- An AI scribe that only transcribes, summarises, drafts letters or suggests codes for a clinician to check is not a medical device under MHRA guidance published on 29 July 2026. One that supports diagnosis, or acts without clinician review, is.
- Patients are warmer to admin AI than clinical AI: in Health Foundation polling, 54% of the public support using AI in patient care, rising to 61% for administrative purposes.
- An aesthetics clinic's enquiry bot counts as advertising, so under CAP Code rule 12.12 it can't promote Botox or any other prescription-only medicine to the public.
AI for clinics pays first in the admin around care: answering enquiries, booking and moving appointments, reminders, intake forms and clinic letters. The regulated line sits where software starts to shape a clinical decision. Under MHRA guidance published on 29 July 2026, AI that transcribes, summarises or drafts for a clinician to check is not a medical device, while AI that supports diagnosis or treatment, or acts without clinician review, is. Every job on both sides of that line handles health data, which UK GDPR treats as special category data.
This guide covers independent UK clinics: private GP, physiotherapy, consultant outpatients and aesthetics. The cost of a missed call or an empty slot works as it does in a dental practice, and our guide for dentists runs those numbers. What differs here is the rulebook.
Why a private clinic is a different case
Private demand is at a high. PHIN, the body that publishes private healthcare data under a Competition and Markets Authority order, counted a record 953,000 reported admissions at the UK's private hospitals in 2025: 670,000 funded by insurance and 283,000 paid for by the patients themselves. Those are hospital admissions, not clinic appointments. Read them as the direction of demand, not a count of anyone's patients.
At a clinic, that demand arrives as enquiries, and each one is a buying decision: a date, a named clinician, perhaps an insurer's authorisation. Both halves of that front desk suit automation. The catch comes when an AI tool reads symptoms, writes into notes or talks about treatments. Then each type of clinic meets a different rule.
The line the MHRA drew for AI scribes
AI scribes (ambient voice technology, in the regulator's words) are the clinical tool most clinics are being sold. The MHRA settled their status in two sentences. Products "intended solely for transcription, summarising of clinical conversations, drafting letters, or suggesting clinical codes for a clinician to review are not regulated as medical devices". Products "intended to support diagnosis, treatment or prevention, or that take automated action such as placing orders without clinician review, are regulated as medical devices".
So a scribe that drafts the note and referral letter for the clinician to check sits outside device regulation. Switch on auto-send and the same product moves inside.
The guidance also says clinicians "remain responsible for reviewing and verifying AI generated transcripts, summaries and other outputs before they are used in patient care." That review step is what keeps a scribe in the lighter category, so build the approval gate in as a required step, never an optional one.
Intended purpose is the test, and it reaches past scribes. An intake form that collects history is admin. One that tells a patient what their symptoms probably mean, or decides how soon they're seen, is doing a clinical job and is likely to be treated as a medical device. Take regulatory advice before building that.
A rules map for the jobs clinics automate
Each job a clinic commonly hands to AI, against the rule that bites first. A starting map, not legal advice.
| Job | What the AI does | Rule that applies | What to have in place |
|---|---|---|---|
| Enquiry and booking calls | Answers, checks the diary, books or moves appointments | UK GDPR: anything a caller says about their health is special category data | Tell callers it is AI, limit recording retention, pass anything clinical to a person |
| Reminders and recall | Sends confirmations, reminders and recall messages | UK GDPR | No condition or treatment named in a message preview |
| Intake forms | Collects history before the visit | Admin while it only collects; likely a medical device once it interprets or prioritises | Interpretation stays with a clinician unless the product is UKCA or CE marked |
| AI scribe and clinic letters | Transcribes consultations, drafts notes and letters | Not a medical device while a clinician reviews every output (MHRA, July 2026) | Clinician sign-off, a hazard log and a data protection impact assessment |
| Treatment questions at an aesthetics clinic | Answers questions about anti-wrinkle and filler treatments | CAP Code rule 12.12: no promoting prescription-only medicines to the public | Script it to offer a consultation and never name or sell the medicine |
| Automatic orders and referrals | Places tests or referrals without review | Medical device under the MHRA guidance | A marked device with its documentation, or a clinician back in the loop |
Our UK AI receptionist guide covers caller notice, recording and retention. On aesthetics, the ASA's Botox guidance says the ban covers online content and social media, even hashtags. A chatbot on the clinic's website is the clinic's marketing.
