Is an AI Receptionist Safe for GP Practices?

Yes, an AI receptionist can be safe for a GP practice, provided it is built for primary care and backed by the right regulation, clinical safety and data protection evidence. The safe ones are registered with the MHRA, meet DTAC, DCB0129 and DSPT, never make clinical decisions, signpost emergencies to 999 or 111 and hand over to a person whenever a call needs one. Before you sign anything, ask the supplier to show you that evidence in writing.

This guide explains what each standard means, what to ask, and ends with a checklist for supplier meetings.

What makes an AI receptionist safe or unsafe?

Safety is less about the technology and more about how it is governed. An AI receptionist answers calls, follows your call flows, captures information and books or routes requests. The risks come from what happens at the edges:

• a patient describes urgent symptoms and is not signposted quickly
• a call that needs a human gets stuck with AI
• patient data is stored or shared without the right controls
• there is no record of what was said, so nobody can check or learn from a call

A safe supplier designs for each of these and can prove it. To understand the basics first, read how an AI receptionist works.

Which regulations and standards should you check?

Is it registered with the MHRA as a medical device?

There is a grey area here. Some suppliers say an AI receptionist is purely administrative. Others point out that once software guides a patient’s care journey, even by following agreed triage or signposting steps, it may count as a medical device. Ask the supplier for its position and, if it says it is registered, ask for proof of MHRA registration.

InTouchNow chose to register as a Class I medical device, even though AI is a non-clinical, administrative tool. You can read why in our post on certification and what it means for you.

Has it passed DTAC?

The Digital Technology Assessment Criteria (DTAC) is the NHS baseline for digital health tools. It covers clinical safety, data protection, technical security, interoperability and usability. Ask for the supplier’s completed DTAC and check the date on it.

Does it meet DCB0129, and can you meet DCB0160?

DCB0129 is the clinical risk management standard for manufacturers. The supplier should have a named Clinical Safety Officer, a clinical safety case and a hazard log. DCB0160 is the matching standard for the organisation deploying the system, which means your practice. A good supplier will give you the documents you need to complete your own DCB0160 work rather than leaving you to start from scratch.

Does it have a DSPT submission?

Any organisation with access to NHS patient data should complete the Data Security and Protection Toolkit (DSPT). Ask for the supplier’s organisation code so you can look it up yourself.

Is an AI receptionist GDPR compliant in the UK?

It can be, but compliance depends on the supplier and on your setup. Check that:

• the supplier acts as a Data Processor and your practice remains the Data Controller
• there is a signed Data Processing Agreement (DPA)
• the supplier is registered with the ICO
• you complete a Data Protection Impact Assessment (DPIA) before going live, with your Data Protection Officer involved
• you know where data is stored, how long recordings are kept and who can access them
• your privacy notice tells patients that calls may be handled by AI

What about wider security certification?

Cyber Essentials is a sensible minimum. ISO/IEC 27001:2022 (information security) is a stronger signal, and ISO 22301 (business continuity) tells you the supplier has planned for outages.

How should AI handle emergencies?

This is the question that matters most. AI should never judge urgency or give medical advice. Instead, look for:

• Red-flag checks built into the conversation, not just at the start
• Immediate 999 or 111 signposting when red-flag symptoms are described
• Safety-netting given as standard at the end of the call
• A record of the signposting on the call transcript
• Escalation to your team for anything outside your protocol

On InTouchNow Total Triage, red-flag symptoms are checked as the call goes on, anything urgent is signposted to 999 or 111 immediately, and the safety-netting given is recorded on the transcript. Triage decisions stay with your clinicians.

Can patients still speak to a person?

They should always be able to. A safe AI receptionist introduces itself as a digital assistant, never pretends to be human and transfers the call when a patient asks for a person or when a call needs nuance, empathy or discretion. Ask how the transfer works, where it goes and whether the context is passed across so the patient does not have to repeat themselves.

With InTouchNow, calls AI can’t complete are transferred to your practice team, in line with your rules, with the full context passed across. You keep your existing number and IVR, with a transfer-back line to reception, as explained in our FAQs.

Why do recordings and audit trails matter?

A human receptionist’s phone call often leaves no record beyond a note. AI can do better. Every call can be recorded and transcribed, giving you clear evidence of what was asked, when and how it was handled. That helps with complaints, significant event reviews, training and clinical governance.

Ask whether you can listen back to any call, how quickly you can find it and whether the supplier reviews call data with you to improve your flows.

How do you adopt AI safely in a medical practice?

1. Start with your problem. Be clear whether you are tackling the 8am rush, triage, booking or out-of-hours demand.
2. Collect the evidence. Request the supplier’s information governance pack, clinical safety case and hazard log.
3. Do your own paperwork. Complete a DPIA and your DCB0160 assessment, and update your privacy notice.
4. Configure to your rules. Call flows, triage questions and booking rules should mirror your local policies.
5. Test before go-live. Ring the system yourself and try awkward scenarios, including emergencies and requests for a person.
6. Review regularly. Listen to a sample of calls each week at first, and log any issues.

Checklist: questions to ask any AI receptionist supplier

How does InTouchNow meet these standards?

InTouchNow is built only for primary care and is used by 150+ practices (see our AI receptionist for GP practices page). According to our clinical safety and compliance page and FAQs, our compliance includes:

• MHRA Class I medical device registration
• DCB0129 and DCB0160 clinical safety standards, with an NHS-accredited Clinical Safety Officer and an in-house Data Protection Officer
• NHS DTAC
• DSPT (J7V5S) and ICO registration (ZB496965)
• UK GDPR and the Data Protection Act 2018, acting as Data Processor under a signed DPA
• ISO/IEC 27001:2022, ISO 9001, ISO 22301 and Cyber Essentials

Every deployment is risk assessed and maintained within our clinical safety case, including hazard logs. You can request our Information Governance Pack, and see more detail on our clinical safety and compliance page.

Frequently asked questions