AI scribes in the NHS, what is actually required

What changed on 29 July 2026

The MHRA published guidance clarifying how existing medical device law applies to ambient voice technology in Great Britain, developed in partnership with NHS England. It works through examples rather than abstractions, which is why it settles the question.

Not a medical device, on that guidance. A product solely intended to transcribe a conversation. One that summarises a conversation without making clinical recommendations. One that formats information into structured data for clinician review and confirmation. One that suggests clinical codes from terms explicitly mentioned rather than deduced. One that drafts documents from existing records for a clinician to review and edit.

A medical device, on the same guidance. A product that offers generated insights such as suggested diagnoses or follow-up and treatment options. One marketed as guiding diagnosis and treatment planning. One that analyses data and places orders without clinician input. One that offers suggested diagnoses as diagnostic recommendations. The line is whether the software is documenting or deciding.

What did not change, which is most of it

The device question was always the noisiest requirement and never the largest. Everything in NHS England's guidance on AI-enabled ambient scribing still stands, and none of it turns on device status. Its own wording is that the safety requirements apply to all digital products to be used in the NHS, regardless of whether it is considered a medical device.

Your supplier owes you a DCB0129 clinical safety case with a hazard log that is live rather than a document written once. You complete a DCB0160 for your own setting, which means a local safety case, a local hazard log, a monitoring framework and a data protection impact assessment. You assign a Clinical Safety Officer, who has to be a registered clinician with clinical safety training rather than whoever has capacity.

DTAC, DSPT and Cyber Essentials sit alongside. The DSPT moved to align with the National Cyber Security Centre's Cyber Assessment Framework for 2025/26, with four CAF objectives plus an NHS-specific objective on lawful use and sharing of patient information, an independent audit, and a submission deadline of 30 June 2026. Holding Cyber Essentials Plus or ISO 27001 does not exempt an organisation from it.

A pilot does not suspend any of this

This is the most common and most expensive misreading. NHS England's guidance states that running a pilot or proof of concept does not exempt a supplier from compliance, and that pilots can continue as planned only if they are time-limited, up to four months, and are not used to bypass compliance.

So a four month trial with a supplier who has no DCB0129 is not a trial, it is a non-compliant deployment with an end date. The safety case, the hazard log, the DPIA and the Clinical Safety Officer are all required before the first patient, not after the pilot succeeds.

Design the pilot properly and it answers the questions that actually decide the purchase. Our guide to running a scribe pilot sets out the acceptance criteria worth agreeing in writing first.

The AVT Supplier Registry, and what it is not

NHS England launched a national self-certified registry for ambient voice technology suppliers on 16 January 2026, with applications reopening on 3 February 2026 through the Find a Tender service. It holds an accepted list of suppliers and a repository of supporting evidence.

Three things it is not. It is not a commercial framework, so being on it does not let anyone buy without a procurement route. It is not an endorsement, and NHS England says so directly. And it is not compulsory, so a product absent from it faces no stated restriction, whatever you may have read.

What it is good for is saving you the first hour of diligence, because the evidence is in one place. Treat it as a starting point rather than a pass mark, and do the checks in the next section anyway.

Registered is not certified

These two words are used as though they mean the same thing and they do not, which matters more now that fewer products need either. Registered means listed with the MHRA, and at Class I a manufacturer self-declares with no external assessment. Certified means an independent UK Approved Body has assessed it, which is mandatory at Class IIa and above.

One ambient voice product was reported as the first certified UKCA Class IIa on 24 June 2026. Another holds EU MDR Class IIa with CE marking, which Great Britain accepts until 30 June 2028. A widely used ambient scribe has been reported as self-declared Class I with Class IIa in progress. Verify any of these against the MHRA public register rather than taking a vendor's word, including ours.

A survey of 121 AI scribe products found only 7 percent explicitly claimed Class I status, and of those only six could be located on the MHRA register under the same or a clearly linked legal entity. That was published as a preprint in March 2026, before the MHRA guidance, and it reads differently now. Most of those products never needed the registration they were being criticised for lacking.

Transparency, not consent

Explicit patient consent is not legally required for an ambient scribe used in individual care in England. Transparency is. You tell the patient what is being recorded, what the output will be, and who will use it and how it is stored, and NHS England publishes wording you can adapt.

That is close to the opposite of the United States, where about a dozen states require consent from every party to a recording and some carry personal exposure for the clinician. If you practise in both, our guide to US recording consent laws covers that side.

Audio and transcripts should be deleted once a verified summary exists unless there is a clear justification for keeping them, and the clinician remains responsible for the accuracy of the record. NHS England is explicit that users must review and approve outputs before any further action.

The independent clinic, which this guidance does not reach

The MHRA position on device status applies to any clinic in the United Kingdom, because whether a product is a medical device is a question of law rather than of who is buying it. Almost everything else on this page is not. DCB0160, DTAC and the Data Security and Protection Toolkit are NHS instruments, owed by NHS organisations and by suppliers contracting with them, and an independent clinic working outside the NHS record estate is not bound by any of them.

What governs there instead is the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, enforced by CQC, together with UK GDPR. The questions change shape rather than disappearing. Nobody asks a private clinic for a DTAC, and somebody will eventually ask what its records system can evidence about who wrote an entry, when it was created and what it said before it was edited, which is covered in what documentation software has to prove.

The two regimes differ in vocabulary rather than in seriousness. A clinic that adopts DCB0160 voluntarily has a better safety case than one that adopts nothing, and we think that is worth doing. What it does not have is an obligation, so a supplier presenting an NHS requirement to a private buyer as a legal duty is describing somebody else's. The map of what does apply is in software and CQC, what is actually being assessed.

How to check any vendor, including us

Ask four things and make them answer in writing. Which legal entity holds any registration, because brand and manufacturer names frequently differ and that breaks traceability. Which product and which feature is covered. Under which regime and at which class. And who assessed it, or whether it is self-declared.

Then ask the question the new guidance makes the important one. Does any feature offer a suggested diagnosis, a management plan, or an action taken without a clinician. If yes, it is a device whatever the marketing says. If no, ask why the vendor is still claiming a registration it does not need, because that is its own kind of answer.

The wider procurement set is in what to ask a scribe vendor, and the assessment itself is in DTAC explained for clinics buying an AI scribe.

What we are not claiming

We are not telling you we are the best option for an NHS organisation today. The messaging platform already in around 98 percent of GP practices in England reported a scribe partnership in May 2026 that puts a scribe in front of more than 200,000 NHS staff. Distribution at that scale is not something a standalone product competes with directly and we will not pretend otherwise.

If you need a certified device because a feature genuinely crosses the line, a product certified at UKCA Class IIa is where to look. If you want the least friction inside general practice, try what is already in the building first.

This is general information rather than regulatory advice, and it is dated for a reason. The position moved three times in eighteen months and the most recent move was in the opposite direction to the previous two. Check the primary sources below against the date you are reading this. Clinicians still decide what enters the record.

Frequently asked questions