Accountable use
- Nurses
- Educators
- Programme leads
- Practice development leads
- NMC platform 1
- NMC platform 6
- NMC platform 7
Governance, safety and the EU AI Act
Before an AI tool is used in care or education, legal and clinical safety checks should already have happened. Knowing how UK and European rules fit together helps you ask the right questions — and spot when a tool has skipped them.
DCB0129 (supplier safety case) + DCB0160 (local deployment hazard log signed off by your trust’s Clinical Safety Officer).
MHRA SaMD registration for diagnostic/triage AI + UK GDPR DPIA and DUAA 2025 automated decision safeguards.
Article 4 AI Literacy, Article 14 Human Oversight, High-Risk healthcare/education rules, and Northern Ireland Windsor Framework scope.
1. NHS and UK safety checks behind an approved tool
Trace How an AI Tool Is Approved, Overseen & Monitored
Toggle between an Administrative AI Scribe and a High-Risk Clinical / SaMD Tool, then click each stage of the safety chain.
Stage 1: Supplier & Device Law (Manufacturer / Supplier CSO)
Administrative AVT · Not SaMD if Clinician-ReviewedPurely administrative ambient voice scribes reviewed by a clinician before use are generally not regulated as a medical device (MHRA, July 2026), but still require supplier clinical safety assurance.
| Check | What it is | Who is responsible |
|---|---|---|
| Clinical safety: DCB0129 | NHS clinical risk management standard for manufacturers of health IT systems, requiring a clinical safety case report and hazard log | The supplier's Clinical Safety Officer (CSO) |
| Clinical safety: DCB0160 | NHS clinical risk management standard for organisations deploying health IT locally in their own workflows | The deploying organisation's Clinical Safety Officer (CSO) |
| Data Protection Impact Assessment (DPIA) | Assessment under the UK GDPR and Data Protection Act 2018 of risks to people's personal data before high-risk processing begins | Information Governance (IG) team and Data Protection Officer (DPO) |
| Automated Decision-Making safeguards (DUAA 2025) | Under the UK Data (Use and Access) Act 2025 (changes in force from February 2026), significant automated decisions require transparency, the right to human intervention, and the right to contest the decision | Organisation and system owner |
| Data Security and Protection Toolkit (DSPT) | Annual assurance check of an organisation's and supplier's cyber and information security | Deploying organisation and supplier |
| MHRA medical device registration (SaMD) | Software or AI that supports diagnosis, triage, clinical scoring or treatment decisions is usually a medical device and must carry UKCA / CE marking and MHRA registration. Purely administrative transcription reviewed by a clinician generally is not (MHRA, July 2026). | Manufacturer, regulated by the MHRA |
| Procurement and contract | Commercial terms governing data residency, whether prompts train vendor models, retention periods and liability | Procurement, legal and digital teams |
In September 2026, the MHRA-convened National Commission into the Regulation of AI in Healthcare recommended lifecycle monitoring of AI tools after deployment, clearer boundaries between manufacturer and clinician liability, and coordinated AI education across health curricula.
2. The EU AI Act and what it means for UK nurses
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world's first horizontal law regulating AI by risk level. Even though Great Britain regulates healthcare AI sectorally through the MHRA rather than adopting the full EU AI Act, the Act directly affects nursing in three ways:
- Cross-border care and Northern Ireland (Windsor Framework): Nurses working across the Northern Ireland / Republic of Ireland border, or in EU-partnered research and education programmes, meet the Act directly. In Northern Ireland itself, under the Windsor Framework, EU AI Act provisions apply where AI is embedded as a safety component in physical products (such as physical medical devices governed by the EU Medical Devices Regulation, MDR 2017/745, or In Vitro Diagnostic Regulation, IVDR 2017/746) placed on the Northern Ireland market.
- Global supplier standards ("Brussels effect"): Most international health-tech suppliers selling EPR modules, triage tools or ambient scribes into the NHS design their products to meet both MHRA requirements and EU AI Act high-risk rules.
- A benchmark for organisational good practice: Its core duties — staff AI literacy, human oversight, transparency and post-market monitoring — mirror what the NMC Code and NHS clinical safety standards expect.
Key EU AI Act rules in health and education
| Provision | What the EU AI Act requires | Nursing equivalent in UK practice |
|---|---|---|
| Article 4: AI Literacy Mandate (in force since February 2025) | Providers and deployers of AI systems (including hospitals, clinics and universities) must take measures to ensure staff and users have sufficient AI literacy tailored to their role, technical knowledge and the context in which the AI is used. | Aligns with NMC Pre-Registration Standards (R1.1.7), the Council of Deans of Health (2026) Principles, and structured role-based learning such as this toolkit. |
| Prohibited AI practices (Article 5) (in force since February 2025) | Bans manipulative or deceptive AI that exploits vulnerabilities (such as age or disability), social scoring, and untargeted emotion recognition in workplaces and educational institutions (except for specific medical/safety reasons). | Upholds NMC Code Standard 1 (dignity and humanity) and protects students and staff from unconsented algorithmic surveillance. |
| High-Risk Healthcare & Education AI (Annex I & Annex III) | Classifies AI safety components in medical devices (MDR/IVDR), emergency healthcare triage systems, and AI used to determine access to education or evaluate learning outcomes without human review as high-risk. Requires risk management, representative datasets, technical documentation and logging. | Mirrors DCB0129 / DCB0160 clinical risk management, MHRA SaMD assurance, and UK university quality assurance (QAA / NMC). |
| Article 14: Human Oversight | High-risk AI systems must be designed so natural persons overseeing them can understand their capacities and limitations, watch for automation bias (over-relying on output), interpret outputs properly, and override or stop ("kill switch") the system safely. | Matches the GOV.UK AI engineering guardrails (G-ET-03: AI may assist, humans must decide) and NMC Code Standards 13 & 19. |
| Article 50: Transparency duties | People must be informed when they are interacting directly with an AI system (such as a patient-facing symptom chatbot) or viewing AI-generated/manipulated audio, image or video content. | Matches NHS England ambient scribing guidance on informing patients and respecting a refusal. |
3. European Health Data Space (EHDS) and nursing data
Alongside the EU AI Act, the European Health Data Space (Regulation (EU) 2025/327) sets rules for primary use (patients accessing and sharing their electronic health records) and secondary use (securely pooling de-identified health data to train and audit AI models). As the European Federation of Nurses Associations (EFN) highlights, nurses generate a large share of bedside clinical data — meaning that accurate, person-centred and unbiased nursing records are the foundation of safe future health AI in both the UK and Europe.
4. The nurse's part in governance
- Ask for the safety sign-off: “Has this tool completed a local DCB0160 assessment, DPIA and Equality Impact Assessment for our setting?”
- Check the scope of approval: A tool approved for outpatient letters is not automatically approved for mental health crisis notes or safeguarding meetings.
- Involve frontline nurses early: Offer bedside knowledge during procurement and hazard workshops so workarounds and safety gaps are caught before go-live.
- Stay the decision-maker: Watch for automation bias — especially when tired or busy — and trust the person in front of you over a screen score.
- Report software errors and near misses: Log AI hallucinations, transcription omissions or biased outputs in your local incident system (Datix / LFPSE) and, for medical devices, the MHRA Yellow Card scheme.
- Protect student learning: When supervising students on placement, ensure they follow the placement provider’s clinical governance rules.