What Policies Should a GP Practice Have? Checklist and AI Drafts

No single official list exists, but a GP practice should have written policies for every duty the regulations place on it: governance, safe care, safeguarding, complaints, consent, chaperones, infection control, data protection, and business continuity, among others. AI can draft each in minutes. A partner must still adapt, approve and review them.

The reason no list exists is that the Care Quality Commission inspects against regulations, not against a document count. CQC's guidance on Regulation 17 (good governance) lists "governance arrangements such as policies and procedures" among the records a provider keeps, alongside regular audits and accurate, secure records. So the useful question is not "do we have a complaints policy?" but "can we show the policy matches what the team does, and that someone reviews it?" That is where AI helps with drafting and tracking, and where it cannot help at all with accountability.

Follow me on Instagram@sagnikteaches

Which policies a practice usually needs, grouped by risk

Treat this as a working checklist to adapt, not a legal minimum. Group by what goes wrong if the policy is missing, then work through the groups in that order.

Connect on LinkedInSagnik Bhattacharya

Check which items your contract, local commissioner or professional bodies add. Your professional association, your medical defence organisation and the CQC GP mythbusters publish guidance on individual topics, and the mythbusters are the clearest statement of what inspectors expect.

Subscribe on YouTube@sagnikteaches

What the regulator actually says about two core policies

Reading the guidance beats guessing. Two CQC mythbusters show how specific the expectations are, which is exactly what your drafts need to reflect.

Chaperones

The mythbuster (GP mythbuster 15) says patients should routinely be offered a chaperone for any consultation or procedure, with the offer made clear before any procedure, ideally at the time of booking. The policy should be advertised through leaflets, the website and notice boards. If a patient declines, the offer and the refusal should be recorded and coded. If a requested chaperone is not available, the patient must be able to reschedule within a reasonable time, and the reason recorded if delay is not appropriate. Staff acting as formal chaperones must be trained, and the record should say who chaperoned and for which part of the consultation. A generic AI draft often omits the recording and coding step, which is the part an inspector checks.

Complaints

The complaints mythbuster (GP mythbuster 103) expects acknowledgement no later than the third working day, with the complainant offered a chance to discuss how it will be handled. The regulations set no response deadline, so you agree one with the complainant, and if there is no response within six months they can go to the Ombudsman. Complaints should normally be made within 12 months of the event, or of the complainant realising they had cause to complain, and that limit can be extended in some circumstances. The mythbuster suggests publishing the process in three forms: information on the website, a leaflet and poster with a simple version, and a full working policy for staff. Complaints should also be monitored for trends and shared for learning. A draft that says "we will respond within 10 working days" has invented a rule; one that says "we will agree a timescale with you" matches the guidance. The letters themselves, and how to keep to the deadlines, are covered in complaints policy letters and deadlines with AI.

How to draft a policy with AI, step by step

The method below keeps the useful part of AI (a fast structured draft) and removes its worst habit (writing what sounds right instead of what you do).

1. Write a one-paragraph fact sheet. Who does the task, in which system, how often, what happens when it fails. Use real roles, not names: "reception team leader", "named safeguarding lead".
2. Paste in the regulator source. Quote the relevant mythbuster or regulation text into the prompt, so the model works from it and not from memory.
3. Ask for a draft with a fixed structure. Purpose, scope, roles, procedure, recording, training, review date, related documents.
4. Ask for a gap list. Have the model list every statement it made that is not in your fact sheet or source, so you can confirm or delete each.
5. Adapt by a human who does the task. The person who chaperones, triages or processes the complaints edits it.
6. Sign off and date it. A named partner or manager approves, and the review date goes on page one.

A tested prompt

You are helping a practice manager draft a chaperone policy.
Use only the SOURCE and PRACTICE FACTS below. Do not invent timescales,
legal duties or job titles. Structure: purpose; scope; who may act as a
chaperone; how the offer is made; what is recorded and coded; what
happens if the patient declines or no chaperone is available; training;
review date; related policies.
After the draft, list under "UNVERIFIED" every statement that does not
come directly from the SOURCE or PRACTICE FACTS.
SOURCE: [paste the relevant guidance text]
PRACTICE FACTS: Formal chaperones are the two healthcare assistants and
the practice nurses. Reception does not chaperone. Offers are recorded
in the consultation template field "Chaperone offered". If no formal
chaperone is free, the patient is offered the next available slot or a
colleague from the other site.

A realistic output has a clean structure and one or two flaws you only spot by reading: it might say "all staff may act as chaperones in an emergency", which contradicts your fact sheet, or it may add "all chaperones are DBS checked" without your saying so, when the mythbuster says non-clinical chaperones may need a DBS (criminal-records) check and asks for a risk-assessed rationale if you decide against one. The UNVERIFIED list should catch the second kind, and the rationale is yours to write. The first is why a human who does the work must read it.

