AI in nursing practice: safe, lawful and accountable use

Cue 1 A prediction tool and a generative tool side by side, each with its typical failure

EMMA 00:00 George, I'll be honest. Every second email at work now is about AI, and I still couldn't tell you what the thing is actually doing. Can you?

GEORGE 00:10 I can, and it takes about a minute. First, there isn't one thing. On a ward there are at least two kinds, and they fail differently. One predicts, taking measurements already in the record and giving you a score or an alert. The other generates, taking words in and producing new words out.

EMMA 00:32 Give me an example of each.

GEORGE 00:34 A deterioration risk score is the first kind. A scribe that listens to a consultation and drafts the note is the second. The first can be miscalibrated, wrong about a kind of patient it saw too little of. The second can invent.

EMMA 00:51 Invent. That's a strong word.

Cue 2 A fluent paragraph with three highlighted claims, one of which is invented

GEORGE 00:53 It's the right one. A generative tool has learned from a huge amount of text which words tend to follow which. When it answers, it produces the most plausible continuation. It doesn't look anything up, and it has no idea whether what it produced is true.

EMMA 01:11 But it sounds so sure.

GEORGE 01:13 Because sounding sure is what it's built to do. Smooth, confident prose is its whole output. It doesn't hesitate when it's guessing. A wrong sentence and a right sentence look identical on the screen.

EMMA 01:27 So how do I know which is which?

GEORGE 01:30 You don't, from the text alone. You know from what you saw and heard. Which is why I want you to carry four failure modes in your head. Invention, a detail nobody said. Omission, something said that's missing. Distortion, the detail's there but changed. And misattribution, the wrong person said it.

Cue 3 Four failure modes as four short clinical examples: invention, omission, distortion, misattribution

EMMA 01:50 Which is the worst?

GEORGE 01:52 Omission, because you can't see a gap by reading what's on the page. You only catch it if you remember what was said in the room. A missed allergy is invisible in a note that looks complete.

EMMA 02:07 And distortion?

GEORGE 02:07 Numbers, sides and negatives. A dose that's slightly off. Left for right. No chest pain turning into chest pain. Those three get a second look from me, every time, whoever wrote the draft.

EMMA 02:21 Here's what bothers me. If it's right nearly every time, I'm going to stop checking. I know I will.

Cue 4 A tired clinician at the end of a shift reading a draft, with the unread last paragraph fading

GEORGE 02:28 Everybody does. It has a name, automation bias, and it isn't carelessness. It's what happens to a tired person given a draft that's ninety-five per cent right. The five per cent hides in the bit you stopped reading. And the better the tool, the worse it gets.

EMMA 02:47 That's a strange thing to teach. The better it is, the more dangerous it is.

GEORGE 02:53 Not more dangerous, harder to supervise. So you use a habit. Read it as though a very fast, very confident junior had written it, someone who has never met the patient. You wouldn't sign their note unread.

EMMA 03:08 Fair. Now the part everyone worries about. The NMC. What does the Code actually say about this?

GEORGE 03:15 Nothing about the technology, and it doesn't need to. Clause 10.4 says attribute your entries to yourself. 10.3, complete records accurately and without falsification. 6.2, keep the knowledge and skills you need for safe practice. And 19.1 and 19.2, reduce the likelihood of mistakes and allow for human factors and system failures.

Cue 5 Code clauses 10.3, 10.4, 6.2 and 19.1 with a draft note in the middle and an arrow to the registrant

EMMA 03:36 So if the tool wrote it and I accepted it...

GEORGE 03:40 It's your entry. You adopted it. You also have to know enough about the tool to use it safely. Not how it's built. How it fails.

EMMA 03:50 Is the Code about to change?

GEORGE 03:52 The NMC has said it will consult on a new Code from September to December 2026, and that digital and AI technologies are one of its areas. I'd be surprised if the duties got lighter. This course teaches what stands today and tells you when that might move.

EMMA 04:12 What about my employer? If they bring the tool in, doesn't some of this land on them?

GEORGE 04:18 Some does. They share responsibility for how it's introduced, tested and supported. But your accountability to the NMC is yours. It doesn't transfer. So you want to be someone who can ask good questions about the tool, which is where we go next.

