Do You Need an AI Policy in Your Care Service? Yes. Here Is a One-Page Version.

Care is a fast-paced service. It is a Friday evening. An email lands from a hospital discharge team or a brokerage desk that is desperate to place three people before the weekend. The coordinator who opens it is already busy. She has assessments to carry out, care plans to write up, and a roster that was stretched before the email arrived.

For her, anything that saves time is a godsend. A tool that turns an hour of typing into five minutes is not a gimmick. It is the difference between getting home and not.

A coordinator told me recently that her service does not use AI. Her company has not bought one, so as far as she was concerned, they do not have one. Then she mentioned, almost in passing, that she uses a free AI app on her own mobile. She pastes her assessment notes in and asks it to make them sound professional before they go into the care plan. I did not think she was careless. I thought: of course she does. Nobody gave her a safe way to do it, so she found her own.

That is the point. Care coordinators and managers will reach for whatever helps them cope with the Friday-evening email. Care providers therefore have a duty to protect them: to give them tools that are safe to use, rules that are clear, and a named person to ask. The Department of Health and Social Care said as much in its September 2026 guidance: have an AI policy even if your policy is that staff may not use AI at all.

I have read a few of the policies now circulating. Most are eight pages of generic language that no coordinator will ever read on a Friday evening. So here is a different approach: one page, plain English, written for both home care and care homes, that you can adopt this week and improve later.

Why one page

A policy only works if the people it covers know what it says. In care, that means a night carer on her first week, a coordinator with the phone ringing, and a registered manager who has thirty other policies to keep current. Eight pages will be signed and forgotten. One page can be read in a handover, pinned in the office, and repeated from memory.

The policy also has to answer the questions people have in the moment: can I use this? With what information? Who checks it? What do I do if I am not sure? Everything else is detail that belongs in your procedures, your DPIA and your supplier contracts, not in the policy itself.

Where the duty sits

Before the template, a plain-English note on what the law and the regulator require, because a policy should rest on something.

• Data protection. UK GDPR and the Data Protection Act 2018 place the duty on the data controller, which is your organisation, not the carer and not the software supplier. Article 35 of UK GDPR requires a Data Protection Impact Assessment (DPIA) before processing that is likely to be high risk to people’s rights. Processing health and care records with an AI tool will usually meet that bar. The Information Commissioner’s Office (ICO) publishes guidance on AI and data protection and a DPIA template.
• Regulation in England. The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 place duties on the registered provider. Regulation 17 (good governance) requires systems to assess, monitor and mitigate risk and to keep accurate, complete records. Regulation 12 (safe care and treatment) requires risks to be assessed and mitigated. Regulation 11 (need for consent) and Regulation 9 (person-centred care) matter where AI touches how care is planned or recorded. CQC’s May 2026 AI statement makes clear these existing regulations are how AI will be judged.
• Elsewhere in the UK. Providers in Scotland (Care Inspectorate), Wales (Care Inspectorate Wales) and Northern Ireland (RQIA) are regulated under their own frameworks, but UK GDPR and the Data Protection Act 2018 apply across the UK, and the governance principle is the same.

None of that requires a long policy. It requires a clear one, and a DPIA and a training record sitting behind it.

The one-page AI policy

Copy this, replace the square brackets, and remove anything that does not apply. It is written to be read aloud in a team meeting.

[Organisation name] – Use of Artificial Intelligence (AI) Policy

Version: 1.0 Approved by: [Registered Manager / Nominated Individual] Date: [date] Review: every 12 months, or sooner if a new tool is introduced.

1. What this policy covers. Any tool that generates, summarises, transcribes or analyses information using artificial intelligence. That includes chatbots (such as ChatGPT, Copilot or Gemini), note-summarising and transcription tools, AI features inside our care management system, and AI assistants built into phones, email or web browsers. It covers all staff, volunteers and contractors, on work devices and personal devices, whenever the information concerns our organisation, the people we support, their families or our colleagues.

2. What you may use. Only the AI tools listed in our Approved AI Tools register (kept by [name/role]). At the date of this policy these are: [list, for example “AI Assist, Knowledge AI and Capture AI within Careberry”]. If a tool is not on the register, you may not use it for work. If you think a tool would help, ask [name/role] and we will assess it.

3. What you must never do. Never enter the name, address, date of birth, NHS number, health or care details, photographs or any other personal information about a person we support, a family member or a colleague into a free, public or unapproved AI tool. This applies even if you remove the surname. If you have done this in the past, tell [name/role] today; you will not be in trouble for being honest.

