AI in General Practice UK: Telling Patients and Updating Privacy Notices

A UK GP practice should tell patients in plain words which AI tools it uses and what they do, at several points: in the privacy notice, on the website, on posters and in the consultation itself. The notice must name the purpose, what data the tool handles, who supplies it, how long it is kept, and how a patient can object.

Before any wording is written, the practice must have done the safety and data-protection work that makes the wording true. NHS England guidance for ambient scribing expects practices to complete their own clinical safety documentation and a data protection impact assessment before going live. A notice describing a tool the practice has not assessed is a risk of its own. This page drafts the patient-facing words, then shows the gap checks behind them.

Follow me on Instagram@sagnikteaches

A plain-English summary of the guidance, for practice managers

NHS England first published its guidance on the use of AI-enabled ambient scribing products in health and care settings on 27 April 2025, and the page now carries a second version (last updated 29 July 2026 in the copy I checked). Ambient voice technology, usually shortened to AVT, listens to a consultation and drafts a note or letter for the clinician to check. The Care Quality Commission covers the same ground from the inspector's side in GP mythbuster 109, on the use of AI in GP services. Between them, the two pages point to the duties below. Use this as a map and read both sources before you act, because both are revised as the technology changes.

Connect on LinkedInSagnik Bhattacharya

• Clinical safety. The practice, as the organisation deploying the tool, completes its own clinical risk management under the DCB0160 standard: a named clinical safety officer, a safety case, a hazard log and a monitoring plan. The supplier must have completed its own standard, DCB0129, but that does not replace yours.
• Data protection. The practice completes a data protection impact assessment (DPIA). NHS England's separate information governance guidance for ambient scribing includes a template for one. The CQC says practices should be able to show how suppliers handle, store and use data, for example through a record of processing activities, DPIAs, cyber security arrangements and the Data Security and Protection Toolkit.
• Supplier checks. NHS England runs an AVT supplier registry, described as a national self-certified list of suppliers. Self-certified means the supplier made the statements, and NHS England says it does not endorse any supplier on the list, so a place on it is a starting point for your due diligence, not the end of it.
• Medical device rules. The guidance asks you to check that the product has been correctly considered under medical device regulation and, where applicable, registered with the MHRA, the medicines and devices regulator, which publishes its own guidance on AVT products. Whether a scribe counts as a device depends on the intended purpose its maker states; the CQC says a tool that influences clinical decisions is likely to qualify. Ask the supplier which classification applies, what registration it holds, and whether that covers every function you intend to use, particularly summary and letter generation.
• Clinician review. The clinician remains responsible for the record. The output is a draft to be read and corrected before it is filed, and the CQC expects you to show that human oversight through audits, a significant incident log or other quality improvement work.
• Patient information. The NHS England guidance asks you to be transparent about how information is used and shared, and to cover the processing in your DPIA and in transparency materials for patients. The CQC is more direct: the type of consent depends on the technology and its use, and for a scribe used to deliver individual care you do not need explicit consent and can rely on implied consent under the common law duty of confidentiality, but because AI scribes are new you do need to tell patients they are being used and allow them to object. This is where your notice and poster come in.
• Responsibility. The guidance says NHS organisations may still be liable for claims arising from AI products, particularly where there is a non-delegable duty of care between practitioner and patient, and that clear contracts setting out the supplier's roles, responsibilities and liability reduce that exposure.
• What an inspection looks at. The CQC says its assessments will focus on your systems for safe AI use: procurement against DCB0160, the Digital Technology Assessment Criteria and MHRA registration where applicable, a hazard log, a named clinical safety officer and digital lead with relevant training, data protection evidence, staff training, and a non-digital route to care so that no patient is digitally excluded.

The NHS England guidance also points to the Information Commissioner's Office guidance on AI and data protection, so ask your data protection officer to check the current version of that too. For the bigger picture on policy, see the AI policy template for UK surgeries; for the products themselves and their costs, AI scribes for GPs.

Subscribe on YouTube@sagnikteaches

Step 1: list every tool that touches patients or their data

A patient-facing statement is only honest if the list behind it is complete. Many practices find they use more AI than they thought. Walk through each part of the building and ask what software is listening, summarising, sorting or replying.

