Insights · Agentrix

By Agentrix · Updated 20 October 2026

Using AI in a care business: what the DHSC and CQC guidance says

If you run a care service or a care staffing agency, the rules on AI used to be vague. That has changed. The Department of Health and Social Care published guidance on using AI in adult social care on 29 September 2026, and CQC updated its own position in May 2026. Between them, they set out what a provider is expected to have in place.

This is a plain-English summary of both, with links to the originals. Both apply to England, but most of the practical points are worth following wherever in the UK you operate (see below).

What has DHSC published?

The guidance is called Using AI in adult social care. It covers care-facing tools and everyday admin. It names Microsoft Copilot and Claude as tools that can record meetings and produce notes and action lists, and it mentions AI for automated responses, vacancy administration and onboarding scheduling in recruitment.

It's also honest about where the sector is. DHSC says "many adult social care providers are still in the early stages of exploring AI". If you haven't done much yet, you're not behind.

What does DHSC ask care providers to do?

The best practice section is the part worth printing. In short:

• Have a human review AI output. DHSC recommends always including a human review of anything AI generates, to check accuracy and fairness. If AI is used in care planning, a member of care staff must review the plan.
• Comply with UK GDPR. Know where data is processed and tell people how their data is being used.
• Keep personal data out of free tools. If you use a free or online tool, don't put in personally identifiable information. Without a contract with the supplier, you can't guarantee what happens to it.
• Introduce an AI policy. DHSC says all organisations should consider one, "even if your policy is that staff cannot use AI for work purposes". It suggests the policy should answer who is responsible for AI decisions and tasks, and how the organisation oversees its use of AI.
• Train staff. Make sure people are skilled and confident, and consider digital champions who can help colleagues.
• Decide your position on AI-written applications. More applicants use AI to write CVs. DHSC suggests deciding whether you're happy to receive them and, if not, saying so in your job adverts.

What does CQC expect?

CQC's page, AI in health and social care: CQC's role, expectations and plans, was last updated on 21 May 2026. It sets out principles providers must follow when using AI in line with the regulations. The ones most relevant to a small provider are:

• Support, not replace. AI can enhance human decision making but not replace it.
• Human oversight. AI outputs and processes are continuously monitored and evaluated.
• Security. Sensitive information is stored and processed securely, in line with GDPR.
• Training. People using AI are trained and confident with it.
• Governance. Risk assessments, and a way to recognise, report and investigate when something goes wrong.
• A DPIA. A data protection impact assessment that documents the risks to privacy and how you're reducing them.
• Procurement. AI tools are bought in line with relevant standards.

Will using AI help or hurt our CQC rating?

Neither, on its own. CQC is clear: "the absence or presence of AI does not predict a specific rating." What matters is whether care is safe, effective and well run. If you use AI, you need to be able to show it's governed properly. If you don't, that isn't held against you.

Can staff use free AI tools like ChatGPT?

Not with personal data. That's the clearest line in the DHSC guidance. A free tool might be fine for rephrasing a generic job advert, but nothing that identifies a service user, relative or colleague should go in. It's also easy to get wrong, because it often happens without anyone deciding it should. An AI policy that spells out which tools are approved, and for what, closes that gap.

Do we need a DPIA, and what goes in one?

If AI will touch personal data, assume yes. CQC lists a DPIA among its principles. In practice, a DPIA for a small provider describes what the AI tool does, what data goes into it, where that data is processed, what could go wrong for the people whose data it is, and what you've done about it, such as limiting the data, controlling access and having a named reviewer. It doesn't have to be long, but it should be specific to the process.

Does this apply in Scotland, Wales and Northern Ireland?

The DHSC guidance and CQC's expectations cover England. Care in Scotland, Wales and Northern Ireland has its own regulators: the Care Inspectorate, Care Inspectorate Wales and RQIA. UK GDPR applies UK-wide, though, so keeping personal data out of free tools, doing a DPIA and having a person review AI output make sense wherever you are.

Why does this matter more for care staffing?

Recruitment admin is heavy in care. In England alone, Skills for Care estimates there were around 96,000 vacant posts in adult social care in 2025/26, a vacancy rate of 6.2%, with turnover of 23.6% in the independent sector (Skills for Care, size and structure report, 24 Jun 2026). Vacancies are at their lowest since 2015/16, but that is still a lot of adverts, applications, onboarding and scheduling, which is exactly the work DHSC mentions as suitable for AI. It also means a lot of personal data, so the safety basics come first.

Where should a care provider start?

Choose one admin process, such as meeting notes or onboarding scheduling, using tools you already pay for (Microsoft 365 Copilot, Google Workspace with Gemini, or a business Claude plan) rather than free ones. Write a short AI policy, complete a DPIA for that process, and name the person who reviews the output. Then measure how long the process takes before and after.

On our five-stage maturity ladder, a process only scores stage 4 or above when those basics are in place, and for a lot of care work stage 4, with a person approving every output, is the right place to stop. There's a shorter summary on our AI in care page.

AIOS helps you get set up and use AI safely. It isn't legal advice, and we can't guarantee a compliance or inspection outcome.