A doctor, employer, healthcare provider or developer may face responsibility when healthcare AI contributes to harm, depending on what happened and the applicable law. Doctors retain professional accountability for their decisions, but that does not mean they are always the only potential defendant. Professional accountability and civil liability must be analysed separately.
Originally published on 24 March 2026 and updated on 10 October 2026, this article retains the practical focus of the earlier guide while correcting its implication that legal liability necessarily rests with the doctor alone. The negligence discussion focuses on England and Wales; GMC standards apply across the UK. Individual claims, contracts and indemnity arrangements require case-specific advice.
The Legal Framework for Clinical Negligence in England and Wales
A clinical negligence claim requires an applicable duty of care, a breach of that duty and legally sufficient causation of actionable harm. An incorrect output is not, on its own, proof of all those elements. The assessment concerns what the relevant person or organisation did, what standard applied and how the alleged failure affected the patient.
For diagnosis and treatment, the familiar Bolam and Bolitho principles concern responsible professional practice and whether the supporting reasoning withstands logical scrutiny. They do not mean that any opinion offered by a clinician automatically resolves the question. The Supreme Court's discussion in Montgomery v Lanarkshire Health Board, decided in 2015, explains the distinction between professional judgement and the duty to discuss material risks and reasonable alternatives.
Materiality is not limited to an abstract reasonable patient. It also includes a risk the doctor knows, or should reasonably know, this particular patient would consider significant. McCulloch v Forth Valley Health Board, decided in 2023, further addresses identifying reasonable alternative treatments. Neither decision establishes that mentioning AI is always, or never, required in every consultation; the facts and relevant professional guidance matter.
The earlier guide used the example of a surgeon working with a faulty instrument. That remains a useful distinction if completed properly: the surgeon's conduct can be assessed, but a defect may also raise questions for the manufacturer or organisation. Similarly, a GP acting on an incorrect AI management recommendation may need to justify their decision without excluding a separate claim concerning unsafe design or deployment.
The software itself is not a registered medical practitioner and does not hold a doctor's professional indemnity or face a GMC fitness-to-practise hearing. That does not make the company supplying it legally invisible. The MDU's April 2024 discussion of AI expressly considers potential claims involving developers, users or both.
What the GMC Expects
The GMC's AI guidance, checked on 10 October 2026, maintains doctors' responsibility for their decisions and separately recognises responsibilities associated with creating, testing and updating technology. It also directs doctors to raise concerns about unsafe use. That is a more complete account than saying that every consequence belongs solely to the person at the keyboard.
The historical adoption figure in the original article should also be read precisely. The GMC's February 2025 research update refers to an October 2024 study of nearly 1,000 doctors in which 29% reported AI use in the preceding 12 months. This is not a current October 2026 adoption estimate. The accompanying qualitative work raised questions about guidance, risks and the practical experience of use; it should not become an invented population-wide measure of inadequate training.
In practice, clinicians should understand the tool's relevant limits, maintain their competence and be able to explain consequential decisions. That does not require knowing every detail of a model's engineering. It does require recognising when the information, intended use or verification process is insufficient for the task.
What Defence Organisations Advise
The MDU, Medical Protection and MDDUS have each published material on AI and professional responsibility. Their discussions should be read in their own terms rather than treated as identical insurance promises. Medical Protection's June 2026 warning about gaps between AI and liability arrangements is a policy concern, not a judgment that developers can never be liable. MDDUS's August 2026 discussion likewise addresses the allocation problem when an algorithm is wrong.
The practical questions remain due diligence, verification, documentation, confidentiality and appropriate support. A source-linked answer can help locate evidence, but the clinician must still consider what the passage actually supports and whether it applies. An approved tool can still produce a wrong answer, and an unapproved workflow can create governance problems even when its output happens to be correct.
Keep advice and cover separate. Membership of a defence organisation, employer indemnity and a particular negligence scheme may address different circumstances. Obtain a written answer describing the actual workflow, including private or locum work where relevant, rather than assuming that a general statement about AI settles every use.
Three Hypothetical Cases: Different Failures, Different Questions
In the first fictional case, a clinician receives an incorrect recommendation, has access to contradictory information and acts without resolving the discrepancy. The clinical decision and verification process would be relevant. So might the product's representations, source handling and intended use. The presence of a clinician does not establish that the product played no legally relevant role.
In the second, an organisation configures a system so that a draft is written to the wrong patient's record. The clinician's screen does not reveal the mismatch. The assessment would need to examine integration design, testing, permissions, local acceptance and the user's reasonable opportunity to detect the problem. It would be inadequate simply to point to the name on the finished note.
In the third, a supplier issues a clear warning about a consequential defect, but the organisation fails to communicate or act on it. A subsequent incident would raise questions about organisational response as well as the original defect and individual conduct. Conversely, a warning that was buried, ambiguous or not applicable to the installed version would require a different analysis.
