NHS's ambient scribe guidance doesn't bind your practice. That's exactly why it matters.

NHS England's ambient scribing guidance runs across three linked documents, one for patients, one for health and care professionals, one for information governance teams, and none of them were written with an independent psychology practice in mind. Read the guidance's own scope line and it covers "the information governance considerations for health and care organisations who are adopting an ambient scribe for individual care purposes," language broad enough to sound like it might reach you (NHS England Digital, "Using AI-enabled ambient scribing products in health and care settings," last edited 7 May and 4 June 2026). It doesn't, not as a matter of law. The document sits inside NHS England's Medium-Term Planning Framework, "Delivering Change Together 2026-27 to 2028-29," published July 2026, which directs NHS organisations specifically to deploy ambient voice technology "at pace." MHRA said the same thing from the other direction in its own ambient voice technology guidance of 29 July 2026: deployment rules for AI scribes that fall outside medical device regulation are "outside the scope" of what MHRA covers, and the document it sends readers to instead, the same NHS England guidance discussed here, is written for NHS settings. We covered the device-classification half of that gap last week: MHRA's rules on when an AI scribe becomes a regulated medical device. This picks up exactly where that one stopped: what happens once you've established your scribe isn't a device, and you still have to run it responsibly.

That should read as good news. One fewer document telling an independent practice what to do. It isn't, because there is nothing else to replace it. Neither HCPC nor the British Psychological Society has published anything close to this level of operational detail on ambient scribing specifically, and NHS England's own service pages cite a Great Ormond Street Hospital-led trial finding a 23.5% increase in direct patient interaction time and an 8.2% reduction in overall appointment length where AI scribes were used, with a 13.4% rise in patients seen per shift in A&E (NHS England, "Adopting ambient scribing products in health and care settings," 2026, an NHS-cited figure supporting NHS's own adoption push, not an independently audited one). Numbers like that are exactly why every practice considering a scribe this year, NHS-commissioned or not, has already seen the sales pitch. NHS England's guidance is, in practice, the closest thing the UK has to a model answer for how to run one properly. It just was not written with you in the room, and nobody has written the private-practice version.

What NHS organisations are actually required to do

Strip the three linked documents down to what a health or care professional and their IG team are told to have in place, and nine deployment duties survive the exercise.

Transparency comes first. Clinicians must tell patients at the start of every session that an ambient scribe will be used, not rely on a line buried in a privacy notice. NHS England publishes model wording clinicians can adapt: "During your appointment today I will be using an ambient scribe to help me to take notes... The recording will be deleted once I have checked that the notes are accurate." Consent follows a specific logic: implied consent under the common law duty of confidentiality, paired with a lawful basis under UK GDPR Article 6(1)(e), public task, or Article 9(2)(h), health and care, is treated as sufficient for individual care. Explicit written consent is not required. What is required is a genuine chance to object, and the guidance is unambiguous about what happens if someone takes it: "if an individual dissents, you cannot then use the tool."

Capacity gets its own duty. Where a patient lacks capacity, the clinician must check whether someone else holds legal authority to accept or dissent on their behalf, or whether the patient has previously expressed a preference, before defaulting to a best-interest decision. Accuracy checking is continuous, not a one-off: every output must be reviewed "within a timeframe that allows for a meaningful review," corrected before it reaches the record, and marked with a line stating it was produced with AI assistance and reviewed by the responsible clinician. Retention is deliberately narrow: once a summary is verified and filed, the underlying audio and transcript should typically be deleted, not kept indefinitely as a backup.

The remaining four duties sit with the practice rather than the individual clinician. A data protection impact assessment is, in the guidance's own words, "highly likely to be a legal requirement" for this technology. A data sharing and processing agreement needs to be in place with the vendor, documenting who is controller and who is processor, because the guidance is explicit that the health or care organisation, not the AI supplier, should normally hold the controller role. A security review of the vendor is expected before adoption. And staff need a written policy plus some form of competence check, not just a verbal heads-up that the tool exists.

So what for you: none of these nine duties carries a penalty for an independent psychology practice that ignores all of them, because none of them apply to you as a matter of law. What carries a penalty is not having answers when someone asks, because the underlying UK GDPR and common law duties behind several of these nine items apply to every data controller in the country, NHS or not.

The two documents that matter most, and they're free

Of the nine duties, the DPIA and the data sharing and processing agreement are the two an independent practice is most likely to skip, because they read like the kind of paperwork only a large organisation with a Caldicott Guardian has time for. NHS England publishes a downloadable DPIA template built specifically for ambient scribes, alongside a template data sharing and processing agreement (DSPA), both available directly from the IG guidance pages on digital.nhs.uk. Neither is restricted to NHS bodies. A three-therapist practice can download the DPIA template, work through it against its own chosen scribe in an afternoon, and end up with a document that is more thorough than most independent practices currently hold for any piece of software they run, AI or otherwise. The same applies to the DSPA template as a checklist against whatever contract the vendor is offering.

So what for you: the single most useful thing in NHS England's guidance for an independent practice isn't a rule, it's a template. Use it, adapt the sections that assume an NHS-scale organisation, and keep the dated document on file.

