NHS Communications Artificial Intelligence Operating Framework v2

This operating framework supports NHS communications and engagement professionals to explore and adopt artificial intelligence (AI) in a way that is ethical and effective, and promotes trust, inclusion and transparency.

It offers clear, practical guidance to empower the responsible use of AI tools and technologies, enabling NHS communications and engagement teams to build capability, develop confidence and collaborate effectively with IT, digital, information governance and clinical colleagues. This framework is designed to help professionals advocate for safe access to AI platforms and tools that can enhance patient engagement, improve efficiency and drive more personalised communication.

This is not a policy document, nor a replacement for local protocols. Instead, it offers a shared foundation that NHS communicators can adapt and apply based on local needs, in partnership with other key stakeholders within their organisation. It will be updated regularly (at least every 12 months) to reflect changes in technology, regulation and best practice.

This framework forms part of the NHS Communications AI Taskforce’s national priorities, supported by the NHS Alliance.

The NHS is committed to remaining at the forefront of responsible artificial intelligence (AI) adoption to ensure its ethical, effective and trusted implementation.

This operating framework provides clear guidelines for the use of AI systems within NHS communications. Its purpose is to ensure the protection of personal data, uphold ethical standards, manage potential risks and enable the effective and responsible use of AI tools to enhance communication efforts.  

This document guides the effective deployment, management and governance of AI systems to support improved communications within the NHS. This is not an official policy document, but it will provide useful guidance to NHS communications professionals. It should be used in conjunction with local organisational policies and procedures on AI.

It is important to note that this framework is not exhaustive and will require periodic updates (at least every 12 months) to reflect technological advancements, evolving regulatory frameworks, and emerging best practices in AI governance. This is the second version of the framework; the first was published in October 2025. 

The rapidly evolving landscape of healthcare presents significant opportunities for AI technologies to transform patient care, streamline administrative functions, improve overall operational efficiency and enhance the way the NHS communicates with staff and patients. The NHS recognises the potential of AI and is committed to its ethical, transparent, and responsible use.

The purpose of this framework is to establish clear guidelines for the development, implementation and monitoring of AI systems to protect personal data, uphold ethical standards and mitigate potential risks. It is essential that AI is used in a manner that complies with legal and regulatory requirements, respects patients’ rights and maintains the trust and confidence of our patients, staff and stakeholders.

NHS organisations and their communications teams are encouraged to actively adopt the principles outlined within this framework. They should work collaboratively with their local digital and information governance teams, as well as other relevant departments, to ensure that the implementation of AI within communications meets the specific needs of their staff, patients, and the wider population they serve. This collaborative approach will help tailor the framework’s guidance to local contexts and existing policies.

This framework outlines the key principles and procedures that should be followed when deploying or using AI technologies. By implementing these guidelines, the NHS aims to foster a culture of responsible AI use that maximises its benefits while minimising potential risks, especially in communications.

Ethical use of AI grounds the thinking throughout this document. With that in mind, this latest version of the operating framework includes a dedicated section on the ethical use of AI in NHS communications, with links to practical tools that teams may find helpful.

A glossary of AI-related terms and how they apply to communications, is available in section 14 of this framework.

In September 2026, the National Commission into the Regulation of AI in Healthcare, commissioned by the MHRA, concluded that public support for AI in healthcare is strong but conditional on organisations demonstrating transparency, accountability, human oversight and clear governance arrangements. The commission emphasised that trust in AI cannot be assumed and must be actively earned through safe, responsible and transparent use.

For NHS communications teams, this reinforces the importance of maintaining clear human accountability for all AI-assisted outputs, ensuring appropriate transparency when AI is used, investing in AI literacy and capability, monitoring the impact of AI-enabled activities, and considering inclusion, accessibility and public confidence in all deployments. These principles align closely with those set out in this operating framework.