Then the data protection impact assessment (DPIA). The ICO counts AI as innovative technology, a trigger alongside other risk factors, and requires one outright for large-scale processing of special category data. It excludes an individual health professional treating their own patients. A multi-site clinic group sits closer to its hospital example.
What an inspector will ask about AI
In England, a clinic carrying out regulated activities registers with the Care Quality Commission. Its clearest statement on AI, GP mythbuster 109 (updated 14 July 2025), is written for GP services, but it's the most specific list of what an inspector looks for:
- DCB0160 clinical risk management, led by a senior registered clinician as clinical safety officer
- a hazard log for each AI tool, a DPIA, and the Digital Technology Assessment Criteria (DTAC) used when buying
- device documentation where the product is a medical device
- human oversight of outputs and a way to report incidents
- trained staff, patients told when AI is involved, and a non-digital route to care
A booking agent still needs the data protection work. A scribe needs the whole list, in place before the first consultation is recorded.
Patients accept the admin side first
The Health Foundation polled 7,201 members of the public and 1,292 NHS staff in mid-2024 and found 54% of the public support using AI in patient care, rising to 61% for administrative purposes. It asked about the NHS, not private care, and it's two years old. The gap still points the same way as the rules: admin first.
Where a clinic should start
- Pick one admin job you can count this week: unanswered enquiries, unconfirmed bookings or letters clinicians type up after clinic.
- Run the AI in shadow mode, drafting while staff keep doing the job, and compare.
- Put an approval step on anything that writes into a patient record or goes out under a clinician's name.
- Bring in a scribe only once the clinical safety officer, hazard log and DPIA are in place.
An AI audit helps when it's unclear which job costs most time, and the readiness checklist covers data and permissions. The AI receptionist guide shows how a call hands over to a person, and how to implement AI in a business sets out the order of work. ONS figures put AI use at around 35% of UK businesses with 10 or more employees, up from around 12% in late 2023. That's no reason to rush a clinical tool.
Common questions
Is an AI scribe a medical device in the UK?
Not if it only transcribes, summarises, drafts letters or suggests clinical codes for a clinician to review, according to MHRA guidance published on 29 July 2026. It becomes a medical device when it supports diagnosis, treatment or prevention, or takes automated action such as placing an order without clinician review.
Does a private clinic need a DPIA before using AI?
Very often, yes. The ICO treats AI as innovative technology, one of its triggers for an assessment, and requires one for large-scale processing of health data. A single practitioner with their own patients may fall outside that, but a multi-site clinic group with a shared patient database should assume it needs one.
Can an aesthetics clinic use a chatbot to answer treatment questions?
Yes, within the advertising rules. Botox and similar products are prescription-only medicines, and CAP Code rule 12.12 bars advertising them to the public, online and on social media included. Script the bot to explain the consultation process and book appointments, never to name or promote the medicine itself.
Will the CQC ask about AI at inspection?
Expect it to, once AI touches care. The CQC's GP mythbuster 109 lists what it looks for: DCB0160 clinical risk management, a named clinical safety officer, a hazard log, a DPIA, human oversight of outputs, trained staff, and patients told when AI is used. It is written for GP services but is the clearest guide available.
What should a private clinic automate first?
The enquiry and booking side. It sits outside medical device rules, patients accept it more readily than clinical AI, and the result is easy to count. Leave scribes and anything that interprets symptoms until the clinic has a clinical safety officer, a hazard log and a completed data protection impact assessment.
Before any build, count three things from last month: enquiries that came in, how many became bookings, and how many letters clinicians typed themselves. Bring those to an informal scoping chat (pick Business automation on the form), tell us which booking and notes systems the clinic runs, and we'll send a price range for the build afterwards.
Sources
Every figure in this article links back to the source below it was checked against.
Written for Orwell Lab’s practical guide collection. Regulatory guidance and statistics checked on 2 October 2026.
Discuss your own requirements ↗