Telling the people you support that you use AI

There is a version of this conversation that services dread: explaining to someone that a computer helped write their care notes, and watching them worry about it.

There is also a version where it goes fine, and the difference is almost entirely in the timing and the wording.

The rule, and why it bites

The ICO’s guidance on the right to be informed is direct about new uses of data:

“If we plan to use personal data for a new purpose, we update our privacy information and communicate the changes to individuals before starting any new processing.”

Introducing an AI tool that touches care records is a new purpose. So the obligation is to tell people before it starts, not to mention it afterwards if someone asks.

This is the single most common mistake we see. A service pilots a tool for three months, it goes well, and then someone asks whether people were told. The honest answer is no, and the fix is retrospective.

The ICO also sets a standard for how you tell them. Privacy information must be:

“concise, transparent, intelligible, easily accessible, and it must use clear and plain language.”

A paragraph of legal text appended to a twelve-page privacy notice does not meet that standard, whatever else it does.

What you have to tell them

The ICO’s checklist is long, and most of it your existing privacy notice already covers. The items that change when you introduce AI:

• The purposes of the processing — what you are using AI for, specifically
• The recipients or categories of recipients — the AI supplier is now a recipient of their data
• Transfers to third countries — this one catches people out. If your tool is hosted in the United States, that is an international transfer and it belongs in your privacy information
• Retention periods — how long the supplier keeps it, which may not match how long you keep it
• The existence of automated decision-making, including profiling, if applicable

That third point is why the tool directory records where each tool holds data. Two of the tools we checked are hosted on US infrastructure. If you use one, your privacy notice has to say so.

Transparency is not consent

These get muddled constantly, and the distinction matters.

Transparency is a duty on you. You must tell people what you do with their data. It applies whatever your lawful basis is, and it is not optional.

Consent is one possible lawful basis among several, and for most care records it is not the one you are relying on. Telling someone you use AI to draft their visit notes is not asking their permission, and framing it as permission creates a problem: if you ask, you must be willing to accept no.

Where consent does come in is CQC’s Regulation 11, which requires that staff obtaining consent have “the necessary knowledge of the care and/or treatment they are asking people to consent to”. If a care worker cannot explain how AI is involved, they cannot properly obtain consent for care that involves it. That is a training obligation, not a paperwork one.

CQC’s principles also require “transparency and choice”, including that “non-digital routes to care are offered if needed”. Someone who does not want to engage digitally should not receive a worse service.

How to say it

Plainly, briefly, and without apologising for it. Three things people actually want to know:

1. What it does. “A tool types up what the care worker says, so they spend less time writing and more time with you.”
2. Who checks it. “The care worker reads it and corrects it before it goes on your record. Nothing is saved until they do.”
3. What it does not do. “It does not make any decisions about your care. People do that.”

Point three is the one that resolves most anxiety, and it is the one most services forget to say.

Our letter template puts this on one page.

Timing and method

The ICO suggests “a combination of different techniques including layering, dashboards, and just-in-time notices”. Translated into a small care service:

• Before you start: a short letter or a conversation at the next review. Update your privacy notice at the same time.
• New people: include it in your welcome pack, so it is normal rather than news.
• In the moment: if a care worker is going to speak a voice note in someone’s home, they say so. “I’m going to record a quick summary now, then check it before it’s saved.” That is a just-in-time notice, and it does more for trust than any letter.

Families and representatives

Where someone has a legal representative, or an attorney or deputy, tell them too. Where a family member is closely involved but has no legal standing, use your usual judgement about what you share — introducing AI does not change who is entitled to information about someone’s care.

If someone lacks capacity to understand the explanation, your Mental Capacity Act duties apply as they do to any other decision about their care. That is a larger topic than this page, and worth proper advice.

When someone objects

Some people will not want it, and a few will feel strongly. Useful responses:

• Find out what specifically worries them. Usually it is either “is a machine deciding things about me?” or “who else can see this?”. Both have clear answers.
• Be honest about what you can offer. If you can keep handwritten notes for one person, say so. If you genuinely cannot, do not pretend you can.
• Record the objection. If someone objects and you continue anyway, write down what they said and why you continued. That is the record that protects everyone later.

Before you start

1. Update your privacy notice. The AI supplier is now a recipient of personal data.
2. Check whether the tool involves an international transfer, and say so if it does.
3. Send the letter or have the conversation — before the pilot, not after.
4. Make sure every member of staff can answer “does a computer decide things about my care?” in one sentence.
5. Add it to your welcome pack so you never have to do a retrospective fix again.