EMMA 04:36 So the one thing to take away?

GEORGE 04:38 Two. It writes fluent text whether or not it's true. And once you accept it, it's your record.

Cue 1 A scribe listening to a consultation and producing a draft, with the clock showing time saved

EMMA 04:46 George, scribes. Half my friends in the NHS say they're a miracle and the other half say they're a lawsuit waiting to happen. Who's right?

GEORGE 04:56 Both, depending on whether the note gets checked. Let me start with what one actually does. It listens to a consultation or a handover, with permission, and drafts the note or the letter.

EMMA 05:09 And the benefit is real?

GEORGE 05:11 Yes. Typing is time away from the patient, and trials have reported documentation time coming down. I'm not going to pretend that isn't valuable. But everything from the last module still applies. It can invent, omit, distort and misattribute, and it reads beautifully while it does.

EMMA 05:29 Is there actual guidance on this, or is everyone making it up?

Cue 2 A checklist of what an organisation should have: safety officer, hazard log, impact assessment, device check, privacy notice

GEORGE 05:34 There's actual guidance. NHS England published it in April 2025 and updated it in July 2026. It's written for the organisations adopting these products, which is useful for you, because it tells you what to ask of yours.

EMMA 05:49 What should my organisation have done?

GEORGE 05:52 Appointed a Clinical Safety Officer. Identified the risks and kept a safety case and hazard log, which is what the standard called DCB0160 asks of a deploying organisation. Done a data protection impact assessment. Checked whether the product counts as a medical device. And updated its privacy information before any recording started.

EMMA 06:12 That's a lot. Would I know if they hadn't?

GEORGE 06:16 You can ask. Who's our Clinical Safety Officer? Is there a hazard log for this? Where does the recording go? If nobody can answer, that's information. It doesn't mean stop. It means ask your manager or your information governance team before you rely on it.

Cue 3 Two columns showing the organisation's responsibility and the clinician's, meeting at the signed entry

EMMA 06:34 And what does the guidance ask of me personally?

GEORGE 06:38 Review and approve every output before it's acted on. You keep an ongoing responsibility to review and revise. And it says plainly that NHS organisations can still be liable for claims. So the organisation answers for the tool, you answer for the entry.

EMMA 06:55 I've also heard people argue these aren't medical devices at all.

GEORGE 06:59 The MHRA clarified that on 29 July 2026. In summary, a product that supports diagnosis or treatment, or acts automatically without a clinician reviewing it, is a medical device. One that only transcribes, summarises, drafts letters or suggests codes for a clinician to review falls outside. Read their statement for the exact words, because this is a summary and positions get updated.

EMMA 07:24 So the line is a human reviewing it.

Cue 4 A line dividing products that only draft for review from products that act or support diagnosis, with a clinician standing on the line

GEORGE 07:27 Exactly. And you're the human. That's the design. Which is why I get nervous when people treat the review as a formality.

EMMA 07:36 Okay, give me the routine. I want something I can do in two minutes.

GEORGE 07:42 Same order every time. Numbers first, doses and frequencies. Then negatives, denied and no and absent. Then sides and sites. Then medicines and allergies. Then who said what. And last, close your eyes and ask what was said that isn't there.

EMMA 07:58 And if I can't verify something?

GEORGE 08:00 Don't sign it. Edit it or remove it. A shorter true note beats a fuller uncertain one.

Cue 5 The six-step checking routine as numbered cards, then a patient conversation in plain words, then an amend-not-delete audit trail

EMMA 08:07 What do I say to the patient? I feel awkward.

GEORGE 08:11 Keep it ordinary. A tool is going to listen and help me write the note. I'll check it. This is where the recording goes. You can say no. Clause 5.2 asks you to make sure people know how and why their information is used. If they say no, follow local policy and write it yourself.

EMMA 08:33 Last one. I find a mistake two days later. What do I do?

GEORGE 08:38 Correct it through the proper route so the history is kept. Don't delete and rewrite. Report it as a patient safety event. And if it touched their care, be open and candid with them under clause 14.