What a three-person practice can realistically evidence

Four of the nine duties cost nothing and need no specialist help: telling clients before every session, respecting an objection when it happens, running a capacity check for clients who lack it, and checking every output before it goes in the record. These are behavioural disciplines, not procurement decisions, and a solo practitioner can start them this week.

Two more are free but need an afternoon: working through NHS England's DPIA template against your chosen product, and using its DSPA template as a checklist against the vendor's own contract. Retention discipline, deleting audio and transcripts once a summary is filed, is usually a setting inside the product rather than a process you build yourself, so it is more a procurement question than a governance one.

The genuinely harder duty is the security review. NHS England's guidance tells organisations to "engage with technical and security specialists" before adoption, which is not realistic for a three-person practice with no IT function. The substance of that duty is still achievable without a specialist: ask the vendor where data is hosted, whether it is UK or EU-based, what happens to recordings after processing, and whether the company holds Cyber Essentials or an equivalent certification, then keep the written answers on file. That is not the same exercise NHS England runs for a hospital-scale contract, and it should not pretend to be, but it is a defensible, evidenced answer to the question "what did you check," which is what actually gets asked in practice.

One structural gap is worth naming rather than working around. NHS England's guidance expects a Chief Information Officer, a Chief Clinical Information Officer, a Senior Information Risk Officer, a Caldicott Guardian and a Data Protection Officer to be involved in choosing a scribe. A three-therapist practice has none of those named roles. What it has is a practice director who, in substance, is doing all five jobs at once. The fix is not to invent titles. It is to say so, in writing, inside the DPIA: name the person accountable for each of those functions, even if it is the same person five times over, and date it. That single paragraph is the difference between a practice that thought about governance and one that didn't, and it is exactly what an ICO investigation or an insurer's due diligence questionnaire is designed to surface.

So what for you: six of the nine duties are within reach of a small practice this month, using tools NHS England already built and gave away for free. The one that genuinely needs outside expertise is the security review, and even there, a documented set of vendor answers beats no questions asked.

Where BPS and HCPC are still quiet

We've already covered the consent question specifically for practitioner psychologists: HCPC's Standard 1.4 is the binding standard, and it predates AI entirely, while the British Psychological Society's endorsement of AI principles is advisory rather than statutory (HCPC's consent standard is binding, BPS's AI guidance isn't). That piece also flagged a "substantive change" reading of consent, that adding a new AI tool may require re-confirming consent rather than relying on what a client agreed to previously. NHS England's transparency duty lands in the same place from a different direction: clinicians are told to notify clients at the start of every session "as ambient scribes are new," with the guidance itself noting that requirement may soften "as familiarity and understanding of this technology increases." Two separate sources are converging on the same practical answer: treat consent as something that needs restating, not banked once and forgotten.

The safeguarding side has a similar shape. CQC's own AI guidance names five relevant regulations and does not include Regulation 13, safeguarding, a gap we covered in July (CQC names five regulations for AI, safeguarding isn't one). NHS England's ambient scribing guidance does at least address one safeguarding-adjacent scenario directly, reviewing third-party information mentioned during a session before it reaches the record, which is a more specific instruction than anything CQC has published. It is still guidance written for someone else's organisation.

So what for you: an independent UK psychology practice currently has more detailed operational guidance available from a document that doesn't apply to it than from either of the bodies that actually regulate it. That is worth remembering the next time a vendor implies their tool is "CQC compliant" or "HCPC approved." Neither body has published anything specific enough to make that claim mean much.

What this means for your practice

Do this before your next ambient scribe purchase or renewal, and budget an afternoon rather than a project. Download NHS England's DPIA and DSPA templates from digital.nhs.uk and work through both against your chosen product, striking out sections that assume NHS-scale infrastructure and naming, in each accountable-owner field, whichever member of your practice actually holds that responsibility. Write the verbal notice into your session opening, using NHS England's model wording as a starting point, and agree as a practice what happens when a client objects, including who takes notes by hand that day. Put a dated, one-paragraph note in the DPIA explaining why your practice concluded the product is safe to use, and who checked what. None of this is legally required of you. All of it is the exact evidence an insurer, an ICO assessment, or an NHS-referring GP practice doing due diligence on a referral partner will expect to see, and right now, most independent practices have none of it on file.

If you want a second opinion on which of these nine duties your practice can genuinely evidence today and which ones are still just intentions, that gap analysis is part of our AI Opportunity and Growth Assessment. Or book a 20-minute call and we'll tell you honestly whether the gap is worth closing before your next AI purchase.

Related: Your AI scribe's status is set by marketing  ·  HCPC's consent standard is binding. BPS's AI guidance isn't.  ·  CQC names 5 regulations for AI. Safeguarding isn't one.

This article is for informational purposes only and does not constitute legal or clinical advice. It summarises NHS England's "Using AI-enabled ambient scribing products in health and care settings" guidance (digital.nhs.uk, last edited 7 May and 4 June 2026), NHS England's "Adopting ambient scribing products in health and care settings" service guidance (last edited 29 July 2026), and the Medium-Term Planning Framework "Delivering Change Together 2026-27 to 2028-29" (published July 2026). NHS England's guidance is written for NHS organisations and does not constitute a legal or regulatory requirement for independent practices. Confirm your own consent, data protection and governance position with your professional indemnity insurer, your Data Protection Officer or adviser, and your professional regulator before acting on anything above.