The government's guidance on AI in adult social care: what it says and what it leaves out
DHSC has published its first guidance for care providers on using AI. It gets the basics right, but says nothing about DPIAs, CQC or consent. What it asks of you, and what you still need to do yourself.
On 29 September 2026 the Department of Health and Social Care published Using AI in adult social care on GOV.UK. It is the first guidance from government written for care providers about AI. It is one web page, and you can read it in fifteen minutes.
It is non-statutory. It creates no new legal duties and it does not mention CQC. It sets out what DHSC considers good practice. DHSC is responsible for adult social care in England, so read it as English guidance, although the data protection points apply across the UK.
What it asks of you
The “Best practice guidance” section at the end is the part to read closely. It asks providers to:
- Have a person review everything AI produces. For care plans, DHSC says a member of care staff must check the plan is accurate. It also says the evidence that generative AI can write a truly personalised care plan is “currently limited”.
- Keep personal details out of tools you have no contract with. Without a contract, DHSC says, you cannot guarantee what happens to the information.
- Write an AI policy, even if your policy is that staff cannot use AI for work. It should say who is responsible for what the AI does, how you oversee it, and how each role is expected to use it.
- Decide what you want before you choose a tool. DHSC gives a four-step checklist: write down what you hope to achieve, ask staff and the people you support, compare benefits against risks, and set outcomes you can measure.
- Count the full cost, including staff training and changes to your systems, not only the licence.
- Train staff and name digital champions, people in the team others can go to with questions.
- Watch for bias, drawing on the equity principle from the Oxford Project on the responsible use of generative AI in social care.
If you follow the golden rules and have a one-page AI use policy, you already do most of this.
The first half of the page describes AI already in use in care: acoustic and movement sensors, facial analysis that scores pain, analysis of incident records, chatbots on helplines, and admin tools for meeting notes, recruitment and audits. It names Microsoft Copilot and Claude as meeting-note tools. Treat that half as a description of what exists. DHSC does not assess or recommend any product.
Where the wording needs care
Three points are looser than they should be.
The real test is the contract, not the price. DHSC tells you not to put personally identifiable information into “a free or online tool”. Almost every AI tool runs online, and paying does not fix the problem by itself. DHSC’s own reason points to the real test: whether you have a contract with the supplier that covers the data. A paid personal plan can leave you exactly where a free one does. Our comparison of free and paid plans goes through the four big assistants plan by plan.
Where data goes. DHSC suggests you check whether your data is processed in the European Economic Area. That helps, but it is only part of the question. Under UK GDPR you need to know whether the data leaves the UK and, if it does, what legal safeguard covers it. UK adequacy regulations already cover the EEA. Many AI tools process data in the United States. That can be lawful, but the supplier should name the mechanism that makes it so, and your DPIA should record it.
What AI can do. The guidance says AI-backed sensors have “the capability to think independently”, much like a human. They do not. They find patterns in sensor data and raise an alert, and a member of staff decides what happens next. The page also links to a care home that cut falls by 84% with an AI sensor lamp. That figure comes from one 31-bed home’s six-month pilot. The case study gives no baseline figures and mentions no independent evaluation. The result may hold for that home, but it tells you little about yours.
What it leaves out
The guidance does not mention:
- A Data Protection Impact Assessment. For AI that touches care records, you almost certainly need one, and CQC names a DPIA among its principles for AI. See do you need a DPIA.
- CQC. CQC published its own position on 21 May 2026. It approves no tools and judges AI against the regulations you already meet. See what CQC says about AI.
- When to tell people. DHSC says you must tell people how you use their data. The ICO adds that you tell them before the new use starts, not after. See telling the people you support.
- Consent and mental capacity. For many services these are the hardest questions, and the guidance does not touch them. See capacity, consent and AI.
- Safeguarding. It says nothing about what must stay out of AI tools, or about a helpline chatbot talking to someone in crisis. See safeguarding and AI.
It does not mention the Data Security and Protection Toolkit either. Use the DHSC page as a starting point and fill these gaps from the guides linked above.
What comes next
DHSC is funding more work. The Social Care Institute for Excellence (SCIE) and Partners in Care and Health run a programme on safe, ethical and practical use of AI in adult social care, and pass emerging issues back to DHSC. Their first report came out in August 2026. It draws on conversations with four technology suppliers and two sector partners, plus a session on 5 August attended by 54 people, mostly from local authorities. SCIE calls it an emerging intelligence briefing and says it is not formal research.
Its list of ten open issues starts with:
- Consent, lawful basis and transparency, where councils are taking different approaches.
- How the Mental Capacity Act and the Deprivation of Liberty Safeguards apply.
- The line between AI that transcribes what someone said and AI that interprets it.
Contributors also asked what “human in the loop” means for busy staff in practice. They worried about students and newly qualified staff leaning on AI before they have learned to write a good record themselves.
Two findings apply to a small provider as much as to a council. Start with the problem and the outcome you want, and not with a product another organisation bought. And a short test with an agreed measure beats a long pilot with no clear end. Our guide to measuring a task before you change it shows how to set that measure.
Contributors asked for national guidance sooner, even if provisional. Until it covers consent and capacity, the report says organisations will need to make those decisions locally.
What to do now
- Read the DHSC page.
- Check your AI policy against its questions: who is responsible, how you oversee AI, and how each role uses it. If you have no policy, start from our template or answer the questions in the free AI policy builder.
- Find out which AI tools staff use and on which accounts. Where you have no contract covering the data, keep personal details out.
- For anything that touches care records, complete a DPIA before you start, and tell people before you start too.
We are not lawyers, and this is not legal advice. It is a plain reading of the published guidance, with the sources linked so you can check it against the originals.