For each row that applies, record the supplier, the plan, the data it handles, where it is stored, how long it is kept and whether a person reviews its output. That one table becomes the source for the notice, the poster and the staff script, and it is the first place a regulator or patient would look.

Step 2: draft the privacy notice paragraph

The practice's privacy notice already describes how patient information is used. Add a short, specific section for AI tools rather than rewriting everything. The data protection rules expect you to tell people what you do, why you do it, the lawful basis, who receives the data, how long you keep it and what rights they have. Your data protection officer decides the basis and the exact wording. Here is a draft they can edit, written for a practice that uses an ambient scribe. It is illustrative, so replace every bracket with your own verified details.

Use of AI tools in our practice

We use an AI-assisted note-taking tool, [product name], supplied
by [supplier]. During a consultation, with your awareness, it
listens to the conversation and drafts a note or letter. Your
clinician reads and corrects the draft before it is saved to your
record. The tool does not make clinical decisions.

Why we use it: to let clinicians spend more time with patients and
produce clearer records. Lawful basis: [as advised by our data
protection officer].

What it handles: the conversation during your appointment.
Recordings and transcripts are [kept for X / deleted after Y].
They are stored [where, as confirmed by the supplier] and are only
accessible to [who].

Because the tool supports your direct care, we do not ask for
written consent, but we always tell you when it is in use.

Your choices: you can ask us not to use the tool for your
appointment. Tell the receptionist or your clinician, and your care
will not change. You can also ask us about your rights, or complain,
using the contact details below.

We completed a clinical safety assessment and a data protection
impact assessment before using this tool. Contact: [practice contact
and data protection officer].

Three drafting rules keep the paragraph honest. Name the product and the supplier, because "an AI tool" is too vague for a patient to check. State the retention period only if you have verified it with the supplier in writing. And do not promise anything about accuracy beyond "your clinician checks the draft".

Step 3: the poster and website text

Posters work for people who see them. They should be short, readable from a metre away, and point to the detail. A suitable draft, illustrative:

Poster headline: "We may use AI to help write your notes."

Body: "Some of our clinicians use a tool that listens during your appointment and drafts a note. Your clinician always checks it. You can say no at any time and your care will not change. Ask at reception or see our privacy notice for details."

The website needs a fuller page with the same content, a link from the privacy notice, and the opt-out route. Put a one-line mention where patients book, whether that is an online form or a booking message. For the phone system, add a short spoken sentence at the start of calls: "This call is answered by an automated assistant. Say 'reception' at any time to speak to a person." A staffed route to a human is as important as the disclosure.

Use plain language throughout, avoid "machine learning" and "algorithms", and offer large-print and translated versions where your population needs them. If a patient cannot read the poster, the clinician's verbal explanation carries the load, which is the next step.

Step 4: a script for the first thirty seconds of the consultation

The clinician is the most reliable point of transparency. A script keeps it short and consistent so staff do not improvise or skip it. Illustrative wording:

"I use a tool that listens and drafts my notes so I can look at you instead of the screen. I check everything it writes. Are you comfortable with that? If not, I'll type the notes myself, and nothing changes about your care."

Practise it, and note the patient's answer in the record where your policy requires. A patient who says no gets the same appointment, with the tool off. Check that your system makes it easy to switch off per consultation, and test it, because a tool that cannot be paused undermines the promise on the poster. For the wider question of keeping trust through a rollout, the tutorial on rolling out a scribe without losing patient trust goes deeper, and the consent wording tutorial has more phrasing options.

A worked example: a six-clinician practice, week by week

Take an illustrative practice with six clinicians, a practice manager and about 9,000 registered patients, preparing to pilot a scribe with two clinicians.

