What CQC says about AI, and what it does not
CQC encourages AI but does not approve tools, and says the presence or absence of AI does not predict a rating. What it does expect is that you meet the standards you already have.
This is the question we are asked most often, usually in an anxious form: if we start using AI, what will the inspector say?
CQC published its position on 21 May 2026, and it is more reassuring, and more specific, than most people expect. This page sets out what it actually says, in its own words, and where it is silent.
The short answer
CQC encourages AI. It says it will “encourage the use of innovative technologies, including AI, where the technology benefits people and results in more effective and efficient services”.
But it regulates AI the same way it regulates everything else: through the standards you already have to meet. There is no separate AI inspection, no AI rating, and no approved list.
Two sentences from CQC’s page do most of the work.
“We do not assess or approve specific technologies”
That is CQC’s own wording. It matters because it settles an argument that happens in a lot of care offices.
No AI tool is “CQC approved”. There is no such status. If a supplier tells you their product is CQC approved, CQC compliant, or endorsed by the regulator, they are either confused or selling you something on a false basis. That claim alone is a reason to slow down, and a reason to use our supplier question sheet before you sign anything.
What CQC does instead is check whether the care is safe, effective and person-centred, whatever produced it. A tool is not compliant or non-compliant. Your service is.
“The absence or presence of AI does not predict a specific rating”
Also CQC’s own wording, and worth reading twice.
Adopting AI will not improve your rating. Refusing to adopt it will not damage your rating. Anyone telling a registered manager that they need AI to stay on the right side of inspection is inventing a pressure that the regulator has explicitly disclaimed.
The corollary is the part providers sometimes miss. If AI makes your records worse, your consent practice sloppier or your governance thinner, that will show up — not as an AI problem, but as a records problem, a consent problem or a governance problem, judged against the standards that already applied.
Which regulations actually bite
CQC names five that carry most of the weight when AI is involved.
| Regulation | What it covers | Where AI touches it |
|---|---|---|
| Regulation 9 | Person-centred care | Giving people the information they need to make choices, including about AI’s role in their care |
| Regulation 10 | Dignity and respect | Protecting privacy and treating people fairly |
| Regulation 11 | Consent | Staff obtaining consent must actually understand what they are asking people to consent to |
| Regulation 12 | Safe care and treatment | CQC’s own gloss: “ensuring equipment, for example AI is safe” |
| Regulation 17 | Good governance | CQC’s own gloss: “adhering to regulation, effective risk management systems, and monitoring outputs” |
Regulation 17 is the one that catches most small providers, because it is where “we tried a tool and never checked what it produced” becomes a finding.
One distinction worth holding on to, because it will matter if anyone checks your working. “Monitoring outputs” is CQC’s phrase from its AI page, not wording from the regulation. Regulation 17 itself requires systems that let you “assess, monitor and improve the quality and safety of the services provided” and “assess, monitor and mitigate the risks”. CQC reads AI output-checking into that, and says so. Quote CQC for the phrase and the regulation for the duty, and you are on solid ground either way.
In practice it means someone is actually reading what the AI wrote, on a sample, on an ongoing basis — not once during the trial.
Regulation 11 is the quiet one. If a care worker cannot explain to a person how AI is involved in their care, that care worker cannot properly obtain consent. That is a training question before it is a technology question.
The eleven principles
CQC published a set of principles for good use of AI, aligned with the British Medical Association’s 2024 principles and the World Health Organisation’s 2024 guidance. This is the closest thing to a checklist the regulator has given, so it is worth having in full:
- AI to support, not to replace. AI can enhance, but not replace, human decision making.
- Human oversight. AI outputs and processes are continuously monitored and evaluated.
- Transparency and choice. People have appropriate information to make informed decisions about their care, including the role of AI. Non-digital routes are offered if needed, taking account of digital skills and connectivity.
- Safety and reliability. Introducing AI provides safe care and equitable outcomes.
- Security. The technology resists cyber-attack, and sensitive information is stored and processed securely, in line with data protection law.
- Fairness and impartiality. AI accelerates equity of access and outcomes, produces accurate results across geographies and population groups, and known biases are mitigated.
- AI readiness and training. Those using AI are sufficiently trained and confident, and assess whether it fits existing pathways.
- Effective governance. Risk assessments, plus systems to recognise, report and investigate when something goes wrong, so lessons are learned.
- Data Protection Impact Assessment. A DPIA documents risks to privacy and to people’s rights, to enable lawful use of AI.
- Accountability. Clear mechanisms for addressing issues or harm caused by AI.
- Procurement. AI tools are procured in line with relevant regulatory standards.
Read as a group, they describe an organisation that decided before it deployed, trained its staff, told the people it supports, wrote down the risks, and checks the output. Nothing in that list requires a large organisation or a budget. Most of it requires an afternoon and a decision.
Number 9 is the only one that names a specific document. If you do nothing else on this list, do the DPIA — CQC names it explicitly, and so does data protection law.
One risk CQC calls out that you may not expect
Among the risks CQC lists is this: “when used inappropriately, for example when applying for CQC registration, AI can lead to wrong decisions”.
The regulator is telling you, in its own risk list, that it has seen AI-written registration applications go wrong. If you are drafting a registration application, a statement of purpose or a response to an inspection, AI can help you structure it. It cannot know your service. Every factual claim in that document has to be true of you specifically, and someone has to check that it is.
What is changing, and when
CQC is rebuilding its regulatory model. Following the Better regulation, better care consultation, it published new draft sector-specific assessment frameworks in March 2026 for further engagement, and says those drafts already reference encouraging innovative use of technology, including AI, as part of timely access to care.
CQC has said it will publish the final frameworks and develop supporting guidance before implementation. It has also said it will keep the need for AI-specific guidance and training under review, and may develop guidance tailored to different sectors and settings.
In parallel, it is working with other regulators. The MHRA regulates software and AI as a medical device, and has set up a National Commission into the Regulation of AI; CQC says it is working with that commission and will use its outputs. The AI and Digital Regulations Service is where those remits are explained.
The practical reading: the framework is moving, the direction is settled, and none of the underlying obligations change. Anything built on Regulations 9 to 17 will survive the transition.
What CQC has not said
This is the honest part, and the part most articles skip.
- CQC has not published AI guidance for adult social care specifically. It says it may do so. Anyone quoting detailed CQC AI rules for domiciliary care is quoting something that does not exist yet.
- CQC has not said which tools are acceptable, and has said it does not assess technologies at all.
- CQC has not set a threshold for how much human checking is enough. “Human oversight” and “monitoring outputs” are the words. The judgement is yours, and you should be able to explain it.
- CQC has not said anything about how inspectors will test this in practice in a small service. The frameworks are still in draft.
Where the regulator has not spoken, we say so rather than guessing. If that changes, this page changes, and the date above will show it.
What to do on Monday
If you are using AI now, or about to:
- Write down which tools are approved, and which are not. Our one-page AI use policy covers it.
- Do a DPIA before AI touches anything about a real person. CQC names it directly.
- Decide who checks the output, how often, and what happens when it is wrong. That is Regulation 17.
- Make sure staff can explain AI’s role to the people they support. That is Regulation 11.
- Tell the people you support. See telling people you support.
- Take the board briefing to your next trustees or directors meeting.
None of that requires you to have decided whether AI is good. It requires you to be able to show how you decided.