainability (9), matter less for most small clinics. Intellectual property bites if you build a tool from your own programmes or feed patient data to a vendor that may train on it, so read the terms. Sustainability is worth a line in your procurement notes but rarely a separate task. Whichever you set aside, write down why.
The in-practice principles: where patients are affected
| Principle (CSP number) | The clinic check | Evidence to keep | Owner / review |
|---|---|---|---|
| Safety (16) | Tools used in care meet the safety and medical-device rules that apply, with a route to escalate to a human | Vendor statement on device status; escalation steps in the SOP | Clinical safety lead / yearly |
| Consent (17) | Patients are told, in plain words, before AI is used in their care and consent is recorded where required | Consent wording; log or note field showing it was given | Clinic director / yearly, audit quarterly |
| Choice (11 and 18) | A patient who declines AI receives the same care by another route | Written non-AI pathway; tested by a staff member | Practice manager / yearly |
| Clinical accountability (19) | Clinicians remain responsible for care decisions, and AI never replaces clinical judgement | Policy statement; note-review step; spot-check results | Clinic director / yearly |
| Scope of practice (20) | Each clinician uses only tools matching their competence and role | Short sign-off on training for each tool | Clinical lead / on joining and yearly |
| Clinical reasoning (21) | AI supports, never overrides, assessment and shared decisions | Examples of clinicians changing AI suggestions | Clinical lead / yearly |
| Digital clinical safety (15 and 22) | Staff can spot and report unsafe outputs, errors and data issues | Incident route; short training note; log of reports | Clinical safety lead / twice yearly |
| Workflow integration (12) | The tool fits our pathway and does not add duplicate work | Before and after workflow; minutes per patient | Practice manager / at 3 months |
Three service-delivery principles sit outside the table but still deserve a line in the register. Patient and public involvement (10) can be as simple as asking five patients what they think of the consent wording before it goes live. Interoperability (13) asks whether the tool works with your existing records system; a note-taker that produces text you must copy and paste by hand adds a step where errors creep in. Personalisation (14) asks whether clinicians can adjust an AI-generated exercise plan to the individual, which is a question to test in the trial, not to take from the sales demo.
Consent and choice are the two items clinics most often get wrong, so they get their own sections below.
Consent: what a usable version looks like
The CSP's wording is that patients should give informed consent before AI tools are used in their care, "particularly when their personal data contributes to AI models", and that consent should be meaningful rather than hidden in fine print. Separately, data-protection law sets rules about the lawful basis for recording and processing health data. The two overlap but are not the same, so ask your data-protection adviser which applies and keep their answer.
A usable consent step is short, spoken as well as written, and recorded. AI can draft the first version. Try this:
Write a patient information paragraph (under 120 words, reading age about 12)
for a physiotherapy clinic that uses an AI note-taking tool during
appointments. Facts: the tool records and transcribes the session; the
physiotherapist reads and edits the note before it is saved; the audio is
deleted after [days] days; the data is held by [vendor] under a contract
that stops it being used for training; the patient can say no and will
receive exactly the same care with handwritten notes. End with how to ask
questions. Do not use jargon.An illustrative output: "We use a note-taking tool that listens to your appointment and writes a draft note. Your physiotherapist checks and corrects it before it goes on your record. The recording is deleted after [days] days and is not used to train the tool. If you would rather we did not use it, just say so; your care will be exactly the same and we will write the notes by hand. Ask your physiotherapist or reception if you have any questions." What you fix: confirm every fact against your contract and settings, and remove anything the AI added about security that the vendor has not told you.
Choice: build the non-AI pathway before you need it
A clinic that offers "no AI" in a leaflet but has no way of delivering it has not met principles 11 and 18. The pathway needs to work on a busy Tuesday. Test it: ask a clinician to run a session as though the patient had declined, and time it. If the handwritten route takes ten minutes longer, work out how it is covered, so that the patient who says no does not get a shorter appointment or a worse experience.
The same applies to AI-driven booking or triage. If a chatbot handles first-visit enquiries, there must be a clear way to reach a person. The AI chatbot for physio clinics tutorial shows the hand-off in practice, and the AI receptionist cost and booking setup covers the voice version.
