Is an AI Scribe GDPR-Compliant? The Security Questions UK Clinics Should Ask in 2026

Yes, an AI scribe can be fully compliant with UK GDPR. But compliance belongs to the deployment as a whole, not to the product on its own. Your clinic remains the data controller; the vendor is a data processor working under your instructions. A compliant setup looks like this: you have established a lawful basis for the processing, patients are informed and their agreement to the recording is captured at each visit, a data processing agreement is signed before any patient data flows, a data protection impact assessment (DPIA) is on file, and the vendor can answer the eight questions below in writing. If any of those pieces is missing, the deployment is not compliant, however good the product's own paperwork looks. This guide walks through both sides: what to demand from the vendor, and what only your clinic can do.

Why this question now comes before the product demo

Two years ago, AI scribe conversations started with accuracy and time saved. In 2026 they increasingly start with a practice manager or IT lead asking where the audio goes, who can hear it, and what happens if the ICO comes knocking. Often that caution has been earned the hard way: a clinician pasting consultation notes into a consumer chatbot without the clinic's knowledge, or signing up for a free scribe trial on a personal email, and the clinic discovering it months later.

That instinct is correct. Consultation audio is special category data under UK GDPR, the most protected class of personal data there is. The good news is that the governance questions have clear answers, and a well-run deployment is straightforward to evidence. We cover the wider landscape in our overview of why compliance is critical for AI in healthcare; this post goes deeper on the scribe-specific questions.

The eight questions to ask any AI scribe vendor, in writing

Before anything else, here is the checklist. Send it to every vendor on your shortlist and keep the written answers with your DPIA. Verbal reassurance on a sales call does not count.

Any vendor serious about healthcare will answer all eight without hesitation. Treat evasiveness on questions 2, 3 or 6 as disqualifying: retention, training use and the DPA are where the real risk sits.

Why "is it GDPR-compliant?" is the wrong first question

"Is your product GDPR-compliant?" invites a one-word answer that tells you almost nothing, because no product can be compliant on your behalf. UK GDPR assigns responsibilities to roles, and your clinic holds the senior one.

The better first question is: who is accountable for what?

In plain terms, the law splits duties between two roles:

• The controller decides why and how personal data is processed. That is your clinic. You chose to introduce an AI scribe, you decide what it is used for, and you answer to your patients and to the ICO for the overall processing.

• The processor handles data only on the controller's documented instructions. That is the scribe vendor. Their duties are real (security, confidentiality, breach notification, deleting data when instructed) but they are duties owed largely to you, under the contract.

This is why the data processing agreement matters so much. Article 28 of UK GDPR requires a written contract between controller and processor covering exactly these points. No DPA, no lawful deployment, whatever the product's certifications say.

Here is how the responsibilities divide in practice:

Once you see the split, vendor selection becomes clearer: what you are choosing is a processor whose controls make your compliance achievable and easy to evidence, because no purchase can transfer the controller's accountability.

What your clinic must do: the controller's side

These five items are yours regardless of which scribe you choose. None is onerous, and all of them are things the ICO and CQC would expect to see documented.

Establish your lawful basis

Every processing activity needs a lawful basis under Article 6 of UK GDPR, and because consultation content is health data, you also need a separate condition under Article 9 for special category data. For most clinics, the analysis mirrors the one you already did for your clinical records: the scribe is part of delivering care and keeping proper records of it. Your data protection lead (or external DPO) should document which Article 6 basis and Article 9 condition apply, in the same way as for your existing record-keeping. The ICO's guidance on lawful basis and on special category data is the reference here, and it is written to be usable by non-lawyers.

A common misconception is that GDPR consent must be the lawful basis. Usually it is not, and the ICO cautions against relying on consent where there is an imbalance of power, as there can be between clinician and patient. Which brings us to the distinction that matters.

Inform the patient and record agreement to the recording, every visit

Separate from your GDPR lawful basis, the patient should always know the consultation is being recorded and agree to it. This reflects the common law duty of confidentiality and plain professional courtesy as much as data protection law. Good practice, and the workflow Motics is built around, is a brief verbal explanation at the start of each appointment ("I use an AI scribe to write my notes; the audio is deleted within 48 hours; are you happy for me to record?") with the patient's agreement captured at each visit. Patients who decline simply have their notes written the traditional way; the scribe should make opting out straightforward.

Recording that agreement matters because it is your evidence. If a patient later complains, a logged consent at the visit in question closes the matter quickly.

Complete a DPIA before go-live

A data protection impact assessment is legally required where processing is likely to result in high risk to individuals, and the ICO's DPIA guidance identifies large-scale processing of special category data and the use of innovative technology as triggers. An AI scribe processing consultation audio comfortably meets that bar, so treat the DPIA as mandatory rather than optional.