1. Week 1. The practice manager lists tools in use and finds three AI touches: the scribe pilot, a call-recording system with transcription and a website chatbot supplied by the online booking provider. The partners nominate a clinical safety officer and ask the data protection officer to begin the impact assessment.
2. Week 2. The practice checks the supplier on the NHS England registry, requests the supplier's safety documentation and registration evidence, and asks written questions about storage, retention and sub-processors. One answer is vague, so the pilot waits.
3. Week 3. The clinical safety officer completes the safety case and hazard log. The data protection officer completes the assessment. The practice manager drafts the notice paragraph, poster and script and sends them to the data protection officer.
4. Week 4. The notice is published with a dated version, the poster goes up, and the website page is live. The two pilot clinicians rehearse the script. The scribe goes live for those two only.
5. Weeks 5 to 8. The practice reviews opt-outs, patient comments, errors found in drafts, and any near misses. It updates the hazard log accordingly and decides whether to extend the pilot.

Notice the order: governance first, words second, go-live third. The notice appears when it is true, not before.

Phones, chatbots and text messages need their own lines

Most patients meet AI at the practice through the front door long before a clinician's scribe. Each channel has a different disclosure that fits it.

Phone. If an automated assistant answers or routes calls, say so in the first sentence, offer a human route in the second, and say if the call is recorded. Check how recordings and transcripts are kept, who can listen, and whether the supplier uses them to improve its product. A poster in the waiting room does nothing for a caller. A practice that changes its phone supplier should recheck all three points, since a new supplier often means new defaults.

Website chatbot or online form. Put a visible label on the chat window: "You are chatting with an automated assistant. For urgent problems call [number] or the emergency number." Link the privacy notice from the window, and make sure the assistant cannot give clinical advice. A review of what it says to ten test questions, including a few about symptoms, should be part of go-live, not an afterthought.

Text messages. Reminders and recall messages written with AI help are still sent by the practice, so the notice's general wording about how records are processed covers them, provided a person reads and approves the template. The earlier tutorials on missed appointment letters and immunisation reminders show wording that works.

A weak notice and a better one

An illustrative contrast shows what patients can and cannot use. A weak line, found on many sites: "We may use technology, including artificial intelligence, to improve our services and may share data with trusted partners." It tells the patient nothing about what happens to them, names no supplier and gives no choice.

A better version of the same idea: "In some consultations your clinician uses [product], supplied by [supplier], to draft a note from the conversation. The clinician checks and corrects the note. Recordings are deleted after [period]. You can ask us not to use it, at any time, and your care will not change." The second version is longer, but each sentence can be checked, and a patient can act on it. If a sentence cannot be checked against a supplier document, it does not go in.

Patients who need something different

Some groups need more than a poster and a paragraph. Parents and carers acting for children or adults who lack capacity should hear the same explanation and have the same right to say no, and the clinician should consider who is speaking for whom. Patients with limited English, sight loss, learning disability or low literacy need accessible versions, and the CQC expects a non-digital route to care alongside the digital ones: translated notices from a qualified translator, large print, an easy-read summary and a spoken explanation. Patients with sensitive reasons for attending, such as safeguarding concerns, may reasonably want the tool off, so make "no" easy and never ask them to justify it. Record the choice in the way your policy sets, and check that the tool is truly off when someone says so, not just muted.

A one-page answer sheet for reception

Receptionists get the questions first. Give them a laminated page they can read aloud or paraphrase, and have the practice manager update it whenever a tool changes. A useful outline, with your own details in the blanks:

• What is it? A one-sentence description of each tool in use.
• Who sees the information? The clinician, and the supplier only as described in the notice.
• Can I say no? Yes. Note it in the record and tell the clinician before the appointment.
• Is it safe? We assessed it for clinical safety and data protection before using it, and clinicians check everything it drafts. Do not promise more than that.
• Who do I ask for more? The practice manager or the data protection officer, with the contact line.

Practise two awkward questions in the team meeting: "Is my appointment being recorded right now?" and "Where does my recording go?" Staff who cannot answer those should say they will find out and escalate, never guess.

Reviewing the notice: a calendar that keeps it true

A privacy notice drifts out of date quietly. Put three reviews in the practice calendar. Quarterly, the practice manager asks each supplier whether any AI feature has been added, changed or switched on, and updates the tool table. After any incident, near miss or patient complaint about AI, the clinical safety officer and data protection officer check whether the notice and hazard log need changing. Annually, the partners review the lot: the tools, the notice, the poster, the script and the opt-out record. Each review leaves a dated note. Keep the previous versions of the notice, since a patient may ask what the practice said at the time of their appointment.