The workforce principles: if you employ anyone
| Principle (CSP number) | The clinic check | Evidence to keep | Owner / review |
|---|---|---|---|
| Partnership working (39) | We consulted staff, and any union or representative body, before introducing the tool | Meeting notes; staff questions and our replies | Clinic director / before each new tool |
| Legal advice on employment effects (41) | We took advice if the tool touches rostering, productivity or appraisal | Adviser's note | Clinic director / on any such change |
| Recruitment (43) | Any AI in hiring is bias-tested, explainable and reviewed by a person | Process description; sample audit | Practice manager / yearly |
| Business continuity (44) | We have a plan for when the AI tool is down or compromised | Written downtime procedure; test date | Practice manager / yearly |
| Efficiency gains shared (45) | Time saved is reinvested in patient care, staff wellbeing or development | Note of where the saved time went | Clinic director / yearly |
| Displacement (46) | AI is not used to remove or devalue clinical roles; changes come with support | Statement in the AI policy | Clinic director / yearly |
Two more workforce principles apply to most employers. Disability and neurodiversity support (40) asks you to check that a tool does not disadvantage a dyslexic clinician or a colleague who uses assistive software, so include at least one such person in the trial if you can. Workforce planning (42) matters only if you use AI to model staffing; if you do, it must not reduce roles to data points. Leadership principles 35 to 38, on readiness and strategy, apply when the clinic is introducing tools at scale. For a single-site practice, a one-page readiness note covering skills, infrastructure and clinical risk is enough. Education and research principles (23 to 34) apply if you take students or run research; otherwise record them as not applicable.
Using AI to build your own register from the checklist
Ask the AI to do the tedious part: take your list of tools and produce a first-draft register. The decisions stay with you.
I run a five-clinician physiotherapy clinic. We use or plan to use: an AI
note-taking tool, a patient-facing booking chatbot, and ChatGPT for drafting
exercise handouts (no patient identifiers). For each tool, create a table row
for each of these checks: transparency, confidentiality and data-protection
impact assessment, consent, non-AI option, clinician accountability,
safety and escalation, vendor lock-in, downtime plan.
For each row give: the question to answer, the evidence to collect, a
suggested owner role and a suggested review interval. Mark any check you think
may not apply and say why. Do not claim any tool is compliant.The final sentence stops the AI declaring tools compliant, which it cannot know. Expect about 24 rows. Edit them to fit your clinic, delete the ones that do not apply, and write the reason in a "not applicable" column.
A worked example: a five-clinician clinic adopts an AI note-taker
Illustrative figures. A five-clinician clinic sees about 90 patients a week and plans to trial an AI note-taker. Each clinician spends about 8 minutes writing each note afterwards; the vendor's pitch suggests it could halve that. The clinic director decides to trial it for six weeks with two clinicians before rolling it out.
Before the trial, the practice manager does the paperwork. The register gets a new row. A data-protection impact assessment is drafted with AI help and reviewed by the clinic's data-protection adviser. The contract is checked for training use, retention and data return. The consent wording above is adopted and a note field for "AI scribe used: yes / declined" is added. The non-AI route is tested: a clinician runs three mock sessions by hand and times them. The insurer is asked in writing about the tool and answers within two weeks. The downtime plan says: write notes by hand and enter them by the end of the day.
During the trial, the clinical safety lead reads a sample of five notes per clinician each week against the patient record and logs errors. Suppose she finds that the tool mishears two exercise names a week and once records a side as left instead of right. These go in the log, the clinicians correct them, and the clinic writes a rule: laterality and medication are always checked by eye. At six weeks the director reviews the evidence: time saved per note, error log, patient decline rate, staff views. Say the average note drops from 8 minutes to 5, three patients in 120 declined and were seen without the tool, and the error rate is acceptable with the check rule. The clinic rolls it out to all five, sets a review for three months and records the decision with the date. Every row has an owner, evidence and a next review date.
Compare this with a clinic that simply switches the tool on. It might save the same time and still have no consent wording, no non-AI option and no one who can answer a patient's question. The principles are what separate the two.
Where vendors and procurement criteria come in
The CSP says it applies existing approaches to buying technology rather than a separate AI policy, and its page points members to two sources of procurement guidance: the rules on medical-device regulation and the Digital Technology Assessment Criteria (DTAC). DTAC is the national framework that health-service commissioners and providers use to assure digital health products, and it covers five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility. A revised form with about a quarter fewer questions came in from February 2026, and the previous form should not be used from 6 April 2026, so check the date on any DTAC pack a vendor sends you. DTAC also sits alongside, not instead of, other approvals such as medical-device certification.
The CSP names DTAC as guidance members can use, not as a requirement for a private clinic, so treat it as evidence to request rather than a rule. Ask each vendor whether it has completed the current DTAC form, ask for its clinical safety documentation, and record the answers in your register against principles 8 (risk management), 13 (interoperability) and 16 (safety). If a vendor cannot or will not provide them, that is also evidence. A short vendor email drafted with AI saves time here; prompt it with your tool list and ask for one question per DTAC area, then send it from your own address. The comparison table of physiotherapy clinic software with built-in AI is a useful starting point for the shortlist.