The exercise is smaller than it sounds: describe the processing, assess necessity and proportionality, identify the risks (unauthorised access, excessive retention, vendor misuse, transcription errors reaching the record unreviewed), and record the mitigations. The vendor answers from the eight-question checklist above supply most of the technical half. A well-chosen vendor makes the DPIA short; a vague one makes it impossible to finish, which is itself your answer.

Update your privacy notice

Your patient-facing privacy notice should mention that AI-assisted documentation is used, what data is involved, how long audio is kept, and who the processor is. This is a paragraph, not a rewrite, but transparency is a core UK GDPR principle and an easy win at inspection.

Set internal access controls

Decide who in the clinic can view transcripts and generated notes, who administers the scribe account, and what happens when a staff member leaves. Use the clinic-level account controls rather than letting access accumulate informally. This is also where you set the policy that no patient data goes into any AI tool outside the sanctioned one, on which more below.

Is an AI scribe a medical device? The question most clinics have never asked

Here is the angle that surprises most practice managers: software can be a medical device, and the MHRA regulates it as such. The MHRA's guidance on medical device stand-alone software (and its ongoing Software and AI as a Medical Device programme) sets out the test, which turns on intended purpose. Software intended to inform or drive clinical decisions is in scope; a passive record of what was said generally is not.

For AI scribes, the practical line to watch is descriptive versus prescriptive functionality:

Modern scribes do more than verbatim transcription: they summarise, structure and rephrase, which is exactly why the regulatory direction of travel matters. NHS England's 2025 guidance on AI-enabled ambient scribing products noted that many such tools may qualify as medical devices depending on functionality, and vendors selling into UK healthcare should have engaged with that question rather than hoped it goes away.

This is why vendor registration is a useful signal even at the lowest classification. Motics is registered as a Class 1 medical device with the MHRA, which means the intended purpose, risk classification and post-market obligations have been thought through and formally declared. When a vendor has never considered whether device regulation applies to them, you inherit that unexamined risk.

To be clear about what a scribe should not do in any case: it documents the consultation. Clinical judgement stays with the clinician, and the clinician reviews and signs off every note. That human review step belongs in your DPIA and your standard operating procedure.

What does CQC expect when a clinic uses AI?

The CQC does not certify AI tools, and there is no CQC-approved product list. What the CQC regulates is you, the provider, and its fundamental standards make you accountable for any tool used in the delivery of regulated activity. Under the well-led framework, inspectors are interested in whether the practice understands the technology it uses and governs it deliberately.

The encouraging flip side: well-governed AI use is entirely inspectable. If asked, you want to be able to produce:

• the DPIA and the decision record for adopting the tool

• the signed DPA and the vendor's written answers to the security questions

• your updated privacy notice and the consent workflow (with logged patient agreement)

• your access control policy and staff guidance

• evidence that clinicians review and approve notes before they enter the record (an audit trail)

A clinic that can put those five items on the table in ten minutes is in a stronger position than one using no AI at all but with patchy paper processes. Inspection rewards governance rather than avoidance.

The riskiest AI in your clinic is the AI you have not sanctioned

Every question so far assumes the clinic chose the tool. In practice, the biggest data protection exposure in UK clinics right now is the tool nobody chose: shadow AI.

It looks like this. A clinician, entirely well-meaning and pressed for time, pastes a patient summary into a free consumer chatbot to draft a referral letter. Another signs up for a scribe app on a personal email and personal card because the trial was free. A locum brings their own subscription from their last practice. In each case, identifiable patient data has left your governance completely: no DPA, unknown retention, possible use of the data for model training, no access control, and the clinic is still the controller, accountable for processing it does not even know is happening.

Two things follow.

First, an outright ban does not work. Clinicians reach for these tools because the underlying need (faster notes, quicker letters) is real. Prohibition without an alternative just pushes the behaviour further out of sight.

Second, the effective remedy is a sanctioned route. Give the team a governed scribe for documentation and a secure, compliant chat interface where clinicians can use AI with real patient data, inside the clinic's account, covered by the DPA, with retention and training-use guarantees in place. Motics includes exactly that pairing (the Scribe agent and the Chat agent) so the compliant path is also the convenient one. Then make the policy explicit: patient data goes into the sanctioned tools and nowhere else, and question 8 on the vendor checklist (can staff self-subscribe outside your governance?) becomes part of procurement.

The same shadow-versus-sanctioned logic applies beyond scribes. If your practice is looking at call handling too, our guide to AI phone agents for UK clinics covers the equivalent governance questions on the front desk side.

Does a compliant setup cost more?