These are teaching scenarios, not reported incidents or predictions of litigation outcomes. In each, evidence about control, knowledge, reasonable action and causation matters more than a slogan about who is "in the loop".
The Spectrum of Risk
The earlier guide grouped use into lower, moderate, higher and highest-risk patterns. Those labels are an illustrative way to examine safeguards, not a validated hierarchy of legal exposure or a ranking of brands.
A relatively bounded reference workflow starts with an appropriate question, a visible source and independent application to the patient. Citations and regulatory status do not create immunity. A reviewed ambient-scribe workflow introduces different risks: recording meaning accurately, preserving uncertainty and preventing incorrect material from entering the record. Its safety depends on meaningful review, not merely a signature.
Acting on an unverified general-purpose AI answer is more concerning than treating it as a starting point for investigation. The earlier version named ChatGPT and Gemini; the relevant distinction is the actual configuration, sources, intended purpose and workflow, not an assumption that every general-purpose system lacks retrieval or can only generate unsupported text.
Particularly concerning patterns include identifiable information entered into an unapproved service, prescribing decisions accepted without appropriate medicines verification and consequential recommendations adopted without adequate assessment. These can combine clinical, confidentiality and organisational failures. They do not allow an article to determine liability before the facts are known.
Practical Steps to Protect Yourself
Choose tools by their precise intended purpose, evidence, data handling and limitations. The earlier version described iatroX's UK guideline features as UKCA-marked and MHRA-registered. As checked on 10 October 2026, iatroX's clinical AI standards page describes its UK reference-tool component as an MHRA-registered Class I medical device. Those are scoped platform statements; this article does not independently verify a conformity filing or extend that status to every educational feature. Registration is not proof that each output is correct.
Before a recommendation influences care, inspect the relevant NICE or CKS guidance, an appropriate SmPC on emc, or applicable specialty and local guidance. iatroX's published methodology describes retrieval and source-grounding as design features intended to support that process. It does not establish a measured guarantee of frictionless verification or superior clinical outcomes.
Document the material clinical reasoning: what mattered, what was checked, what remained uncertain and why the plan was chosen. Do not substitute an unedited chatbot transcript for an account of the consultation. Equally, do not inflate the note with irrelevant technical detail that obscures the decision.
Protect confidentiality. Names, NHS numbers and dates of birth are obvious identifiers, but combinations of occupation, circumstances, timing and unusual history can also identify someone. Follow the approved pathway for patient information rather than assuming that removing a name resolves the issue.
Maintain knowledge and seek supervision where needed. As described in iatroX's question-bank material checked on 10 October 2026, spaced repetition and question practice are available learning formats. They are not proven protection against litigation, nor a substitute for supervised clinical experience. Continue reviewing current GMC, college and defence-organisation guidance relevant to the actual work.
The Future Direction
The original article anticipated developing case law. It should not be read as an exhaustive claim that no relevant case exists or as a prediction that one future judgment will resolve every healthcare AI dispute.
A concrete current development is the Law Commission's product-liability consultation, opened on 8 October 2026 and running until 14 January 2027. It considers changes relevant to software, AI and difficulties establishing responsibility. These are proposals under consultation, not enacted rules that have already determined an AI-related clinical claim.
Organisations should therefore preserve the evidence needed to explain what happened: the relevant product version, configuration, inputs, outputs, approvals and external actions. Retention should be arranged through appropriate governance processes, not through personal copies of patient information.
Conclusion
AI does not absorb a doctor's professional judgement or excuse careless use. Nor does the doctor's involvement automatically erase potential responsibility elsewhere. The stronger question is which person or organisation controlled the relevant activity, what obligations applied, what failed and how that failure contributed to harm.
Verification, appropriate documentation, competence and sound deployment can support better practice. They are not a promise of immunity or proof that all risks are avoidable. The software is not itself a human co-defendant, but the organisations developing and deploying it may be legally relevant.
Turn This Clinical Topic Into Active Learning
A useful educational exercise is to review the three fictional cases, identify the missing facts and explain which evidence would change the assessment. As checked on 10 October 2026, iatroX's CPD tools combine learning activities with a draft record for the learner to review and personalise, including suggested framework mapping. CPD is included in the paid all-access subscription, not a separate add-on; a learning record is not accredited legal training or advice on an individual claim.
Frequently asked questions
Is the doctor always solely liable when healthcare AI causes harm?
No. Professional accountability for a clinical decision does not exclude possible liability involving an employer, healthcare provider or developer, depending on the facts and applicable law.
Does using a regulated or source-linked AI tool prevent a negligence claim?
No. Intended scope, evidence and source access are relevant considerations, but neither regulatory status nor citations establish that a particular decision was appropriate.
What should a clinician do after a possible AI-related error?
Prioritise the patient's care, report through the appropriate organisational route and seek relevant advice. Preserve necessary evidence through approved processes rather than retaining patient material in personal accounts.
Explore this topic through a reviewed CPD learning activity →