The Department of Health and Social Care (DHSC) has published guidance for adult social care providers on the use of artificial intelligence, telling them to comply with UK GDPR, keep personal data out of free online AI tools and ensure a human reviews all AI-generated outputs.
The guidance, Using AI in adult social care, published on 29 September describes how AI is already used in care delivery and administration, and sets out best practice for providers considering adopting it. DHSC notes that many providers are still at an early stage of exploring AI and have yet to introduce it in their organisations.
The guidance recommends that providers work through a four-step checklist before choosing an AI tool:
- Create a specification listing what the organisation hopes to achieve with the technology.
- Seek feedback from the people the organisation supports and from staff.
- Set out the potential benefits and risks of the technology in a comparison table.
- Identify measurable outcomes to assess success.
Providers are then advised to compare the benefits and risks against the full cost of the tool, including hardware, software, staff training and system changes, and to track this in a financial plan.
On data protection, the guidance says providers must be careful to comply with UK GDPR when using AI tools. It tells them to consider where data is being processed, including whether it is processed in the European Economic Area, and how they will inform people about the use of their data.
It advises that providers should not enter personally identifiable information into free or online tools, because without a contract with the supplier there is no way to guarantee the security of that information or control how it is used. It points providers to Digital Care Hub's Better Security Better Care programme for support with their data protection obligations.
DHSC recommends that providers always include a human review of AI-generated outputs to ensure accuracy and fairness, and set up review guidelines or quality controls.
It says every organisation should consider having an AI policy, even if that policy prohibits staff from using AI for work. The policy should define who is responsible for the decisions and tasks carried out by AI, how its use is overseen, who holds accountability and whether a framework or decision tool is used to assess whether AI is appropriate.
The guidance describes a range of current uses. Generative AI is being used to draft care plans and care assessments, although DHSC says evidence that it can produce truly personalised care plans is currently limited and that a member of care staff must review any AI-assisted plan for accuracy.
AI-backed sensors are used to monitor movement, sound and vital signs, and acoustic monitoring systems are used at night to detect falls and reduce intrusive checks. Facial analysis software is used to identify facial muscle movements indicating pain in people who may be unable to report it, with the system producing an overall pain score for the caregiver to act on. Chatbots are being introduced as a first point of contact in services such as mental health and community reablement.
On administrative use, the guidance names Microsoft Copilot and Claude as examples of tools that can produce meeting notes and action lists, and covers AI in recruitment, onboarding and multi-site auditing. It advises providers using open AI tools to draft business plans not to input confidential information and to remove their organisation's name.
Health data processed by care providers is special category data under Article 9 of UK GDPR. Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to individuals, and Article 28 requires a written contract with any processor. Articles 22A to 22D, which replaced Article 22 of UK GDPR under section 80 of the Data (Use and Access) Act 2025, came into force on 5 February 2026.
Article 22B keeps a prohibition on significant automated decisions based on special category data, subject to exceptions. The DHSC guidance does not refer to DPIAs, special category data, processor contracts, the automated decision-making provisions or the Information Commissioner's Office's guidance on AI and data protection.
The guidance also directs providers to the ethical principles developed by the Oxford Project on the responsible use of generative AI in social care: truth, transparency, equity, trust, accessibility, humanity and responsiveness. It warns that AI can reflect biases in its training data, which can reinforce stereotypes and lead to discrimination.