Mostly, no. Compliance-grade data handling should come as standard rather than as an upgrade. On Motics, every plan (Free at £0 with 25 credits a month, Starter at £19 a month, Team from £98 a month, Scale from £290 a month, all ex VAT) includes the same core data handling: audio deleted within 48 hours, no training on customer data, and encryption in transit and at rest. What sits on the Enterprise tier is the governance tooling larger organisations need around procurement, namely SSO and formal security review support. Treat any vendor who charges extra for basic data protection commitments (a DPA, deletion, no-training guarantees) with suspicion.

How to choose a compliant AI scribe

A sensible procurement sequence for a UK clinic:

1. Send the eight questions to every shortlisted vendor and require written answers. Discard anyone who is vague on retention, training use or the DPA.

2. Check the public evidence. A trust centre, a Cyber Essentials certificate and an MHRA registration are all claims you can verify independently, so verify them rather than taking the marketing page's word.

3. Draft the DPIA early, using the vendor answers. If you cannot complete it from what a vendor gives you, that vendor has failed the test before the trial starts.

4. Trial with governance on, not as an afterthought: clinic account (never personal sign-ups), consent script in use from day one, and clinician review of every generated note.

5. Confirm the human workflow. Notes must be reviewed and approved by the clinician before entering the record, and the verbatim transcript should be preserved as a medico-legal record while the summary remains editable.

6. Put the internal policy in writing: sanctioned tools named, everything else off-limits for patient data, and a named owner for AI governance in the practice.

Compliance is one pillar of the wider selection decision; accuracy, template fit and integration with your practice management system are the others. We have set out the full buying criteria in how to choose safe AI phone and scribe agents.

FAQ

Do I need patient consent to use an AI scribe?

You need the patient's informed agreement to the recording itself, captured at each visit, and an opt-out that costs the patient nothing (the clinician simply writes notes the traditional way). That agreement is usually separate from your UK GDPR lawful basis: most clinics do not rely on GDPR consent as the legal basis for processing, for the same reasons they do not for ordinary clinical records. Document both parts: the basis in your DPIA, the agreement in the consent log.

Does using an AI scribe make me non-compliant with CQC?

No. CQC accountability attaches to how you govern the tools you use, not to whether you use them. A scribe deployed with a DPIA, a signed DPA, an informed-consent workflow, access controls and clinician sign-off of every note is defensible at inspection. An undocumented free tool on a clinician's personal account is the version that creates CQC and ICO risk.

Where does the consultation audio go, and how long is it kept?

Ask every vendor for the specific answer in writing. For Motics: audio is encrypted in transit and at rest, deleted within 48 hours, and never used to train models; the verbatim transcript is retained as a locked medico-legal record while the generated note remains editable by the clinician. Data residency and sub-processor detail is documented in the public trust centre.

Is my clinic's data used to train the vendor's AI models?

It must not be without your explicit agreement, and the commitment should be contractual. Motics never uses customer data to train models, on any plan. This is the single most important question to get in writing, because consumer-grade AI tools often reserve exactly this right, which is a core reason personal accounts are unsafe for patient data.

What happens if the vendor has a data breach?

Under UK GDPR the processor must notify you, the controller, without undue delay, and you must assess whether the breach is reportable to the ICO within 72 hours of becoming aware of it. Before signing, get the vendor's notification commitment in writing as part of the DPA, and make sure your own incident procedure names who receives that notification at the clinic.

Do I need a DPIA even for a small practice?

Yes. The DPIA requirement turns on the nature of the processing, not the size of the organisation, and systematic processing of special category health data with novel technology is squarely in scope under ICO guidance. For a small practice with a well-documented vendor it is a short exercise, and it doubles as your evidence base for CQC.

References

• Information Commissioner's Office (ICO): Guide to UK GDPR, including guidance on lawful basis for processing and on special category data (ico.org.uk)

• ICO: Data protection impact assessments (DPIA) guidance

• ICO: Controllers and processors guidance, including contract requirements under Article 28

• UK GDPR: Articles 6 (lawful basis), 9 (special category data), 28 (processor contracts) and 33 (breach notification)

• Medicines and Healthcare products Regulatory Agency (MHRA): Medical device stand-alone software including apps, guidance; Software and AI as a Medical Device Change Programme (gov.uk)

• NHS England: guidance on the use of AI-enabled ambient scribing (ambient voice technology) products in health and care settings, 2025

• Care Quality Commission (CQC): fundamental standards and the well-led framework (cqc.org.uk)

• National Cyber Security Centre: Cyber Essentials certification scheme

Motics is the AI operating system for clinics, with a Scribe agent built for UK governance from the ground up: patient consent in the workflow, audio deleted within 48 hours, no training on customer data, Cyber Essentials certification and MHRA Class 1 registration, all documented in a public trust centre. If your clinic is weighing up an AI scribe and wants the compliance questions answered in writing rather than on a sales call, see how it fits your practice at motics.ai.