Someone on your admin team pastes a patient’s symptoms into ChatGPT to help draft a referral letter. Nobody told them not to. The referral goes out. The patient’s details have now been processed outside your data protection framework, without a lawful basis, with no record of what happened. It happens every week in busy clinics where AI tools are available but the rules around them have not been written down.
An AI acceptable use policy is the document that prevents it. And for a clinic, it needs to cover specific ground that a generic business policy will miss.
What is an AI acceptable use policy for a clinic?
An AI acceptable use policy tells staff which AI tools they can use, for which tasks, and where the hard stops are. For a clinical team, three rules are non-negotiable: no identifiable patient data in any public AI system, no AI-only decisions about individual patients, and human review of any AI-generated content before it leaves the practice. NHS Fife’s published GenAI Acceptable Use Policy demonstrates all three in language a busy team can follow.
Beyond those three rules, the policy sets your approved tool list, distinguishes between free consumer accounts and business-grade licences, and specifies when a Data Protection Impact Assessment is required. The Institute of Occupational Health’s AI Usage Policy for occupational health providers is a useful practical example: it specifies approved use cases, prohibits reliance on AI for personalised legal or medical advice, and requires AI use to be documented in final work products.
The policy also has a protective function. Medical defence organisations in the UK are explicit that clinicians remain professionally accountable for decisions influenced by AI. A written policy is how a practice demonstrates it introduced AI with appropriate care, should that ever need to be shown to a regulator, insurer, or commissioner.
Why does this matter for your healthcare practice?
UK GDPR classifies health data as a special category requiring a higher standard of protection. The ICO’s guidance on AI and data protection requires organisations to apply data minimisation, specify a lawful basis, and carry out a DPIA for high-risk AI processing. For a clinic, using AI with identifiable patient data without documented controls carries real regulatory exposure.
The NCSC adds a cyber security dimension. Its guidance on generative AI advises organisations to treat public AI tools as external IT services and avoid passing sensitive data into them. In a clinical context, that means free consumer AI accounts are not appropriate for anything touching patient records, clinical images, or staff health information, regardless of how quickly or conveniently they produce output.
Liability is the third strand. Clinical AI tools have documented performance failures when deployed without adequate oversight. UK medical defence bodies warn that using AI outside approved indications, or relying on its outputs without review, increases professional liability exposure. A well-designed acceptable use policy demonstrates to a regulator, commissioner, or insurer that you exercised reasonable care in how AI was introduced.
Where will you actually encounter AI in your practice?
The situations where acceptable use rules become relevant are rarely dramatic. A receptionist tidies a clinic note with an AI writing tool. A clinician asks a chatbot for differential diagnosis suggestions. A manager pastes a patient complaint into an AI summariser. Each of these feels routine, and each could involve identifiable health data processed outside your compliance framework unless the policy draws the line first.
The Bedfordshire, Luton and Milton Keynes ICB policy shows how NHS bodies are handling this. Staff must not enter sensitive personal information into public AI tools; AI use must be logged; and any higher-risk AI project requires a DPIA. For an owner-operated clinic, those rules are straightforward to adopt and align with NCSC cyber security guidance, which means they support a consistent position should a regulator or insurer ask.
Where imaging AI or clinical decision-support tools are in use, the MHRA’s Software and AI as a Medical Device Change Programme is also relevant. Any AI tool classified as a medical device should carry appropriate UKCA or CE marking, and your acceptable use rules should align with the manufacturer’s intended use and instructions for use. The UK was the first country to join a new global network of health AI regulators in June 2024, and the MHRA’s direction is towards clearer standards for clinical AI, not looser ones.
When does your clinic need a written policy, and when can informal guidance cover it?
A written AI acceptable use policy becomes necessary once more than one member of staff uses AI tools regularly. The relevant threshold is the combination of clinical sensitivity, staff autonomy, and how easily AI tools can be accessed without oversight. A solo practitioner using AI only for marketing copy is a different risk profile from a five-person clinical team with access to patient management systems.
When writing the policy, the approved tool list is the most immediate decision. Owner-operated clinics typically start with two or three named tools. The key distinction is between consumer free tiers, which may retain prompt data for model training, and business-grade plans that include a data processing agreement. ChatGPT Team costs around $25 per user per month. Microsoft 365 Copilot costs around £24.70 per user per month and processes data within your existing Microsoft tenant, which can make it easier to satisfy GDPR requirements.
The IOH recommends a quarterly review cadence during the first year of a policy’s life, moving to at least annually thereafter. AI tools change quickly, and a policy written at the start of the year may not reflect staff habits or available tools six months later. A light quarterly review is easier to sustain than a comprehensive overhaul once the policy has drifted from practice.
What to read alongside this
The ICO’s guidance on AI and data protection, and its guidance on automated decision-making, are the two regulatory documents a UK clinic’s acceptable use policy must reference. Article 22 of UK GDPR restricts decisions based solely on automated processing with significant effects on individuals. The ICO is explicit that meaningful human involvement requires more than a token sign-off; the reviewer must have the authority and competence to change the decision.
The EU AI Act classifies many clinical decision-support systems as high-risk AI, with requirements for risk management, data governance, human oversight, and post-market monitoring. UK clinics using AI tools marketed into the EU will find that vendors increasingly build compliance documentation around these requirements. That documentation can anchor your own policy language, even before UK law imposes equivalent obligations.
A short policy that clinical staff will actually read is more useful than a comprehensive framework they avoid. The NHS Fife example and the IOH policy both demonstrate this: clear rules, plain language, a named review cadence. For a proportionate governance structure, an AI acceptable use policy sits alongside a brief AI risk register and, where required, a DPIA. Between those three documents, a clinic can demonstrate a reasonable, defensible approach to AI governance without a dedicated compliance function.