As national policy, regulation and assurance arrangements continue to develop, future editions of this operating framework are expected to provide more detailed guidance on transparency, accountability, workforce capability, incident reporting, public engagement and governance requirements, reflecting emerging guidance from the MHRA, NHS organisations and wider regulators

Five principles for NHS communications

1. Human accountability always remains
   AI can support, draft and advise, but responsibility for decisions, content and communications outcomes always rests with people.
2. Transparency builds trust
   Communicators should be open and proportionate about the use of AI, particularly where it influences public-facing content, interactions or decision-making.
3. AI literacy is becoming a core professional skill
   Communications professionals should understand the capabilities, limitations, risks and ethical considerations associated with AI tools and services.
4. Governance matters more than the tool
   Safe and effective use of AI depends on robust governance, oversight, risk management and clear policies, regardless of which technology is used.
5. Monitor, learn and continuously improve
   Organisations should regularly review performance, identify risks, learn from experience and adapt their use of AI as technologies, evidence and public expectations evolve.

The following principles provide practical guidance for applying the five overarching principles set out above.

• Fairness and inclusiveness
  AI should support equitable and accessible communications for all audiences. Communications teams should take reasonable steps to identify and mitigate bias, ensure accessibility and avoid reinforcing stereotypes or discrimination.
• Reliability and safety
  AI-generated content should be reviewed to ensure it is accurate, appropriate and safe before publication or use. Particular care should be taken where outputs may influence patient, public or staff understanding.
• Human oversight
  AI outputs should always be treated as drafts requiring human review. Communications professionals remain responsible for verifying facts, checking sources and exercising professional judgement before publication.
• Privacy and security
  AI tools should be used in accordance with organisational information governance, data protection and cyber security requirements. Appropriate advice should be sought from digital, information governance and security teams where required.
• Transparency
  The use of AI should be clear and appropriately disclosed where it materially influences public-facing content, interactions or decisions. Openness helps maintain public confidence and trust.
• Accountability
  Responsibility for communications activity always rests with people, not technology. Organisations should ensure clear ownership, oversight and governance arrangements for the use of AI.

While collaboration across various roles is essential for responsible AI use, there are some duties, accountabilities and responsibilities that are specifically for communications.

Director of communications (responsible director): Oversees the strategic direction and responsible implementation of AI within the communications function.

Communications and engagement teams:

• Ensure all communications related to AI are transparent, accurate, and easily understandable for staff, patients, and the public.
• Develop and implement communication plans for AI initiatives, ensuring stakeholder engagement and addressing concerns.
• Provide clear guidance to staff on appropriate and responsible use of AI tools in their daily communication tasks.
• Collaborate with information governance and IT security on communications regarding data privacy and security of AI systems.
• Conduct patient and public engagement activities that include determining if individuals support the use of data for your intended purpose, or if they have any concerns on how their data will be used.
• Ensure any communication content generated by AI, including images, is thoroughly verified for accuracy, bias, and compliance with NHS standards before dissemination. Special attention should be paid to guarding against unintended bias in AI-generated images to ensure fair and equitable representation across all demographics.
• Be aware of any copyright and intellectual property considerations when using generative AI for content creation.
• Understand that any AI-generated information may be requested under information access rights, including providing an explanation of how and why any new personal information was created. 

All communications employees and authorised users:

• Familiarise themselves with and adhere to the organisation’s information governance and security policies, protocols and guidelines.
• Use AI systems in accordance with established guidelines and protocols.
• Report any concerns or issues related to AI system performance or safety to the organisations data protection officer.
• Provide feedback and insights on the effectiveness, usability and impact of AI technologies in their communication work. 
• Do not enter sensitive information (such as personal details or company intellectual property) into chatbots, and not to perform queries that could be problematic if made public. For example, sharing confidential information and asking ChatGPT to solve a personal/professional dilemma. These tools should only be used for non-clinical purposes.
• You should inform your organisation’s information governance team where you intend to use these services routinely as part of your work.
• Be aware of any potential ethical considerations when using these products, including the potential to propagate biased, discriminatory or harmful content.
• Be aware that you will need to verify any output of these products to ensure accuracy.
• AI software used for work purposes should only be accessed via corporate devices.

The procurement or installation of any software should not take place without explicit permission from your IT department. 

