RWK September News

AI and the Regulator.

As I have written and said before, artificial intelligence (AI) is no longer a future issue for adult
social care providers. It is already being used across the sector to produce care records, identify
patterns in data and automate administrative tasks.
Used appropriately, AI has the potential to reduce administrative burden, improve efficiency
and help providers focus more time on delivering care.
However, AI also presents significant legal, ethical and regulatory risks. The question for
providers is no longer whether AI should be used, but whether it is being used safely, lawfully
and with appropriate governance.

CQC’s message is clear: existing regulation already applies

On 21 May 2026, the Care Quality Commission (CQC) published its first formal statement on AI, entitled
Artificial Intelligence in Health and Social Care: CQC’s Role, Expectations and Plans. The document makes a
crucial point: there is no separate AI regulatory framework for adult social care providers. Instead, AI will be
scrutinised through the existing regulatory framework and Fundamental Standards of care.
CQC emphasised that it does not approve individual AI products. Rather, its role is to ensure that technology
contributes to safe, effective, equitable and person-centred care. The regulator’s focus will therefore be on how
providers select, implement, oversee and monitor AI systems.
Importantly, CQC has made clear that AI should support human decision-making, not replace it. Providers
remain accountable for decisions affecting people who use services, regardless of whether or not an AI tool
was involved.

What will CQC expect to see?

The CQC’s statement on AI identifies a number of core principles that providers should be able to demonstrate,
including:
• Human oversight and accountability.
• Transparency about how AI is used.
• Appropriate staff training and competence.
• Effective governance and risk management.
• Evidence of fairness and mitigation of bias, recognising that AI tools have been shown to demonstrate
bias.
• Cyber security and data protection compliance.

• Cyber security and data protection compliance.
• Systems for identifying, reporting and learning from AI-related incidents.

In practice, providers should expect inspectors to ask familiar questions:

• Who approved the use of the AI tool?
• What assessment was undertaken before implementation?
• How are risks monitored?
• What training have staff received?
• How are decisions checked and verified?
• What evidence demonstrates that the technology benefits people using the service?

Regulation is developing but enforcement remains uncertain

The publication of CQC’s AI statement is a welcome development. It acknowledges both the opportunities and
risks associated with AI and provides a helpful framework for providers seeking to innovate responsibly using
technology.
However, there remains a significant gap between regulatory expectations and regulatory capability.
While CQC has set out ambitious expectations around AI governance, it is far from clear whether the regulator
currently possesses the specialist expertise, resources or operational capacity necessary to assess complex AI
systems effectively across the adult social care sector.
There is a risk that providers are expected to implement sophisticated governance arrangements while
inspections continue to focus on traditional compliance indicators and inconsistent evidence-gathering.
In our view, there remains a considerable distance between the regulator’s aspirations for AI oversight and the
CQC’s practical ability to deliver robust, consistent assessments in this area.

Other regulators are also taking an interest

Providers should not assume that AI governance is solely a CQC issue.

The Information Commissioner’s Office (ICO) continues to emphasise accountability, transparency and fairness
in AI systems that process personal data. Organisations using AI must comply with UK GDPR requirements,
including lawful processing, data minimisation, security obligations and, where appropriate, completion of a
DPIA before deployment.

Practical steps providers should take now

Providers do not need to wait for further regulation to strengthen their position. Providers using, or intending
to use, AI should consider:
1. Developing a dedicated AI governance policy.
2. Maintaining an inventory of AI tools in use.
3. Completing risk assessments and data mapping/Data Protection Impact Assessments, where
appropriate.
4. Identifying clear organisationalaccountability for AI oversight.
5. Training staff on both opportunities and limitations of AI.
6. Establishing mechanisms for monitoring accuracy, bias and errors.
7. Ensuring human review remains central to decision-making.
8. Reviewing contracts with AI suppliers and software providers.

Looking ahead

AI is likely to become a routine part of adult social care delivery over the coming years. Providers that embrace
innovation while maintaining strong governance will be best placed to realise the benefits.
The key message from CQC is straightforward: AI is not exempt from regulation. Existing legal and regulatory
duties already apply.
The challenge for providers will be demonstrating that AI improves outcomes while preserving safety, dignity,
accountability and trust. The challenge for regulators, meanwhile, will be ensuring that inspection and
enforcement frameworks evolve quickly enough to keep pace with the technology they are seeking to oversee.

Keara Bowgen-Nicholas advises adult social care providers on regulatory compliance, governance, data
protection, safeguarding and the safe implementation of emerging technologies, including artificial intelligence.