AI governance for healthcare
Your board owns the safety of every clinical judgement AI touches.
AI is moving into triage, note-taking, monitoring and administration across independent providers, care groups and NHS-adjacent organisations, often inside supplier systems the board cannot independently test. CQC holds the registered provider accountable for safe care and good governance, and where a tool informs diagnosis or treatment the MHRA may regulate it as a medical device. Governance AI gives boards the literacy, controls and evidence to govern AI against the duties they are inspected on.
A clinical decision informed by AI is still a clinical decision the provider answers for.
Health and care serves people who are often unwell, vulnerable or without an alternative, so any AI that touches triage, monitoring or clinical documentation carries an elevated safety burden. CQC regulates providers under Regulation 12 on safe care and treatment and Regulation 17 on good governance, and its published position is that a provider using AI must still meet those outcomes and evidence effective oversight of it. AI deployed without board-level assurance or safety testing is a direct gap that an inspection can act on.
The accountability does not move to the vendor. Where a tool is intended to inform diagnosis, prognosis or treatment it may be a medical device regulated by the MHRA, whose Software and AI as a Medical Device programme tightened post-market surveillance expectations in 2025. Registered clinicians remain personally accountable to the GMC or NMC for decisions they make with AI support, and special category health data sits under UK GDPR. Most AI governance is performance, not protection.
The standards health and care providers are held to.
AI does not create a separate rulebook. It runs through the duties and regulators you already answer to.
Care Quality Commission (CQC)
Regulates providers under Regulation 12 (safe care and treatment) and Regulation 17 (good governance). Its position is that AI in regulated care must still meet those outcomes with evidenced board oversight and risk management.
Medicines and Healthcare products Regulatory Agency (MHRA)
Where a tool is intended to inform diagnosis, prognosis or treatment it may be Software as a Medical Device. The MHRA's programme tightened post-market surveillance duties in 2025, so confirm a tool's classification before deployment.
ICO, UK GDPR and Data Protection Act 2018
Health records are special category data. Processing them through AI needs a lawful basis, a completed Data Protection Impact Assessment and Article 22 safeguards where a decision is solely automated.
NHS DSPT and DTAC
Where you connect to NHS systems or contract with the NHS, the Data Security and Protection Toolkit and the Digital Technology Assessment Criteria set the data security, clinical safety and interoperability bar an AI tool must clear.
GMC and NMC professional duties
Where AI assists a clinical decision, the registered doctor or nurse remains personally accountable for it. The board must ensure clinicians can exercise, and evidence, meaningful professional judgement over any AI output.
What good AI governance looks like for health and care providers.
The Board AI Scorecard measures five areas. Here is what each means in your sector.
Accountability & board oversight
Name who at board level owns each AI system that touches a patient or service user, so an inspector can see accountability sits with the registered provider and the responsible clinician, not the supplier.
AI policy & controls
Set a board-approved AI policy that maps to CQC Regulations 12 and 17, states which clinical and care tasks AI may support, and requires a documented human clinical decision before any AI output affects care.
Risk, transparency & assurance
Register every AI tool, confirm whether it is a regulated medical device, and test it for safety, bias and failure modes against vulnerable groups, with a clinical safety case where a tool touches diagnosis, monitoring or treatment.
Data & security
Hold a completed Data Protection Impact Assessment, DSPT compliance and clear limits on whether patient data leaves your control before special category health data feeds any AI tool or third-party model.
Board literacy & capability
Equip a board recruited for clinical, care and finance expertise to interrogate model safety, evidence base and vendor claims, rather than rely on assurance it cannot independently test.
The UK AI Disclosure Audit 2026
What NHS trust annual reports actually say about AI
Twenty of the 28 NHS trusts we could score, from a sample of 30, two of whose reports could not be retrieved, in annual reports with a period end on or after 31 December 2024 and read on 4 September 2026, mention artificial intelligence at all. The gap between mentioning it and governing it is wide.
- One of the 28 scored trusts mentions AI inside another risk, and a standalone AI risk with a stated mitigation was not found in the documents we read for any of the 28.
- Five of 28 name a committee whose remit covers AI; an individual director named as the owner was not found in the documents we read for any of the 28.
- Two of 28 refer to an AI or acceptable use policy. One of 28 ties data protection language, such as a DPIA or UK GDPR, to its use of AI.
- Fifteen of 28 describe a named AI system or a specific use case, the highest rate of the five sectors: education 13 of 29, charities 13 of 30, housing associations 7 of 30, councils 6 of 30. So 15 of 28 name a system while nil of 28 record a standalone AI risk with a mitigation.
- Three of 28 had an AI item on a public board agenda in the period; public minutes were found for all 28, so no trust is recorded as not applicable here. Across the whole study the same indicator is 10 of 147, or 10 of 73 where minutes were found. Board agendas are the study's weakest indicator, because board papers are not fully searchable within our fetch budget, so treat that figure as unverified.
- Two trusts' reports could not be retrieved: for one the host blocked automated retrieval, and for Frimley Health NHS Foundation Trust no 2024/25 annual report was located by any route we tried.
The annual governance statement is a signed account of whether the trust's system of internal control works. NHS guidance on AI and digital technology already expects clinical safety, information governance and equality checks before deployment. Where a report names an imaging or transcription tool but records no matching risk, owner or policy, that is a gap a board can close quickly. Where we say something is not there, we mean it was not found in the documents we read.
Read the full audit and download the scoresQuestions your board should be asking.
- Where is AI already supporting care across triage, monitoring, clinical documentation and administration, and for each, has anyone confirmed whether it is a medical device the MHRA regulates?
- For any AI touching a clinical or care decision, can we evidence a documented human clinical judgement, a clear accountable clinician, and a safety case proportionate to the risk?
- Have we completed a Data Protection Impact Assessment and satisfied DSPT and UK GDPR before special category health data goes near an AI tool or third-party model?
- How have we tested these tools for safety and bias against the vulnerable groups we serve, and who is accountable for that testing at board level?
- Can we explain to CQC, to a clinician and to a patient how an AI-supported decision was reached, including inside third-party vendor systems?
- What board-level oversight, policy and risk reporting do we hold for AI, and how does it map to CQC Regulations 12 and 17 and our clinical governance framework?
Taking these to a meeting? Print the one-page board pack.
We govern the AI and we build the controls that keep care safe.
Start with the free Board AI Scorecard to see where your board stands in about two minutes. The AI Wake-Up Call is a board session that gets members fluent in the AI decisions in front of them, and the GovernIQ™ Diagnostic gives a scored read of your AI governance against the duties you are inspected on. Our work is grounded in the practice of our founder, Karl George MBE, creator of the TGF Governance Code, and aligned to ISO/IEC 42001, the NIST AI Risk Management Framework and UK GDPR. We help you prepare for certification against ISO/IEC 42001. We do not issue it.
See where your board stands before an inspector asks.
Take the free Board AI Scorecard, or book a short conversation about where your AI exposure sits across triage, monitoring, documentation and patient data.