EMMA 08:53 I think I'd be tempted to quietly fix it.

GEORGE 08:57 I know. But a quiet fix looks like falsification later, and clause 10.3 is clear. An error that's caught and reported means the system works. That's the outcome you want.

Cue 1 An approved tool with its assessment, contract and safety case, beside an unapproved one with none

EMMA 09:09 George, I'll confess something. Last month I pasted a messy handover into a free AI tool to tidy it up. No names. Is that all right?

GEORGE 09:19 I'm glad you said it, because you're far from alone. And no, probably not. Two questions. Had your organisation approved that tool for that use? And was it really anonymous?

EMMA 09:31 Not approved, as far as I know. And I took the name out.

GEORGE 09:36 Take the first one. An approved tool has been assessed. There's an impact assessment, a contract saying what the supplier may do with the information, a safety case. A free tool you found yourself has none of that, and its terms may allow your input to be kept or used. Your organisation's data protection doesn't extend to it.

Cue 2 A list of identifiers building up on a person until they can be recognised

EMMA 10:00 People call that shadow AI, don't they?

GEORGE 10:02 They do, and it's the risk that's growing fastest, mostly because the people doing it are conscientious, trying to save time, not careless.

EMMA 10:12 And the second question? I took the name out.

GEORGE 10:15 A name is the obvious identifier, and far from the only one. Initials, a date of birth, an NHS number, an address, a ward plus an admission date, a rare diagnosis in a small community. Several together almost always identify someone.

Cue 3 A 72 hour clock starting when the organisation becomes aware, with the learner's report speeding it up

EMMA 10:32 So taking the name out isn't enough.

GEORGE 10:34 No. The test is whether somebody who knows the person, or has other information, could work out who it is. If they could, it's still personal data, the UK GDPR still applies, and so does clause 5 of the Code.

EMMA 10:50 Right. So what should I do about last month?

GEORGE 10:54 Tell your manager and your information governance team now. Don't wait and don't quietly fix it. They have to assess whether it's reportable to the Information Commissioner, and where it is, the deadline is 72 hours from when the organisation became aware.

Cue 4 A tool being tested on a narrow group and then used on a wider one, with the gap marked

EMMA 11:11 So the clock starts when they know, not when I did it.

GEORGE 11:16 Yes, which is exactly why telling them early matters. Every hour you wait comes off theirs. And prompt reporting is treated completely differently from concealment. If you're worried about the reaction, Freedom to Speak Up exists for that.

EMMA 11:31 Okay. Moving on, because I want to ask about bias. Isn't that a bit abstract?

GEORGE 11:37 It can be, so let me give you a concrete one. The independent review of equity in medical devices, published in March 2024, found that pulse oximeters can overestimate oxygen levels in people with darker skin. And it warned AI-enabled devices carry a similar risk if they're built and tested on unrepresentative data.

Cue 5 A concern moving from a clinician to a manager, a report and a speaking up guardian, then a reflective account

EMMA 11:58 That's not an AI tool, though.

GEORGE 12:00 No, which is why it's useful. It shows the mechanism. If a group was thin in the data, the tool works less well for them, and nobody has to have intended it. A tool that reassures you about a patient it measured badly is worse than no tool.

EMMA 12:20 Does it apply to scribes?

GEORGE 12:22 Directly. If a scribe handles an accent or a second language less well, the notes for those patients will be worse and look just as confident. So ask of any tool who it was built and tested on, and whether it works as well for the patient in front of you.

EMMA 12:42 And if I think something's wrong?

GEORGE 12:44 Say so. The Code asks you to raise concerns where people may be at risk. Tell your manager, report it as a patient safety event, or go to your Freedom to Speak Up Guardian. A concern raised early is the cheapest safety control an organisation has.

EMMA 13:03 And can I use all this for revalidation?

GEORGE 13:06 Yes, carefully. This course alone is non-participatory CPD. If you then discuss it at a team meeting or journal club, that discussion is participatory. A reflective account might describe a draft that was wrong, what you changed in how you check, and the Code clause it links to. With no patient identifiable, ever.