AI Governance 1 July 2026 | Reviewed September 2026 — checked against CQC's current AI principles, ICO AI/data-protection guidance and current NHS digital clinical safety standards
What Is an AI Impact Assessment and Why Every Care Provider Needs One Now
Copy link
CQC does not currently require every care provider to complete a document formally called an 'AI Impact Assessment'. It does, however, now explicitly expect providers using AI to have effective governance mechanisms, including risk assessment, human oversight, safety and reliability controls, appropriate security, staff training, accountability and appropriate procurement. CQC also identifies Data Protection Impact Assessments (DPIAs) as part of lawful AI use where data-protection risks require them. An AI Impact Assessment can therefore be used as a practical governance framework for bringing these questions together — but it should not be described as a standalone CQC statutory requirement.
AI governance in health and social care moved onto much firmer regulatory ground in 2026.
CQC published its national position on artificial intelligence in health and social care in May 2026. It encourages innovative technologies where they benefit people and support high-quality, equitable care, but makes clear that existing regulations continue to apply regardless of the technology used.
CQC identifies Regulation 9 (person-centred care), Regulation 10 (dignity and respect), Regulation 11 (consent), Regulation 12 (safe care and treatment) and Regulation 17 (good governance) as particularly relevant to AI-enabled care.
Its provider principles now explicitly address human oversight, transparency and choice, safety and reliability, security, fairness, staff readiness and training, effective governance, DPIAs, accountability and procurement.
This changes the governance question for providers. The issue is no longer whether CQC has anything to say about AI. It does. The practical question is how a provider demonstrates that an AI tool has been considered, introduced, monitored and governed in a way that is consistent with those existing regulatory duties.
An AI Impact Assessment is one practical way of structuring that evaluation. It can bring together the purpose of the AI, affected people, data use, safety risks, human oversight, equality considerations, supplier assurance and organisational controls. The important distinction is that 'AI Impact Assessment' is a governance framework used in this article — not the title of a universal statutory CQC form.
What Is an AI Impact Assessment?
An AI Impact Assessment is a structured evaluation of the implications of introducing or using an AI system.
For a health or social care provider, a useful assessment can bring together questions about:
There is no single universal CQC form called an AI Impact Assessment.
The value of the assessment is that it provides a structured way of addressing several governance questions that CQC now explicitly expects providers using AI to consider.
- purpose and intended use
- people affected by the system
- safety and reliability
- human oversight
- personal and special-category data
- privacy and data-subject rights
- equality, fairness and potential bias
- staff competence and training
- supplier and product assurance
- accountability
- incident management
- ongoing monitoring and review
What Does CQC Actually Say About AI?
CQC's May 2026 position sets out 11 principles for providers using AI:
CQC does not assess or approve individual AI products. Its role is to consider whether providers deliver safe, effective and equitable care in accordance with the regulations when technology, including AI, is used.
CQC also states that the presence or absence of AI does not itself predict a particular rating.
Providers should not approach AI governance as an exercise in obtaining 'CQC approval' for a tool. They need to demonstrate that the technology is selected, deployed and used consistently with existing regulatory responsibilities.
| CQC principle | Practical governance question |
|---|---|
| AI to support, not replace | Is human professional decision-making being preserved? |
| Human oversight | Who monitors and evaluates AI outputs and processes? |
| Transparency and choice | Do people receive appropriate information about AI's role, and are appropriate non-digital routes available? |
| Safety and reliability | Has the provider established that using the system supports safe care and equitable outcomes? |
| Security | Is sensitive information processed and stored securely? |
| Fairness and impartiality | Have potential biases and unequal outcomes been identified and mitigated? |
| AI readiness and training | Are staff trained and confident, and has integration into existing pathways been assessed? |
| Effective governance | Are risk assessment, incident reporting, investigation, learning and improvement mechanisms in place? |
| Data Protection Impact Assessment | Have privacy and data-subject-rights risks been assessed where required? |
| Accountability | Is it clear who is responsible for addressing problems or harm? |
| Procurement | Has the tool been procured in accordance with relevant regulatory standards? |
AI Impact Assessment vs DPIA vs Clinical Safety Assessment
These governance processes overlap, but they are not interchangeable.
A provider should not assume that completing one process automatically satisfies the others. An AI Impact Assessment may identify that a DPIA is required, while DCB0129 and DCB0160 responsibilities must be addressed separately where applicable.
| Assessment/process | Primary purpose | When relevant |
|---|---|---|
| AI Impact Assessment | Broad organisational assessment of AI purpose, risks, affected people, oversight and controls | A useful governance approach; not a universally prescribed CQC form |
| DPIA | Identify and minimise risks to rights and freedoms from personal-data processing | Required where processing is likely to result in high risk |
| DCB0129 | Clinical risk management for manufacturers of health IT systems | Relevant to manufacturers within scope |
| DCB0160 | Clinical risk management for deployment and use of health IT | Relevant to health and care organisations where the standard applies |
Why Care Providers Need One Now
Care providers need a structured approach to AI risk because CQC has now expressly incorporated AI into its published regulatory position. Its May 2026 guidance says existing regulations apply to AI-enabled care and identifies effective governance mechanisms such as risk assessments as part of responsible use.
