DPIA before AI notes: a UK dental checklist

Your practice manager has found an AI note tool that drafts the clinical record from the surgery conversation. The demo went well, the price is sensible, and the sales contact says it is "not a medical device". That last line is true for many of these tools, and it answers a question about the MHRA. It says nothing about the one that comes next: before patient data goes into a new tool, have you assessed what could go wrong with it?

On 29 July 2026 the MHRA published its position on ambient voice technology. Products "intended solely for transcription, summarising of clinical conversations, drafting letters, or suggesting clinical codes" are not regulated as medical devices, while products that support diagnosis, treatment or prevention, or "take automated action such as placing orders without clinician review", are (MHRA, 29 July 2026). The same page says "clinicians remain responsible for reviewing and verifying AI generated transcripts" and "this guidance does not change the law". It does not mention data protection, UK GDPR or data protection impact assessments (MHRA, 29 July 2026). The gap is yours to fill.

We could not open the British Dental Association's AI page or the GDC's guidance from the environment this article was written in, and we found no GDC guidance on AI notes. The only GDC item on AI we saw, dated 15 October 2026, concerns dental education. What follows rests on the ICO's own pages and the MHRA notice, each named where it is used.

Does a dental practice need a DPIA for AI notes?

Article 35 of the UK GDPR requires a data protection impact assessment where processing "is likely to result in a high risk to the rights and freedoms of natural persons", and it must be done "prior to the processing" (ICO, guidance read October 2026). Three situations always need one. One of them is large-scale processing of special category data, and the ICO lists "data concerning health" as special category data (ICO, October 2026).

The ICO also publishes a list of processing that needs a DPIA. It includes "innovative or novel use of technology, including AI", but that item requires a DPIA when combined with another criterion from the European guidelines on DPIAs, known as WP248 (ICO, October 2026). The ICO page does not tell a dental practice which pairing applies to it.

Our reading: a clinical note is health data, health data is the likeliest second criterion, and an AI tool is the novel technology, so you should treat a DPIA as required unless you can write down why it is not. Whether a single-site practice counts as "large scale" is a judgement we would not rely on, because the cost of doing the assessment is small and the cost of having none when a patient or the ICO asks is not. The ICO's page also carries a notice that the guidance "is under review and may be subject to change" because of the Data (Use and Access) Act, so check the current wording before you finalise anything.

So what for you: if the tool will see patient records, start the DPIA before the pilot, not after the trial month.

The seven steps, applied to an AI note tool

The ICO describes the process in seven steps: identify the need for a DPIA, describe the processing, consider consultation, assess necessity and proportionality, identify and assess risks, identify measures to mitigate the risks, and sign off and record outcomes (ICO, October 2026). For a dental AI note tool, each step turns into a concrete question.

1. Need. Write one paragraph on why you are doing a DPIA. Reference the health data and the AI element.
2. Describe the processing. The ICO asks you to describe "how and why you plan to use the personal data". Name the tool, what it records (audio, transcript, or both), where the audio and text are stored, how long they are kept, who at the vendor can access them, and whether your data is used to train the vendor's models. If you cannot get a straight answer to the last two, that is a finding in itself.
3. Consultation. The ICO says to "seek and document the views of individuals (or their representatives) unless there is a good reason not to", and to record the reason if you skip it. For a practice, that can be as light as asking a few patients how they feel about the surgery being recorded, and writing down what they said.
4. Necessity and proportionality. The ICO's questions are "Do your plans help to achieve your purpose?" and "Is there any other reasonable way to achieve the same result?". Your honest answer has to weigh the minutes saved on notes against recording the whole appointment.
5. Risks. The ICO says "harm does not have to be inevitable to qualify as a risk". List what could go wrong: a wrong note about an allergy or medication, a recording stored outside the UK, a vendor breach, a patient who did not know they were recorded. Score each by likelihood and severity.
6. Mitigations. Clinician review of every note before it is saved, a contract that bars training on your data, a short patient notice, a retention limit. Each risk gets a measure.
7. Sign off. The ICO says to record whether each risk has been "eliminated, reduced, or accepted", the residual risk, and whether the ICO must be consulted.

The accuracy risk deserves its own line. Our piece on hallucination rates in dental AI scribes covers why a fluent note can still be wrong, which is the main reason the MHRA's "clinicians remain responsible" line matters in practice.

So what for you: the DPIA is a document you can mostly write from the vendor's answers plus an hour of your own thinking. Book that hour before you sign the contract.

Two traps: the data protection officer and the waiting time

The ICO says that "if you have a DPO, you must seek their advice", and that if you reject their advice you should record your reasons (ICO, October 2026). We could not open the ICO's page on when a DPO must be appointed, so we do not say here whether your practice needs one. If you have one, they sit in the middle of this process. If you do not, check the threshold on the ICO site rather than assuming.

The second trap is time. If your DPIA finds a high risk that you cannot reduce, prior consultation with the ICO is required, and "you cannot go ahead with the processing until you have consulted us". The ICO aims to respond "within eight weeks of receipt of your DPIA", and in complex cases "can extend this to a maximum of 14 weeks" (ICO, October 2026). In our reading, mitigations such as mandatory clinician review and a ban on vendor training will bring the risk down for most practices, so few will reach this point. If your honest assessment is that the risk cannot be reduced, though, you are looking at a wait of two to three months, not a quick call.

So what for you: if a risk looks unfixable, change the design (a narrower use, a different tool, no audio retention) before you file, not after.

Where this sits next to CQC and the GDC

A DPIA is one document in a wider governance picture. If your practice is regulated by the CQC, the same description of the tool, the review step and the risks is the evidence you will want for a governance conversation. Our pieces on CQC well-led expectations for dental AI and on what the GDC and the BDA each say about AI cover those angles. For the equivalent exercise in a psychology setting, see DPIAs, consent and the Data Act for UK therapy practices.

One point from our reading of the sources: the MHRA notice puts the weight on the clinician checking the output, and the ICO process puts the weight on you describing and defending the processing. Neither regulator tells you which tool to buy. That is why a written DPIA matters. It is the only document that shows you asked the questions in the right order.

So what for you: file the DPIA with your governance records, and put the next review date in the diary, because the tool, the vendor terms and the ICO guidance will all change.

What we would do, and what we would not

The call: for a UK dental practice that wants to try an AI note tool, complete the DPIA first, in writing, and have the principal sign it. Do it for a one-chair practice as readily as for a group. Make clinician review of every note a condition of use, and do not run a "quick pilot" on live patient records while the paperwork is pending. A pilot is processing.

What we would not do is pay a consultancy to produce a forty-page template exercise. For a tool with a single purpose, the ICO's seven steps can be written up in a few pages, and a document you wrote yourself is one you can explain to a patient. A multi-site group adding a third surgery faces the same question at a larger scale, and it is worth deciding once, at group level, who owns the DPIA and who approves each new tool.

Frankly, the real risk is the vendor answer you did not ask for. If the supplier will not say where the audio goes or whether it trains on your data, the DPIA has already given you its result.

Limits of this article: we have not seen the BDA's current AI advice or any GDC guidance on AI notes, we could not open the ICO's page on data protection officers, and ICO guidance is under review following the Data (Use and Access) Act. Check each before you rely on it. Where a practice would like an independent read of which AI tools are worth its time and what the paperwork should cover, that is part of what the AI Opportunity and Growth Assessment examines, and a free 20-minute discovery call is the place to start.