Worked example: a 9-GP, 14,000-patient practice rebuilds its set

This is an illustration with invented numbers. A practice manager inherits 46 policy documents, 19 of them with no review date, 11 written for a former computer system, and three that say different things about the DNA process. She has four weeks.

Say a first draft written from scratch takes about 90 minutes; with the prompt and a gap list the same document takes 20 minutes to draft and 25 to adapt, so 45 minutes in all. Across 29 policies that saves roughly 22 hours (29 x 45 minutes). The saving is real, but notice where the time goes: the clinician read, the partner sign-off and the register are all human work, and they are the parts that create the evidence.

A review schedule that survives staff turnover

Most failures are policies nobody reviews. A schedule is a spreadsheet plus a calendar, not a software purchase.

• Annual for high-risk policies: safeguarding, consent, infection control, medicines, complaints, significant events, information security and any policy covering AI tools.
• Every two years for stable, low-risk ones: sickness leave, social media, expenses.
• Triggered reviews: after any significant event, a change of clinical system, a change of premises, a guidance update, or a new tool such as an AI scribe.
• Spread the load: due dates across the year, not all in March. Put four policies into each month.

AI can help here too. Ask an assistant to compare a policy with a pasted guidance update and list what changed or conflicts, then review that list. Or ask it to turn the register into monthly reminder emails. It is poor at telling you whether a policy matches what staff really do. For that, sample two staff members and ask them to describe the process, then compare with the policy.

Five more examples of where AI helps and where it misleads

Plain-language patient version. Give AI the full complaints policy and ask for a leaflet at a reading age of about 12, 250 words, with the practice's actual contact route. This is a strong use because the source is yours. Read it for anything the leaflet promises that the policy does not.

Staff quiz. Ask for ten multiple-choice questions on the infection control policy for induction. Verify the answers against the document; models occasionally write a distractor that is also correct.

DNA policy. The common fault is a draft that threatens removal after two missed appointments, which may conflict with your contract and with fairness to vulnerable patients. Before drafting, decide your real rule, including vulnerable-patient exceptions, and give that to the model; wording a DNA policy and its letters works through that rule in detail. The same pre-drafting applies to reminders: cutting missed appointments with AI shows which messages cut DNAs.

AI-use policy. You now need a policy on staff use of AI tools: which are approved, what data may never be pasted in, who reviews outputs, and how scribe recordings are handled. Draft it from the approved-tool list first, then ask the model to find loopholes. What staff may do with patient data under an AI policy sets out the rules such a policy usually needs. The AI scribe checklist for a practice lists the data protection checks to link from it.

Consolidating duplicates. Paste the three DNA documents and ask the model to table the differences. It is quick at that, and the table tells the partners what to decide.

Failure modes to watch for in AI-drafted policies

• Plausible invented specifics. Timescales, form names, job titles and legislation citations that sound official. Fix: the UNVERIFIED list and a requirement that every number has a source.
• Policy by template. Two practices with identical policies, one using a different system. Fix: the practice fact sheet in every prompt.
• Policies longer than anyone reads. An 8-page chaperone policy will not be used on a busy morning. Fix: one-page procedure plus a longer reference section.
• No owner. A policy with "the practice" as the responsible party. Fix: every policy gets a named role as owner.
• Version sprawl. Old versions on the shared drive. Fix: one folder, archive older versions, and publish only the current PDF to staff.

A filled-in register row and a filled-in policy front page

The register is what turns a pile of documents into a system. One illustrative row, and the front page it points to, shows the level of detail that works.

The "drafted with AI" column is optional, but it is useful: when a tool changes or a draft is later found wrong, you can find every affected document in one filter. The read-and-sign column answers the inspector's first question to a receptionist: "where would you find the policy, and have you seen it?"

Asking AI what changed when guidance is updated

This is the most underused job. When a regulator updates a mythbuster or your commissioner issues a new requirement, paste both the old policy and the new guidance text and ask for a comparison.

Below are (A) our current complaints policy and (B) the updated guidance.
Make a table with three columns: guidance requirement; where our policy
covers it (quote the sentence, or write NOT COVERED); suggested change.
Do not rewrite the policy. Flag any place where our policy says
something the guidance contradicts.
(A) [paste policy]
(B) [paste guidance text]

An illustrative result: the table finds that your policy acknowledges complaints "within 5 working days" while the guidance says no later than the third working day, and that your policy never mentions the patient's right to go to the Ombudsman if there is no response in six months. Those are two concrete edits instead of a rewrite. The limitation: the model only compares what you paste. If you give it a summary of the guidance instead of the guidance, it will compare against the summary.