Keeping the evidence file so it survives a busy year
Evidence is only useful if someone can find it in five minutes. Keep one folder per tool with five things: the purpose statement, the contract and data-processing terms, the impact assessment, the consent wording and the review log. Add a single index page listing each tool, its owner and its next review date. Once a quarter, the practice manager opens the index, checks that nothing is overdue and sends the clinic director a three-line note. That routine, rather than the principles document, is what shows a patient, an insurer or an inspector that the checklist is alive.
Ask the AI to draft the index and the quarterly note from your register, but never to fill in the "evidence seen" column. Only a person who has opened the document can say they have seen it.
Five ways a clinic's AI checklist quietly stops working
- Treating them as a policy to adopt rather than a process to run. A PDF in a shared folder proves nothing. Dated evidence and a review do.
- Consent in a footer. The CSP's own comment is that consent should not be hidden in fine print.
- No owner for anything. If the answer to "who owns this?" is "the team", nobody does.
- Forgetting free tools. A clinician using a personal ChatGPT account to tidy notes is using AI in care. Cover it in your policy, with a clear line on what may never be pasted in.
- No review date. Tools change terms and models without telling you. A calendar entry is the cheapest control you have.
For the consent and data side of AI scribes specifically, see a consent and GDPR checklist for AI scribes in physiotherapy. If you want a hand setting the register up and deciding which tools are worth the effort, that is what my AI implementation consultation covers. It is advice on process, not clinical or legal advice, so your regulator, insurer and data-protection adviser still have the last word.
Questions clinic owners ask about the CSP principles
Are the CSP's AI principles a legal requirement?
No. They are professional guidance from the Chartered Society of Physiotherapy, designed as a reference and checklist, and the CSP says not every principle will apply in every setting. Data-protection law, medical-device rules and your regulator's standards still apply on their own terms, so use the principles alongside them.
Do all 46 principles apply to a small private clinic?
No. Many cover education, research and workforce policy. A small clinic will usually work from the general, service-delivery, in-practice and work principles, and record in writing which others it has set aside and why. That record is part of your evidence.
Does using an AI note-taker need patient consent?
The CSP's principles say patients should give informed consent before AI tools are used in their care and should be able to decline where possible. Whether consent or another lawful basis applies for recording and processing is a data-protection question, so confirm it with your data-protection adviser.
Does the HCPC have its own AI guidance for physiotherapists?
Not yet as a dedicated page, when checked on 4 November 2026. In July 2026 the HCPC said it would publish information this autumn on using AI in line with its standards of conduct, performance and ethics, and it commissioned research into registrants' AI use. Until then its existing standards on confidentiality, records and scope of practice apply to AI tools as to anything else. Check the HCPC site before finalising your policy.
Does the CSP's insurance cover AI use?
The CSP's own guidance says its professional liability policy does not currently specifically address AI and that AI use is treated as within the scope of physiotherapy practice. Ask your insurer in writing how it treats the tools you plan to use, and keep the reply with your evidence.
Further reads
- AI Scribe Patient Consent: Implied or Explicit for UK Clinics? — Work out whether consent for an AI scribe must be explicit.
- AI Chatbot for Healthcare: A Small Clinic's Data and Consent Checklist — A general small-clinic checklist for chatbot data and consent.
- AI Tools for Physiotherapy Clinics: What Each One Actually Does — What each AI tool in a physio clinic actually does.
- How Can AI Help Physiotherapy Clinics Write Referrer Updates? — Apply the checklist to AI-drafted referrer updates.
- AI in Physiotherapy: Filling Cancellations From a Waiting List — Check consent and choice in a waiting-list messaging tool.
- AI Usage Policy for a Medical Practice: Template and HIPAA Rules — A template-style AI usage policy to compare with yours.
- Infection Control Audit Action Plan: Turn Findings Into Fixes With AI — Paste anonymised audit findings into AI, get grouped fixes with owners and dates, then a re-audit sheet that proves each one closed.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: Chartered Society of Physiotherapy, Artificial Intelligence (AI) principles in action (csp.org.uk, read 4 November 2026, page last reviewed 15 November 2025); HCPC news item on AI research (23 July 2026) and its meeting our standards pages (checked 4 November 2026); DTAC guidance for buyers and suppliers (archived copy, September 2026). Verify the live CSP page before relying on any principle number.