Judge success by simple indicators: how many patients opted out, whether anyone complained that they were not told, whether staff can explain each tool without looking, and whether the notice matches the tool table. If a patient is surprised by the tool, the notice is not working, however accurate it is on paper.

How a true notice quietly becomes a wrong one

A few common failures. The notice says "we do not use AI" after the website chatbot has been switched on by a supplier update: ask suppliers to tell you before any AI feature is enabled, and review the notice each quarter. A poster promises that recordings are deleted immediately when the supplier keeps them for 30 days: copy retention facts from the supplier's written confirmation, not from a brochure. A clinician forgets the script and a patient discovers the tool from the letter: add a prompt in the consultation screen and audit a sample monthly. The phone system records calls with no mention: the spoken line and the notice both need updating.

Another is wording drift. Three versions of the notice circulate: one on the website, one in the leaflet and one in the welcome pack. Keep a single master with a date and version number, and update every copy the same day. Also check what your reception team says when patients ask. They should have a one-page answer sheet and a route to the practice manager for anything beyond it.

Using AI to help draft the notice itself

A chatbot can tidy the wording once the facts are settled. Give it the table from step 1 and your data protection officer's required headings, never patient data, and ask for plain English at a reading age patients can follow. Then compare the draft with your facts line by line, because assistants add comforting claims such as "your data is fully secure" that nobody verified. Delete any claim you cannot prove from a supplier document.

If you want help listing the tools in your practice and drafting wording that matches what you really do, that is what my AI implementation consultation covers.

Questions practice managers ask about telling patients

Is a poster in the waiting room enough?

Not on its own. A poster helps, but patients who book by phone, online or by text never see it. Tell them in the privacy notice, on the website, in the booking or call flow where the tool is used, and by the clinician at the start of the consultation. Layer the information so each patient meets it somewhere.

Do patients have to agree before a scribe is used?

Not usually in writing. The CQC's GP mythbuster on AI says that for a scribe used to deliver individual care you can rely on implied consent rather than explicit consent, but because scribes are new you must tell patients they are being used and let them object. Your data protection officer confirms the lawful basis for your product, and patients should have a simple way to say no for that consultation.

Who signs off the privacy notice change?

The practice partners or data controller, advised by your data protection officer. Have the clinical safety officer confirm the description of what the tool does, and keep the old version and the new one with dates. A change to a notice is a record of a decision, so file the reasons.

What about a phone system that uses AI to answer calls?

It needs telling too. Add a short spoken line at the start of the call, a mention in the notice, and a clear route to a human. If the system records or transcribes calls, say that, and check how long recordings are kept and who can hear them.

Further reads

• AI Scribe for Medical Practices: Pick by Country and EHR — Choosing a scribe by country and records system.
• Is an AI Scribe Worth It for a Small Private Clinic? — Whether a scribe pays for itself in a small practice.
• AI Scribe Security: Audio, Retention and BAA Vendor Questions — Questions on audio, retention and contracts for any vendor.
• How a Small Clinic Can Use AI at the Front Desk Safely — Front-desk AI rules for a small clinic.
• AI Platform for Doctors: One Suite or Separate Scribe and Phone Tools? — One suite or separate scribe and phone tools.
• Care Home Software UK: An AI Features Checklist Before You Sign — Supplier questions in another regulated care setting.
• CQC and GP Practices: Build an Evidence Folder With AI — Organise a GP practice's CQC evidence by key question and quality statement, with an AI-built index, policy review log and mock-inspection summary.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: NHS England, Guidance on the use of AI-enabled ambient scribing products in health and care settings (first published 27 April 2025; second version, checked 4 November 2026), which links the AVT Supplier Registry, its information governance guidance and the MHRA's AVT guidance; CQC GP mythbuster 109, Use of artificial intelligence (AI) in GP services (checked 4 November 2026). Readers must read the current guidance themselves.