4. A human stays in charge. AI drafts and suggests. People decide. Nothing produced by an AI tool goes into a care plan, assessment, daily record, medication record, incident report or message to a family until a named member of staff has read it, checked it against what they know of the person, corrected it where needed, and approved it. The person who approves is responsible for the content, exactly as if they had written it themselves.

5. Who checks what. [Role] approves AI-assisted care plans and assessments. [Role] reviews AI-generated daily note summaries at handover. [Role] reviews AI-generated audits, reports and policies. Where an AI tool records a conversation (for example an assessment or supervision), consent is asked for and recorded before recording starts, and anyone may decline, in which case we take written notes instead.

6. Telling people. We tell the people we support and their families, in plain language, that we use approved AI tools to help with paperwork, that a member of staff checks everything, and that they can ask us not to use AI in their records. This is written into our service user guide and discussed at care plan reviews.

7. Data protection. We complete and keep a Data Protection Impact Assessment (DPIA) for each approved tool before it is used. We know where each tool processes and stores data, and we have confirmed in writing with the supplier that our data is not used to train AI models for anyone else. The data protection lead is [name].

8. Training. No one uses an approved AI tool until they have completed our short AI induction, which covers this policy, how the tool works, and how to spot when its output is wrong. Training is recorded. [Name/role] is our digital champion and first point of contact for questions.

9. When something goes wrong. If an AI tool produces something inaccurate, unsafe, unfair or embarrassing, or if personal information has gone into an unapproved tool, report it the same day through our usual incident process. We will treat it as a learning event, assess whether it is a personal data breach that must be reported to the ICO within 72 hours (UK GDPR Article 33, where the breach is likely to put people at risk), and update this policy or the approved tools register if needed.

10. Keeping this policy honest. We review this policy every 12 months and whenever we add or remove a tool. Staff feedback on what is working and what is not is welcome at any time.

Signed: ______________________ Role: ______________________ Date: __________

How to put it into practice in one week

1. Monday: Ask every member of office and senior care staff what AI tools they have used for work in the last three months. Write the answers down without judgement. This is your starting register.
2. Tuesday: Decide what goes on the Approved AI Tools list. If the only safe answer today is “the AI features inside our care management system” or “nothing yet”, say so. An empty list is a valid policy.
3. Wednesday: Fill in the names and roles in the template. Read it aloud to one carer and one coordinator. If either of them asks “what does that mean?”, rewrite the sentence.
4. Thursday: Start the DPIA for each approved tool. Ask your supplier the three questions: where is the data processed, is it used to train models, and can you give me that in writing?
5. Friday: Brief the whole team, add the policy to your induction pack, and add a line about AI to your service user guide. Record who was briefed and when.

Home care and care homes: where the emphasis differs

In home care, the biggest risk is the personal phone. Carers work alone, between visits, and a free chatbot is one tap away. Section 3 of the policy does the heavy lifting, and the honest-reporting line matters: you want to hear about the notes that have already been pasted in, not find out at an inspection.

In a care home, the risk is more often a tool that has been bought rather than a tool that has been snuck in. Sensors, acoustic monitoring and summarising tools arrive through procurement. Sections 5 and 7 matter most: who acts on the alert, who reviews the summary at handover, and whether the DPIA was done before the first night it ran, not after.

Either way, the policy is the same page. Only the names in the brackets change.

How Careberry fits

We built Careberry AI so that a provider could write section 2 of this policy with a single line. AI Assist, Knowledge AI and Capture AI live inside the platform your team already uses, behind the same login and role permissions. Every AI action is logged with who requested it, what was suggested and who approved it, which is section 4 and section 5 made automatic. Capture AI asks for and records consent before any recording, and carries on with written notes if someone declines. Your data is hosted in the UK, is never used to train AI models, and we will put that in writing for your DPIA.

And if your answer to section 2 is “nothing yet”, that is fine too. AI in Careberry is off until you switch a module on, and you can switch it off again whenever you want.

People first. Process next. Technology always.

A closing thought

The coordinator with the free app on her phone was trying to do right by the people she supports, on a day that probably looked a lot like that Friday evening. That instinct is the most valuable thing in your service. A good AI policy does not shut it down. It protects the person who has it, gives the instinct a safe place to go, and a name to ask when she is not sure.

Write the page. Read it aloud. Then get back to the people.

If you would like to see how Careberry AI handles consent, human approval and audit trails in practice, or want our DPIA answers in writing, book a viewing of Careberry.