Ambient voice technology in UK adult social care

Until 2025 there was no national position on ambient recording in health or care. There are now five documents and a supplier registry that matter, published by three different bodies, none of them together.

The picture changed sharply on 29 July 2026, when the MHRA published its first guidance on ambient voice technology and NHS England updated its own guidance to version 3 on the same day.^[1],[2] CQC set out its own position on AI two months earlier, on 21 May 2026.^[19] Anything you read about this subject written before August 2026 is describing a different regulatory landscape.

This is the single most useful thing the MHRA published, and it is the question to put to any supplier before anything else. The test is not the technology. It is what the product claims to do.^[2]

Two points deserve emphasis because they catch people out. First, a disclaimer does not save a product whose marketing makes clinical claims: the MHRA says manufacturers “should mitigate risk… by design first or by introducing other protection measures before considering warnings.” Example 7 in the guidance is a product that only summarises, but is marketed as improving patient outcomes — it is a medical device because of the marketing.^[2]

Second, the classification is not trivial. A product that determines “the probability of a patient having a disease or condition based on an analysis of a clinical interaction” and is intended to be relied on is providing decisive information, which puts it at Class IIa and requires an approved body — not the self-declaration route available for standard Class I.^[2],[26]

A pendant or phone recording a care visit is doing two things at once. It is processing a person's special category data, which every document above addresses. It is also recording an employee, continuously, in a workplace that happens to be somebody's living room, which none of them address.

The ICO's employment guidance is unambiguous and it is the sharpest constraint on the whole category:

Read carefully, this is a constraint on continuous and default-on capture, not on purposeful recording of a defined activity with a trigger. That distinction is the whole design brief. A device that records the visit because the carer starts it, and stops when the visit ends, is a different proposition from a device that runs all shift.

Three further points follow. Consent will not be your lawful basis for the staff-facing processing: the ICO says “consent is not usually appropriate in the employment context, due to the imbalance of power between you and your workers.”^[14] A DPIA is not optional — it is required before processing likely to result in high risk, and NHS England separately assesses a DPIA as “highly likely to be a legal requirement” for ambient scribing.^[5],[14] And capture start and stop times are, functionally, timing data about a worker. If you can see them, you are monitoring; decide deliberately whether that is a purpose you are declaring, and never let it become a de facto clock-in you never told anyone about.

The Nuffield Trust's central criticism is worth quoting because it is the one a board should put to any supplier: evaluations “stop at the point of documenting time savings” without establishing what those minutes enable.^[17] Minutes saved is an output. Whether anything changed for the person receiving care is an outcome, and almost nobody has measured it.

The Healthwatch findings matter more in domiciliary care than in a clinic, and in the same direction. Support is finely balanced and skews negative in intensity. Comfort collapses precisely around the subjects that come up in someone's home — mental health, safeguarding, domestic abuse. Disabled respondents were more sceptical than the general population. A home is not a consulting room, and the visit is not a fifteen-minute appointment that ends when the person leaves. Anyone who tells you the evidence for this technology is settled for home care is describing hospital evidence and hoping you do not check the setting.

Not where most vendors suggest — but closer than the sector generally realises. On 21 May 2026 CQC published its position on artificial intelligence, and it names note-taking directly: “writing up notes and consultations, for example in GP and outpatient settings” is listed as a current use.^[19] If you have been told CQC has said nothing about this, that is no longer true.

What it says is measured, and two sentences do most of the work. CQC “do not assess or approve specific technologies.” And: “the absence or presence of AI does not predict a specific rating.”^[19] There is no tick for adopting it and no mark against you for not.

What CQC does set out is eleven expectations of any provider using AI. Six of them are procurement and governance questions you should be able to answer on the day you go live: AI to support, not to replace — “AI can enhance, but not replace human decision making”; human oversight — outputs “continuously monitored and evaluated”; transparency and choice — people have “appropriate information to make informed decisions about their care, including the role of AI in care pathways”; a DPIA; accountability — “clear mechanisms for addressing issues or harm caused by AI”; and procurement “in line with relevant regulatory standards.” The others cover safety, security, fairness, training and governance.^[19]

CQC's separate guidance on surveillance in care services is worth reading alongside it, with a caveat: it covers “CCTV, cameras and microphones,” it recommends taking legal advice, and it says you “will need to tell everyone it affects.”^[22] But it was last updated on 12 August 2025, it does not address people's own homes, and it does not address recording by staff. It was written for a care home lounge, not a domiciliary visit.

Underneath all of it sits the obligation that has not changed: Regulation 17(2)(c) requires you to “maintain securely an accurate, complete and contemporaneous record in respect of each service user.”^[23] Note the first word — in a system built on capturing and processing audio, “securely” is doing as much work as “accurate.” How the record was produced is your business; whether it is right, complete and safely held is the regulator's.

Two pieces of timing are worth holding. The single assessment framework — 34 quality statements, six evidence categories, numerical scoring — remains the live framework being used to assess adult social care providers as at September 2026. A draft sector-specific adult social care framework was published in March 2026, replacing the quality statements with a smaller set of key lines of enquiry, removing scoring, and reintroducing rating characteristics; CQC has confirmed it “will remove scoring from our assessment approach” and that future judgements “will be made holistically using the professional judgement of our inspection teams, informed by evidence and with reference to the rating characteristics and supporting guidance.”^[20] Pilots are running from June to October 2026, with final evaluation in November.^[21] The five key questions and four rating levels survive. CQC has not published an implementation date; end of 2026 is a widely repeated inference from a November evaluation, not a commitment, and you should not plan procurement around it.

The practical consequence for a technology decision: do not buy anything whose value proposition is tied to the 34 quality statements or to a numerical score. Both are on their way out. The things that will still be true in 2027 are Regulation 17, the fundamental standards, and an assessment method that asks what difference the care made to the person — which is a question about the record's substance, not its production method.

Separately: the Data Security and Protection Toolkit is where most providers' actual accountability for this will sit. The 2025-26 edition (version 8) is aligned to the Cyber Assessment Framework version 3.4.^[24] Check the current edition and deadline directly — this one moves.