One AI Bill call, one code stuck at 2027

Two things happened on consecutive days this week that, read together, say more about the state of UK healthcare AI regulation than either says alone. On Wednesday, a committee of MPs and peers told Parliament the current system lets AI developers walk away from the harm their tools cause. On Thursday, five regulators including the GDC responded not with rules but with a promise to eventually write some. Meanwhile the one document with actual legal teeth, the ICO's statutory AI code, isn't due for another year. None of this is a reason to wait before using AI in your practice. It's a reason to stop assuming a finished rulebook is coming to tell you what's allowed, and start documenting what your own practice does instead.

1. MPs say AI developers are passing liability onto the clinicians who use their tools

The Joint Committee on Human Rights, a cross-party committee of MPs and peers, published a report on 16 September 2026 criticising the freedom AI developers currently have to shift responsibility for harm onto the healthcare organisations and clinicians who deploy their products. The report states that users of AI are "often less powerful, have less access to resources, and are not in the best position to identify risks or prevent harm occurring", and calls for a new AI Bill together with an independent statutory oversight body to give the issue tailored, effective protection. It gives a concrete example directly relevant to this site's readers: a dentist using AI diagnostic software could face a clinical negligence claim if a patient were harmed, even where the fault originated in a defective AI system, not the dentist's own judgement. Source: Joint Committee on Human Rights report, reported by Dentistry.co.uk, 16 September 2026.

The number: two. The two concrete asks in the report, a new AI Bill and a new independent oversight body, neither of which exists yet.

The so-what: a select committee report is a recommendation, not a change in the law. Nothing about how liability is currently assigned shifted this week. What did shift is how bluntly Parliament is now naming the problem: right now, the practice and the clinician carry the exposure by default, regardless of where an AI tool's own fault lies. We found the same gap from the insurer's side in 0 of 2 psychologist insurers ask about AI: nobody has written the rule yet, so a practice's own contract with each AI vendor, spelling out who is responsible for what, is the only protection that exists today.

2. A day later, five regulators pledged principles, not rules

On 17 September 2026 the General Dental Council joined regulators covering medicine, nursing and midwifery, and social work in a joint statement of intent, pledging to develop "high-level principles" to guide AI regulation across health and social care, aimed at what the statement calls a coherent, consistent and proportionate approach. Read the statement's own language carefully and the limits are clear: it describes itself as "the beginning of a formal collaboration", with no principles published, no timeline set, and no enforcement mechanism attached. Source: joint regulator statement of intent, reported by Dentistry.co.uk, 17 September 2026.

The number: one. The one concrete thing this statement creates right now: a formal collaboration between regulators. Not a standard, not a deadline, not a sanction.

The so-what: the timing is not a coincidence. A parliamentary committee names the liability gap on Wednesday, and by Thursday the profession's own regulators are signalling they intend to do something about it, eventually. For a two-site dental group weighing a third location, that eventually still leaves today's governing documents exactly where we found them in GDC's safeguarding guidance predates AI: unchanged since 2013 and silent on AI. A pledge to write principles is not a reason to delay documenting your own AI decisions in the meantime.

3. The UK's actual AI rulebook, the one with legal force, isn't due until 2027

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, SI 2026/425, came into force on 12 May 2026, placing the Information Commissioner under a statutory duty to write a single code covering AI development, AI deployment and automated decision-making, including a mandatory children's data component. That duty is now legally binding on the ICO. The code itself is not. Legal trackers monitoring the ICO's own timeline put publication in 2027, a full year or more after the duty to write it took effect. This is separate from the ICO's draft guidance on automated decision-making under the Data (Use and Access) Act 2025, whose consultation closed on 29 May 2026 and which also remains unpublished in final form. Source: legislation.gov.uk, SI 2026/425; ICO consultation page, checked September 2026.

The number: 2027. The earliest year the UK's actual statutory AI code, the one document in this week's news with legal force behind it, is expected to exist.

The so-what: don't wait for either ICO document to tell you what's allowed. Article 22B's restriction on solely automated decisions using special category data, which covers most AI-scored mental health outcome measures, is already in force regardless of whether the ICO's own guidance has caught up with it, a point we set out in full in Article 22 loosened. Not for health data. The law that binds you today was written months ago. The document explaining it in plain English is still years off.

4. NHS's AI infrastructure keeps scaling regardless: 29 suppliers, up from 19

NHS England's Ambient Voice Technology self-certified supplier registry has grown to 29 suppliers, up from 19 when it first published its list in January 2026, a rise of more than half in eight months. Each listed supplier must meet current DTAC assessment requirements, hold MHRA Class 1 registration with evidence of post-market surveillance, and demonstrate integration with existing NHS digital infrastructure before being added. The registry sits inside NHS England's wider £10bn technology investment, which explicitly prioritises AVT integrated into electronic patient records over standalone tools. Source: NHS England Digital, Ambient Voice Technology Self-Certified Supplier Registry, checked September 2026.

The number: 29. Suppliers now certified, against 19 in January, while the regulatory code meant to govern how they're used sits three items above this one, still years away.

The so-what: none of NHS England's AVT guidance binds an independent practice outside the NHS. What the registry's growth does offer is a useful proxy for vendor maturity: a supplier that has cleared DTAC and MHRA Class 1 registration for NHS deployment has already been through a level of scrutiny most independent practices have no time or budget to replicate themselves. We set out exactly what NHS guidance does and doesn't require of a private practice in NHS's AI scribe guidance isn't binding. Use the registry as a shortlist, not a compliance shortcut.

5. NHS England is finally closing the guidance gap for vulnerable patients

NHS England and the Royal College of Psychiatrists are developing joint guidance on using ambient voice technology with patients who have mental health needs, learning disabilities, or who are neurodivergent, covering considerations around capacity, privacy and trust specific to that population. The work was announced in May 2026 and is due to publish this month. Until now, no AVT guidance published in the UK has addressed this group directly, despite AVT already being deployed in mental health settings where capacity to consent is precisely the question most likely to be contested. Source: Royal College of Psychiatrists, "RCPsych and NHS England to develop guidance on use of Ambient Voice Technology", 6 May 2026.

The number: zero. The number of AVT guidance documents specific to mental health, learning disability or neurodivergent patients that existed before this one was commissioned.

The so-what: this is the first UK guidance we've seen that names capacity to consent as a distinct AVT question rather than folding it into general consent principles. A psychology or allied health practice serving patients whose capacity may fluctuate should treat this as the clearer bar to work towards once published, not the CQC or ICO's more general AI guidance, which don't address capacity in this much depth. We cover the medical device status question this guidance sits alongside in Your AI scribe's status is set by marketing.

What this week adds up to

Every story this week points the same direction: naming the problem is running well ahead of fixing it. Parliament named the liability gap. Regulators named their intent to respond. The ICO's own statutory duty is real, but the document it produces is a year or more away. Only the infrastructure, NHS's supplier registry and its guidance pipeline for vulnerable patients, is actually moving at the pace the headlines imply. For an independent practice, the practical read is the same one this site keeps returning to: a pledge to write principles is not a standard you can be assessed against, and a statutory duty is not the same as a finished code. What protects your practice in the meantime is what you can write down yourself, today: what your AI vendor contracts say about responsibility, what your own consent process actually discloses to patients, and where your practice's own documentation would stand up if the liability question Parliament raised this week ever reached your front desk.

If you want a structured, independent read on where your own practice sits against those questions, the AI Opportunity and Growth Assessment benchmarks you against the CARE Framework in two weeks. Or book a 20-minute discovery call and we will work through what this week's stories mean for the tools you already run.