Special-category data. A regulator that expects continuous monitoring.
Clinicians and care staff use AI scribes and consumer tools for notes and admin, and the CQC expects continuous monitoring, risk assessment and named accountability for harm.
of GPs use AI scribes; most started without practice-level support (npj Digital Medicine, 2026)
of health and social care providers use AI, the second lowest of twelve industries (Access, 2025, vendor survey)
expects continuous monitoring, DPIAs, consent records and named accountability for AI (CQC, 2026)
Accountability stays with a named person.
CQC (May 2026): AI “can enhance, but not replace human decision making”; providers need risk assessments, DPIAs and accountability procedures for when AI causes harm. MHRA and NHS England (July 2026): transcription tools are not medical devices, tools that support diagnosis or act on their own are, and NHS organisations remain responsible for deploying them safely.
Regulator statements summarised from the published guidance; see the sources on the Problems page. This supports compliance; it is not legal advice.
- Consultation notes and letters
- Rota, admission and resource planning
- Patient and family communications
- Referral and triage support
- Health data in consumer tools without consent
- Unregulated scribes in clinical use
- No incident record when an output is wrong
Audit with a data-flow map for special-category data. Gateway rules that block health data from unapproved tools. Rules naming where AI must not be used. Compliance Mapping to CQC expectations and UK GDPR. Ledger as the incident record.
Four agents, trained for this sector.
The rules, as controls.
- CQC AI expectations (May 2026)
- NHS DSPT and Caldicott
- MHRA ambient voice guidance (Jul 2026)
- UK GDPR (special-category data)
Issues detected · needs attention first
| Issue | Rule | Severity | Owner | Status |
|---|---|---|---|---|
| Payroll file uploaded to an external AI tool | R-15 | High | HR Director | Blocked · reviewed |
| 31 personal AI accounts found in Sales | R-02 | High | Head of Sales | Migrating · 27 done |
| Customer data in a prompt without redaction | R-01 | High | Ops lead | Redacted · 0 left |
| Premium model used for internal drafts · 412 requests | R-07 | Medium | Engineering lead | Rerouted |
| CRM "AI assist" running without a DPIA | Policy | Medium | Head of Sales | DPIA in progress |
| Agent attempted an external email | R-12 | Low | S. Reid | Held · approved |
| Job | Owner | RAG | Effort | Cost to date | Forecast | Actual | Variance | Return / yr | Status |
|---|---|---|---|---|---|---|---|---|---|
| Migrate personal accounts to managed | IT Director | 12 d | £4,200 | £6,000 · 20 d | £4,200 · 12 d | −£1,800 · −8 d | risk | Done | |
| Route everyday tasks to standard tier | FD | 3 d | £900 | £1,200 · 4 d | £900 · 3 d | −£300 · −1 d | £58,400 | Done | |
| Payroll upload block (R-15) | HR Director | 1 d | £300 | £300 · 1 d | £300 · 1 d | 0 | risk | Done | |
| Collections letters via Comms agent | Head of Collections | 18 d | £11,600 | £14,000 · 25 d | — | on track | £96,000 | In progress | |
| KYC document checks | Head of Onboarding | 9 d | £5,100 | £9,000 · 15 d | — | on track | £61,000 | In progress | |
| Contact-centre adviser assist | Head of CS | 26 d | £19,800 | £16,000 · 20 d | — | +£3,800 · +6 d | £142,000 | At risk · vendor delay |
Effort, cost and return are recorded against each job as it happens. Done means the job is solved in production with its owner’s sign-off, not that a licence was bought.
From this sector.
Is GenWA a medical device?
No. GenWA controls, records and evidences the AI tools you use; it does not make clinical decisions or claims.
Where does our data go?
Nowhere new. Everything runs inside your own cloud account. Nothing routes through GenWA's infrastructure. Sensitive data is removed before a request leaves your environment.
Find out where your AI stands. Then decide.
Under a minute, an upload, or a visit. Something for the board either way.