RWK Goodman August Bulletin - AI Governance in Social Care
As I have written and said before, artificial intelligence (AI) is no longer a future issue for adult social care providers. It is already being used across the sector to produce care records, identify patterns in data and automate administrative tasks.
Used appropriately, AI has the potential to reduce administrative burden, improve efficiency and help providers focus more time on delivering care.
However, AI also presents significant legal, ethical and regulatory risks. The question for providers is no longer whether AI should be used, but whether it is being used safely, lawfully and with appropriate governance.
CQC's message is clear: existing regulation already applies
On 21 May 2026, the Care Quality Commission (CQC) published its first formal statement on AI, entitled Artificial Intelligence in Health and Social Care: CQC's Role, Expectations and Plans. The document makes a crucial point: there is no separate AI regulatory framework for adult social care providers. Instead, AI will be scrutinised through the existing regulatory framework and Fundamental Standards of care.
CQC emphasised that it does not approve individual AI products. Rather, its role is to ensure that technology contributes to safe, effective, equitable and person-centred care. The regulator's focus will therefore be on how providers select, implement, oversee and monitor AI systems.
Importantly, CQC has made clear that AI should support human decision-making, not replace it. Providers remain accountable for decisions affecting people who use services, regardless of whether or not an AI tool was involved.
What will CQC expect to see?
The CQC’s statement on AI identifies a number of core principles that providers should be able to demonstrate, including:
Human oversight and accountability.
Transparency about how AI is used.
Appropriate staff training and competence.
Effective governance and risk management.
Evidence of fairness and mitigation of bias, recognising that AI tools have been shown to demonstrate bias.
Cyber security and data protection compliance.
Systems for identifying, reporting and learning from AI-related incidents.
In practice, providers should expect inspectors to ask familiar questions:
Who approved the use of the AI tool?
What assessment was undertaken before implementation?
How are risks monitored?
What training have staff received?
How are decisions checked and verified?
What evidence demonstrates that the technology benefits people using the service?
Regulation is developing but enforcement remains uncertain
The publication of CQC's AI statement is a welcome development. It acknowledges both the opportunities and risks associated with AI and provides a helpful framework for providers seeking to innovate responsibly using technology.
However, there remains a significant gap between regulatory expectations and regulatory capability.
While CQC has set out ambitious expectations around AI governance, it is far from clear whether the regulator currently possesses the specialist expertise, resources or operational capacity necessary to assess complex AI systems effectively across the adult social care sector.
There is a risk that providers are expected to implement sophisticated governance arrangements while inspections continue to focus on traditional compliance indicators and inconsistent evidence-gathering.
In our view, there remains a considerable distance between the regulator's aspirations for AI oversight and the CQC’s practical ability to deliver robust, consistent assessments in this area.
Other regulators are also taking an interest
Providers should not assume that AI governance is solely a CQC issue.
The Information Commissioner's Office (ICO) continues to emphasise accountability, transparency and fairness in AI systems that process personal data. Organisations using AI must comply with UK GDPR requirements, including lawful processing, data minimisation, security obligations and, where appropriate, completion of a DPIA before deployment.
Practical steps providers should take now
Providers do not need to wait for further regulation to strengthen their position. Providers using, or intending to use, AI should consider:
Developing a dedicated AI governance policy.
Maintaining an inventory of AI tools in use.
Completing risk assessments and data mapping/Data Protection Impact Assessments, where appropriate. 4. Identifying clear organisational accountability for AI oversight.
Training staff on both opportunities and limitations of AI.
Establishing mechanisms for monitoring accuracy, bias and errors.
Ensuring human review remains central to decision-making.
Reviewing contracts with AI suppliers and software providers.
Looking ahead
AI is likely to become a routine part of adult social care delivery over the coming years. Providers that embrace innovation while maintaining strong governance will be best placed to realise the benefits.
The key message from CQC is straightforward: AI is not exempt from regulation. Existing legal and regulatory duties already apply.
The challenge for providers will be demonstrating that AI improves outcomes while preserving safety, dignity, accountability and trust. The challenge for regulators, meanwhile, will be ensuring that inspection and enforcement frameworks evolve quickly enough to keep pace with the technology they are seeking to oversee.
Keara Bowgen-Nicholas advises adult social care providers on regulatory compliance, governance, data protection, safeguarding and the safe implementation of emerging technologies, including artificial intelligence.