An AI Impact Assessment is the document that answers those questions before they become the subject of an inspection finding.
The timing matters because AI adoption in care settings is accelerating faster than governance awareness. Care workers and managers are using AI tools — chatbots, writing assistants, summarisation tools, documentation aids — in their daily work, often without any organisational assessment of whether those tools are appropriate, what data they process, or how their outputs are reviewed before entering care records. In many cases, this is happening without the knowledge of the registered manager or the information governance lead.
An AI Impact Assessment conducted at the organisational level creates visibility. It answers the question: what AI tools are we actually using, across the whole service, and have we thought carefully enough about each of them?
What Should a Care Provider's AI Impact Assessment Cover?
There is no mandatory CQC template, but CQC's current AI principles provide a strong basis for deciding what a structured assessment should examine.
1. Tool, Purpose and Intended Use
Record the AI system, supplier, intended purpose, users and specific tasks. Establish whether the proposed use falls within the tool's intended purpose.
2. People Affected
Identify people receiving care, relatives, staff and professionals who may be affected, including groups that could experience different risks, barriers or outcomes.
3. Human Oversight and Accountability
Define who reviews AI-assisted outputs and decisions. AI should support rather than replace human decision-making, with clear challenge and accountability routes.
4. Safety and Reliability
Identify how incorrect, incomplete, misleading or inappropriate output could affect care, how outputs are checked and when escalation is required.
5. Data Protection and Security
Establish what information is processed, whether personal or special-category data is involved, where it is stored and what supplier arrangements apply. Determine whether a DPIA is legally required; this assessment is not a substitute for one.
6. Equality, Fairness and Accessibility
Consider unequal outcomes, barriers, limitations, potential bias and appropriate alternatives where digital access or connectivity creates difficulty.
7. Transparency and Choice
Determine what people need to know about AI's role and whether meaningful alternatives or non-digital routes are available.
8. Staff Readiness and Training
Identify competence, instruction and supervision requirements, including limitations, verification, information governance and escalation.
9. Supplier, Procurement and Regulatory Assurance
Record contractual, security, data-processing, medical-device and digital clinical-safety assurance. Supplier assurance does not remove responsibility for safe local use.
10. Incident Management, Monitoring and Review
Define how errors, near misses, concerns and adverse outcomes are recognised, reported, investigated and learned from, with review triggers for material changes, incidents or regulatory developments.
AI Impact Assessment: Practical Decision Table
| Question | If the answer is unclear |
|---|---|
| What exactly is the AI being used for? | Define intended use and scope before proceeding |
| Who could be affected? | Map affected people and consequences |
| Who reviews the output? | Establish human oversight and accountability |
| Could an error affect care? | Conduct proportionate safety and risk assessment |
| Does it process personal data? | Assess UK GDPR obligations and DPIA threshold |
| Could outcomes differ between groups? | Assess equality, fairness and potential bias |
| Are staff competent? | Put training and supervision in place |
| How will problems be detected? | Establish monitoring, incident and review arrangements |
Who Should Be Involved?
The appropriate people depend on the service, technology and level of risk.
Responsibility should sit with someone who has sufficient authority to ensure identified risks lead to action, but AI governance should not automatically be assigned to one individual simply because they are the registered manager.
Depending on the use case, relevant contributors may include:
The objective is proportionate multidisciplinary scrutiny. A low-risk administrative tool does not necessarily require the same depth of assessment as an AI system influencing clinical decisions, care planning, monitoring or access to services.
Ready to Build Your AI Governance Foundation
- the registered manager or operational lead
- information-governance or data-protection expertise
- clinical or professional leadership
- digital or IT expertise
- safeguarding or quality leads
- staff who will use the system
- procurement or contract-management expertise
- a Clinical Safety Officer where applicable
- representatives of people affected where appropriate
AI Impact Assessment Template + Complete Governance Pack
10 editable Microsoft Word templates including AI Impact Assessment, AI Systems Register, Risk Assessment, Acceptable Use Standard, Output Review Record, and six more governance documents. Start with the assessment. Build from there.
How Does an AI Impact Assessment Fit With Other Governance Requirements?
An AI Impact Assessment should sit within the provider's wider governance system rather than operate as an isolated document.
