Digital tools have quietly become part of how most practices run, from online consultations to AI scribes. The CQC has noticed and questions about how you assure the safety of those tools are an increasingly normal part of an assessment. The good news is that what inspectors look for is broadly what existing good practice looks like anyway. Take our free five-minute assessment to assess your readiness, and read on to find out what you need to know.
First, a word on the changing framework
The CQC's approach is in transition. The Single Assessment Framework introduced in 2024 is being replaced by four sector-specific frameworks - primary care among them - following the Dash review and the Better regulation, better care consultation. Draft frameworks were published in March 2026, with the new approach expected to take effect towards the end of the year. Scoring is being removed, and quality statements are being replaced with structured questions.
Through all of this, the five key questions stay the same: Safe, Effective, Caring, Responsive and Well-led. Digital and AI tools sit mainly under Safe and Well-led, and that isn't changing, which makes them a sensible place to focus, whichever version of the framework you're assessed under.
What inspectors actually ask about AI and digital tools
The clearest GP-specific steer is CQC's GP mythbuster 109. It sets out that assessments focus on your systems and processes for safe, compliant use, and points to evidence in a few areas:
- Procurement and governance: tools procured in line with relevant standards - DCB0160, DTAC, and MHRA registration where the tool is a medical device - and used in line with their intended purpose.
- Clinical safety: a completed DCB0160 assessment and a named Clinical Safety Officer responsible for it.
- Data protection: a DPIA where patient data is processed in a new way.
- Monitoring and oversight: evidence that you keep an eye on how the tool performs, train staff, and act when something looks wrong.
CQC's position on AI, in plain terms
In May 2026 CQC published its position on AI in health and social care. It isn't creating a separate AI rulebook; it's clarifying how existing regulation already applies. Its headline principle is that AI should support, not replace human decision-making, with meaningful clinical oversight retained. It links AI use to existing regulations including Regulation 12 (safe care and treatment) and Regulation 17 (good governance).
One trap worth avoiding
There's a temptation to use general-purpose AI to generate policies and audit documents ahead of an inspection. Whilst not inherently problematic, the generic nature of these are something that Inspectors are well practised at spotting. The CQC wants to see policies which are obviously relevant to how your practice does things with evidence of it actually being followed. As the latest draft assessment frameworks have highlighted, just having the paper is not good enough. The question is do your staff understand and do they actually follow them?
How to be ready, without a scramble
Readiness is mostly about having a clear, current picture of your tools and being able to show how you assured each one. A practical starting point:
- List every digital and AI tool in use, including ones adopted informally.
- For each, note its MHRA status, whether the supplier holds a DCB0129 case, and whether you've completed a DCB0160 assessment and DPIA.
- Confirm who your named CSO is and what they oversee.
- Keep a simple record of monitoring, training and any incidents.
Curistica's free Assess tool walks you through the first two steps in about five minutes, and our CQC readiness service is built around exactly this kind of evidence giving a clear review of every tool, every gap, and a prioritised plan to close them.
See where your digital governance stands before an inspector does. Try the five-minute Assess tool, explore CQC readiness, or book a free call.
