The short version
- Don't put residents' or children's personal information into a free AI chatbot.
- Decide which tools are approved, what never goes in, and who checks the output.
- Keep a named person responsible for every record. AI drafts; people decide.
- Start with low-risk admin, like meeting actions and rota shortlists, before anything involving personal data.
Your staff are probably already using it
Ask around your service and you'll likely find someone using ChatGPT or a similar tool on their phone. Maybe to tidy up a daily log, word a tricky email to a family, or summarise a long policy.
Usually they're trying to save time on paperwork, which is fair. The risk is that nobody has said what's allowed, so personal information may already be going into tools nobody has checked.
Banning AI rarely stops it. It just moves it somewhere you can't see. The safer move is to bring it into the open with a few clear rules.
What's safe, and what isn't
The main question is what goes into the tool. Free versions of AI chatbots may keep what you type and use it to improve their models, depending on the tool and your settings. Health and care information counts as special category data under UK GDPR, which needs extra protection.
| Task | Free public chatbot | Approved business tool |
|---|---|---|
| Drafting a policy outline or a training quiz | Fine | Fine |
| Rewording a general email with no names in it | Fine | Fine |
| Summarising meeting notes with staff names | Avoid | With care |
| Tidying a daily log or incident record | Never | Only if approved for this |
| Anything with a resident's or child's health details | Never | Only if approved, with a data protection check first |
"Approved" means someone in your organisation has checked where the data goes, whether it's used for training, and whether there's a proper agreement with the provider. If you're unsure, treat a tool as not approved.
Five rules to work to
These are the rules we teach on our AI apprenticeship for care providers. They work for any service.
- The people you support come first. If using AI doesn't improve someone's care or day, it isn't worth doing.
- A named person makes the final decision. AI can draft. A responsible member of staff reviews and signs off.
- No personal data in unapproved tools. Ever. This is the one that matters most.
- People's words stay their own. AI can fix structure and spelling. It must never soften or reinterpret what a child or resident actually said.
- Be open about it. Families, commissioners and inspectors should be able to find out where AI is used and why.
Running a care service? We train one person on your team to put these rules into practice. See how the AI apprenticeship works →
What to put in a care home AI policy
Your AI policy doesn't need to be long. One or two pages that staff will actually read is better than twenty that sit in a folder. Cover:
- Approved tools: which ones, and what each may be used for.
- Never put in: names, dates of birth, health details, addresses, photos, or anything that identifies someone, unless the tool is approved for it.
- Checking: who reviews AI output before it becomes a record or is sent to anyone.
- Accuracy: AI can state wrong things confidently. Staff check facts against the source.
- Data protection: a data protection impact assessment before any new tool touches personal data.
- Who to ask: a named person staff can go to with questions.
- Review date: tools change quickly, so look at the policy again every six months.
The Department of Health and Social Care's guidance on using AI in adult social care (September 2026) recommends exactly this: an AI policy shared with all staff, a person reviewing every AI output, and no personal information in free online tools. For the legal side, the Information Commissioner's Office (ico.org.uk) publishes guidance on AI and data protection.
Where to start: three low-risk jobs
1. Meeting actions
Turn rough team meeting notes into a list of actions with an owner and a date. Remove anyone's personal details first, or use an approved tool.
2. Training and policy drafts
Ask AI for a first draft of a quiz on a policy, or a plain-English summary of a long document for new starters. A manager checks it before it's used.
3. Rota shortlists
With an approved setup, AI can list who is available, trained and within their hours when someone calls in sick. You still decide who covers.
Who should own AI in your service?
Most of the risk comes from AI being nobody's job. The government guidance suggests appointing "digital champions" for exactly this reason. One trained person who knows your service, your rules and the tools can set things up properly, answer staff questions and spot where AI genuinely saves time.
That's what our Level 4 AI apprenticeship for care providers is for. It trains someone already on your team over 15 to 18 months, with data protection built in from the start. It's up to 95% government-funded for employers who don't pay the apprenticeship levy.
Quick answers
Can care staff use ChatGPT at work?
Only for tasks that involve no personal information, such as drafting a policy outline or a training quiz, unless your organisation has approved a business tool for more. Government guidance for adult social care says personal information should not go into free or online AI tools.
Is ChatGPT GDPR compliant for care homes?
The free version isn't suitable for residents' or children's personal data, because there's no contract controlling how that data is handled. Business versions may be, but only after your organisation checks where data goes, whether it's used for training, and completes a data protection impact assessment.
Do care homes need an AI policy?
Department of Health and Social Care guidance recommends that adult social care providers have an AI policy shared with all staff, even if the policy is that staff can't use AI for work. It's also a clear way to show inspectors you manage the risk.
This guide is general information, not legal advice. Check your own obligations with your data protection lead.