The care provider should organise an immediate clinical response and a clear explanation, while the relevant organisational and supplier teams investigate their parts of the incident. The patient should not have to identify which algorithm or contract failed before receiving help. Complaints, safety reporting, compensation and professional-regulatory processes remain distinct, even when they concern the same event.
This article is dated 10 October 2026. The provider-regulation discussion concerns England, while professional standards may apply across the UK. CQC guidance on Regulation 20 distinguishes the statutory duty of candour from professional duties and identifies additional requirements for notifiable safety incidents. Not every AI error automatically meets that specific threshold.
Begin with the patient's current needs
Imagine a fictional patient whose follow-up was delayed after an AI-generated summary incorrectly described an outstanding result as already reviewed. The patient now needs an assessment of the delay, clarification of the plan and a reliable route to further care.
The first response should not be a technical explanation of how language models work. Establish what is known, what clinical action is needed and who will coordinate it. A supplier investigation may take time; appropriate care should not be made conditional on its completion.
Also consider whether others may be affected. The same configuration could have influenced additional records, or the event could be confined to one unusual encounter. Both possibilities require assessment. Avoid reassuring the patient that the problem was isolated before the organisation has evidence to support that conclusion.
Give the patient a named route, not a list of organisations
A proposed response pathway should identify a clinical contact, an organisational incident lead and the route for complaints or further questions. Those roles may be held by different people, but the patient should not have to coordinate them.
Explain what each process can do. The clinical team addresses current care. The incident process examines what happened and how to reduce recurrence. A complaint allows the patient to raise concerns about the service and its response. A compensation claim raises legal questions that are not decided simply by recording an incident.
A referral to the supplier's support desk is not, by itself, a patient-care response. The supplier may hold essential technical evidence and need to correct a product defect. The healthcare organisation still needs to coordinate the clinical consequences and communication within its responsibilities.
Be open about facts and uncertainty
The GMC and NMC professional duty-of-candour guidance, checked on 10 October 2026, addresses explaining and recording what went wrong, apologising and reporting errors. It is relevant even when the precise technical cause is still being investigated.
A useful initial explanation distinguishes the event from the proposed cause: "The record described a task as completed when it was not. We are checking how that happened and have arranged the necessary review." This fictional wording avoids blaming a model before the facts are established while still acknowledging the problem.
Where the statutory duty applies, follow its specific requirements rather than assuming that an informal conversation completes the process. CQC's guidance also makes clear that an apology is not an admission of liability. Openness should not be delayed while parties negotiate a final allocation of fault.
Keep the different routes to redress intelligible
The following table is an explanatory framework, not a substitute for the applicable local or legal process.
| Route | Main question | What it does not automatically establish |
|---|---|---|
| Clinical remediation | What care or correction is needed now? | Who is legally liable |
| Complaint | How should the service address the patient's concerns? | That compensation is owed |
| Patient-safety response | What happened and what should change? | A disciplinary finding against an individual |
| Information-governance response | Was information handled unlawfully or insecurely? | That every clinical error was a data breach |
| Compensation claim | Are the legal requirements for redress met? | That a regulator must sanction someone |
| Professional-regulatory process | Is there a relevant concern about professional practice? | The resolution of every organisational or product issue |
Several routes may operate together. The patient should be told which are active, what information is being shared and how further questions can be raised. Avoid presenting one route as the only legitimate option merely because it is the organisation's preferred process.
Investigate the whole chain without assigning blame in advance
In the fictional follow-up case, examine the original result, the source record, the generated summary, any clinician edits and the system that marked the task complete. A technically correct summary of an incorrect source and a fabricated completion statement require different remedies.
Review the environment too. Could the clinician see the outstanding status? Did the interface distinguish a suggestion from a completed action? Did the receiving team receive an alert? The review should not stop at the fact that a human clicked approval.
HSSIB's October 2025 investigation concerning implementation of the Patient Safety Incident Response Framework provides background on learning-focused organisational responses. It is not a special legal framework assigning liability for AI. An investigation should answer the safety questions without pretending to decide every separate contractual or legal dispute.
Correct the record and the consequences
Amending one note may not correct a referral, patient message or later summary derived from it. The response should identify the destinations that received the inaccurate information and assess which require amendment or contact.
Preserve the distinction between the original entry and the correction. A later reader needs to understand what changed and why. The organisation should also check whether the patient has already acted on the earlier information; an updated screen does not undo an action taken outside the system.
Where personal information may have been improperly disclosed or altered, involve the information-governance team. ICO breach guidance addresses assessment and reporting requirements for personal-data incidents. Do not assume that an internal patient-safety report alone completes those obligations.
Make the improvement visible to the people affected
A proposed closing response should explain the established findings, remaining uncertainty, care changes and relevant system changes in language the patient can understand. It should distinguish an immediate workaround from a tested longer-term correction.
An organisation might restrict an affected function, revise review arrangements or require additional supplier evidence. The patient does not need confidential commercial detail, but should not receive an empty assurance that lessons have been learned. Explain what has actually changed and how its effectiveness will be checked.
For clinicians, an incident may also reveal a learning need. A fictional or generalised exercise can help examine the clinical reasoning without transferring the patient's case into an unrelated learning service. iatroX can be considered for the educational task within its published scope, not as the place to conduct an unauthorised investigation or determine compensation.
A patient-centred response keeps these strands connected without confusing them: care first, honest communication, appropriate evidence, accountable investigation and accessible redress.
Frequently asked questions
Should a patient be directed to the AI supplier after an error?
The supplier may need to investigate, but the healthcare provider should coordinate the clinical response within its responsibilities. The patient should not have to resolve the technical supply chain before receiving care or an explanation.
Does every AI mistake trigger the statutory duty of candour?
Not every mistake meets the specific notifiable-incident threshold. General openness and relevant professional duties still matter, and the organisation should assess the applicable requirements.
Does correcting an AI-generated note complete the response?
Not necessarily; earlier versions may already have influenced other records, messages or care. The response should assess and address the relevant downstream consequences.