Policies people forget: three short examples

Lone working. A practice that offers home visits, or has a nurse running a clinic at a branch surgery alone, needs a rule for check-ins and panic alarms. A draft from AI will list sensible generic steps; add the actual alarm system, who receives the check-in text and what happens if there is no reply within 15 minutes.

Freedom to speak up. The policy should say who staff can go to, including someone outside the partnership, and promise protection from detriment. AI drafts are usually fine on the wording but often leave out the named contact. A policy without a name is a poster, not a route.

Use of recording and AI scribes. If clinicians use an ambient scribe, the policy should say which product is approved, how patients are told, how consent or objection is recorded, who reviews the output and how errors are corrected. It should link to your data protection documents and your risk assessment. Do not let a clinician start the tool before the policy is signed; adding it afterwards is how practices end up with undocumented risk.

Data protection and information security: what to cover in the draft

These two policies are the ones where a generic AI draft is most likely to look complete and be wrong, because they depend on systems and suppliers you actually use. Before drafting, collect the facts the model cannot know: the clinical system and its hosting arrangements, who your data protection officer is, how long you keep each record type, how patients request their records, and how staff log in. A short list works as the practice fact sheet.

A good test of the finished draft is to ask five concrete questions and find the answer in the document in under a minute each. Who do I tell if I think I have sent a letter to the wrong patient, and by when? Where may I not save a patient list? How does a patient ask for a copy of their record, and who replies? What do I do if my smartcard or password is lost? Which AI tools am I allowed to use, and what must I never paste into them? If any answer is missing or vague, the policy fails in practice even if it reads well.

The incident route deserves care. Ask the model to draft a one-page flow from "someone notices a problem" to "decision on whether to report", with roles in each box, then have your data protection lead check the timings against the regulator's own guidance rather than the model's memory. Models often state a reporting deadline confidently and occasionally get the starting point wrong.

What to do this week

1. Create the register spreadsheet and list every policy you can find, with owners and dates. It takes an afternoon.
2. Pick the three most overdue patient-safety policies and redraft them with the prompt pattern.
3. Book the partners' sign-off slot before you start drafting, so the work has a deadline.
4. Put the review dates into the shared calendar, four per month.
5. Decide who owns the AI-use policy, and write it before the next tool is switched on.

How to tell your set is in good order

Run a ten-minute check each quarter. Pick any five policies at random. For each, confirm there is a named owner, a review date in the future, a signature or approval record, and a version staff can find in under a minute. Then ask one member of staff to describe what they would do in the scenario the policy covers. If the answer differs from the policy, one of them needs to change. Log the result in the register. That log, together with dated sign-offs, is the evidence a governance inspection asks for, and it is far stronger than a thick folder of undated documents. Building a CQC evidence folder with AI shows where the register and the log sit in it.

If you would like help setting up the register and an AI drafting routine around your own systems, that is what my AI implementation consultation covers, via the contact page. For wider ideas on AI in practice administration, see the AI guide.

Questions practice managers ask about policies and AI

Is there an official list of mandatory GP policies?

No single list exists. The regulations require good governance, safe care, safeguarding, complaints handling and similar duties, and policies are how you evidence them. Inspectors look at whether your arrangements are in place, current and followed, so build your list from the regulations, your contract and your own risks.

Can AI write a policy that CQC will accept?

AI can produce a first draft quickly, but no tool carries your accountability. A policy is accepted because it matches what your team really does, names real roles and has been reviewed and signed by someone responsible. A draft that has not been adapted to your practice usually fails that test.

How often should each policy be reviewed?

A common pattern is annually for most policies, sooner after an incident, a regulation change or a change of system, and every two years for stable low-risk documents. Record the review date and reviewer on the front page so you can show the schedule was kept.

Is it safe to paste our existing policies into an AI tool?

Policies rarely hold patient data, so the risk is lower than with records, but check them for staff names, passwords, rota details and security arrangements first. Use a business-grade account whose terms exclude training on your content.

Further reads

• Physical Therapy Policies and Procedures: A Clinic Manual Drafted With AI — A clinic manual drafted with AI, for comparison with a GP set.
• Writing Pharmacy SOPs With AI: A Step-by-Step Workflow — A step-by-step method for turning daily practice into written procedures.
• AI Chatbot for Healthcare: A Small Clinic's Data and Consent Checklist — Data and consent checks for any patient-facing AI tool.
• AI Scribe for GPs: Costs, Free Tiers and the NHS Pilot Limit — What AI scribes cost and what the free options leave out.
• 10 Admin Tasks a Small Clinic Can Hand to AI This Month — Ten routine admin jobs that can be handed to AI safely.
• How a Small Clinic Can Use AI at the Front Desk Safely — Front-desk AI use that your policies should cover.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: CQC GP mythbuster 15 (chaperones) and GP mythbuster 103 (complaints management); CQC guidance on Regulation 17 (good governance); all read November 2026.