DPIA
A DPIA addresses risks to people's rights and freedoms arising from personal-data processing. The ICO states that a DPIA must be carried out where processing is likely to result in high risk to individuals. AI does not remove or replace that legal test.
Clinical safety
Where digital clinical safety standards apply, DCB0129 and DCB0160 have different responsibilities. DCB0129 concerns manufacture of health IT systems; DCB0160 concerns deployment and use by health and care organisations.
CQC governance
CQC's AI principles identify effective governance mechanisms such as risk assessments, human oversight, monitoring, incident reporting and investigation. An assessment can provide evidence of how those questions were approached, but the document alone does not demonstrate safe or compliant practice. It must connect to actual controls, decisions, staff practice, monitoring and improvement.
When to Conduct One
An AI Impact Assessment should be conducted before a new AI tool is introduced to the service — not after it has been in use for several months and has already influenced care records or operational decisions. Retrospective assessments are possible and better than no assessment at all, but they cannot undo the period of ungoverned use that preceded them.
The assessment should be reviewed and updated whenever a new AI tool is introduced, whenever an existing tool is significantly changed or upgraded, whenever the organisation's use changes substantially, and at a review frequency proportionate to the risk, with additional review when material changes, incidents, new evidence or regulatory developments occur.
For organisations that are only now formalising AI governance, the right starting point is a rapid audit: identify every AI tool currently in use across the service, prioritise them by the sensitivity of the data they process and the significance of the decisions they influence, and conduct the full assessment for the highest-priority tools first.
What the Assessment Produces
A completed AI Impact Assessment produces three outcomes. The first is a documented record that the organisation has asked and answered the right questions about its AI use — the record that demonstrates responsible governance to a CQC inspector, an ICO investigator, or any other regulatory body that asks.
The second is a structured view of the organisation's actual AI risk profile — which tools introduce material risk, which are being used appropriately within their designed scope, and which require additional controls or should be discontinued.
The third is a governance baseline from which future AI adoption decisions can be made. An organisation with a completed AI Impact Assessment for its current tools is in a position to evaluate new AI tools systematically rather than reactively, comparing each proposed new tool against the governance standards the assessment has established.
This last outcome is perhaps the most valuable in the long run. AI tools for care settings are proliferating rapidly, and the organisations that will navigate this environment most effectively are not those that avoid AI — the efficiency and quality benefits are real and the direction of travel is clear — but those that have built the governance infrastructure to adopt AI responsibly, at pace, with documented evidence of responsible decision-making at each step.
An AI Impact Assessment is where that infrastructure begins.
Frequently Asked Questions
Q: Does CQC require an AI Impact Assessment?
A: CQC does not currently prescribe a universal document or form called an 'AI Impact Assessment'. Its May 2026 AI position does explicitly expect effective governance mechanisms such as risk assessments and identifies human oversight, safety, security, fairness, training, DPIAs, accountability and procurement. A structured assessment is one practical way to bring those considerations together.
Q: Does CQC allow care providers to use AI?
A: Yes. CQC encourages innovative technologies, including AI, where they benefit people and support high-quality, equitable health and social care. Existing regulations continue to apply regardless of whether AI is used.
Q: Does CQC approve AI tools?
A: No. CQC does not assess or approve specific technologies. Its concern is whether providers use technology in ways that support safe, effective and equitable care and comply with relevant regulations.
Q: Can using AI affect a CQC rating?
A: CQC states that the absence or presence of AI does not predict a particular rating. What matters is whether applicable requirements are met and whether AI contributes to safe, effective and equitable care.
Q: Is an AI Impact Assessment the same as a DPIA?
A: No. A DPIA concerns risks to people's rights and freedoms from personal-data processing and is legally required where processing is likely to result in high risk. An AI Impact Assessment can examine broader operational, safety, equality and governance issues.
Q: Does every use of AI require a DPIA?
A: Not automatically. The legal test is whether processing is likely to result in high risk to individuals. Providers must assess their processing against current data-protection requirements and complete a DPIA where that threshold is met.
Q: What does CQC say about human oversight?
A: CQC says AI should support rather than replace human decision-making and that AI outputs and processes should be monitored and evaluated.
Q: What should care providers assess before introducing AI?
A: Providers should consider intended use, people affected, safety and reliability, human oversight, data protection and security, fairness, staff readiness, transparency, accountability, procurement and ongoing monitoring. The depth should be proportionate to risk.
This article aligns with PAIDS™ (Professional AI Documentation Standards) — well-sourced, thoroughly researched, and defensible with verifiable data. reporticaai.co.uk/governance
Cross-referenced with: AI Governance in Care Settings , ICO Better Records Together Campaign , CQC AI Guidance and Documentation
For the wider governance context, read What CQC Inspectors Actually Look For Under the Well-led Key Question .
Need help choosing?