The NHS standards that apply
- Data Security and Protection Toolkit (DSPT). Organisations with access to NHS patient data and systems complete it every year. Suppliers are usually asked for their status.
- Digital Technology Assessment Criteria (DTAC). The baseline NHS England uses to assess digital health technologies.
- Clinical safety (DCB0129 and DCB0160). DCB0129 applies to manufacturers of health IT systems; DCB0160 applies to the organisations that deploy them. Both require a clinical safety officer and a hazard log.
- UK GDPR. Health data is special category data. A data protection impact assessment is expected before AI processes it. See the ICO guidance on AI and data protection.
Where to start
Start with administrative work that does not make clinical decisions: drafting routine letters for review, summarising non-clinical correspondence, or answering staff questions from approved policy documents. Keep a named person reviewing every output that reaches a patient.
Where AI should run
Patient-identifiable data should only go to services that your information governance team has approved, with processing in the UK unless a lawful transfer is in place. Public AI tools with no contract are not suitable for patient data. See on-premise versus cloud AI.
What to ask any supplier
- Cyber Essentials and Cyber Essentials Plus. A National Cyber Security Centre scheme covering basic security controls. Often a condition of public sector contracts that handle personal data.
- ISO/IEC 27001. The international standard for information security management. ISO/IEC 42001 is the newer standard for AI management systems.
- Data Security and Protection Toolkit (DSPT). An annual self-assessment that organisations with access to NHS patient data and systems must complete.
- Digital Technology Assessment Criteria (DTAC). NHS England's baseline for digital health technologies: clinical safety, data protection, technical security, interoperability, usability and accessibility.
- Ask for evidence. Ask every supplier, including us, for certificates in writing, and check them against the issuing body. A certificate covers a named scope and date; check both.
How to start, and what it costs
- Free AI Readiness Audit. 15 questions, about 5 minutes, including AI governance. Take the audit.
- AI and Copilot Discovery Day. One day with a consultant, £950 + VAT, fixed. For a public body this is where we classify your data, map where each AI tool processes it and agree the rules. See what is included.
- Implementation. Value based, scoped and quoted after the Discovery Day.
When we are not the right fit
We do not build or certify clinical decision support or medical devices. If your use case diagnoses, triages or recommends treatment, you need a specialist medical device manufacturer and clinical safety expertise. We help with administrative and operational AI, governance and readiness. Back to sovereign AI for UK organisations.
Questions we are often asked
Can NHS staff use ChatGPT or similar tools?
Only within their organisation's policy. Patient-identifiable data should never go into a public AI tool without an approved contract and information governance sign-off.
What is the DSPT?
The Data Security and Protection Toolkit, an annual self-assessment for organisations with access to NHS patient data and systems.
What is DTAC?
The Digital Technology Assessment Criteria, NHS England's baseline for digital health technologies across clinical safety, data protection, technical security, interoperability, usability and accessibility.
Do you work on clinical AI?
No. We work on administrative and operational uses, governance and readiness. Clinical decision support needs a specialist medical device route.