6.1 Defining purpose and identifying legal basis for AI use

• Generative AI can be used in many ways to enhance the work of the organisation. It is important that the purpose and use of AI is clearly defined and agreed, including why AI is being used and what value it will bring to the organisation.
• You should also determine with your organisation’s information governance team if a lawful basis (processing reason) for the use of data is required before any data is processed. Where possible, any data should be anonymous so a lawful basis would not be required. However, it is important that data and use cases are carefully assessed to determine if individuals can be identified using the contents of the information even if common identifiers such as name, address and phone number are removed. For example, the combined details of a local area, a rare condition and a very young age may enable a patient to be identified. In such cases you would need to treat this as personal data and therefore identify a lawful basis for the processing, along with meeting the requirements of the common law duty of confidentiality.
• The above requirements also apply to data used to test and develop AI systems even if there is no outcome or decision for an individual. This is because you are processing data by using it to train/inform AI models or algorithms. 

6.2 Freely available AI apps and services (eg. ChatGPT, CoPilot, Claude, Gemini)

• AI is a feature of many applications currently used by staff, including apps within MS Teams. It is important to use AI appropriately and responsibly to ensure that it does not compromise personal data or business sensitive information, violate policies, or pose a risk to patient safety or our network integrity.
• The framework recommends caution when using freely available AI software based on large language models (LLMs) such as ChatGPT, Claude and Gemini. Although it can be used in the same way you might use different sources to kickstart a research project or better understand what people are saying about a topic, it should not be used as your primary source for information. This is because it can produce inaccurate, biased or false information. These tools should never be used for patient-identifiable information.
• The UK’s National Cyber Security Council states that you should not enter sensitive information such as personal details or company intellectual property into chatbots, and not to perform queries that could be problematic if made public. For example, sharing confidential information and asking ChatGPT to solve a personal/professional dilemma. 
• If using publicly available AI for your communications activities, then we recommend that you should follow the following basic rules:  

• No personal data should be used in these apps or services.
• No business sensitive data should be used in these apps or services.
• These apps should only be used for non-clinical purposes.
• You should inform your organisation’s information governance team where you intend to use these services as part of your work.

You should be aware:

• of any copyright and intellectual property considerations when using generative AI
• that any information generated may be requested under information access rights, including providing an explanation of how and why any new personal information was created
• of any potential ethical considerations when using these products, including the potential to propagate biased, discriminatory, or harmful content
• that you will need to verify any output of these products to ensure accuracy
• that AI software used for work purposes should only be accessed via corporate devices
• that AI systems should be continuously monitored for suspicious activities, anomalies and potential security breaches.

6.3 Procuring and implementing AI products or systems for communications

When procuring and implementing artificial intelligence products or systems that include AI features, there are a number of things you should do:

• Engage with your organisation’s procurement team.
• Engage with your organisation’s IT/information governance teams by submitting your request via your organisations IT service request system and process.
• Be aware that the NHS is legally required to complete a data protection impact assessment (DPIA). The service area and the supplier should engage with this process.
• Consider the risks and practical steps to reduce risks that are documented in the ICO’s AI toolkit.
• As part of the DPIA, carefully assess potential societal impact and ethical implications of AI deployments and mitigate any associated biases or ethical concerns and document and address them. This includes specific consideration for AI models generating images, ensuring diverse representation and avoiding harmful stereotypes or misrepresentations.
• Ensure that AI outcomes or outputs are reviewed by a human. You cannot rely solely on the use of AI for decision-making, there should be substantial involvement from an appropriately qualified human.
• Identify a process to raise any concerns regarding the output of AI products. If there are concerns that have led to an incident, report them via your organisation’s incident reporting procedures.
• Establish incident response plans to handle security incidents, including data breaches, unauthorised access and system failures.
• Ensure use of AI is transparent to staff and patients, making sure they understand where it is being used and how it may impact their employment, work or care. The logic behind it should be explainable.
• Data should be collected and processed in a lawful and ethical manner, with appropriate consent and anonymisation measures in place. Data access and sharing should be strictly controlled and data should be stored securely throughout its lifecycle. 
  Be assured that any product mitigates against bias and discrimination. 

To ensure the responsible and effective use of AI in NHS communications, staff must be equipped not only with technical understanding but with the professional judgement to apply AI in ways that align with NHS values and local context.

Training should not be viewed as a one-off requirement, but as a core component of long-term professional development. Evidence from across the NHS and wider public sector consistently shows that generic, one-time training has limited impact. Effective AI capability building requires role-differentiated learning, structured progression, and regular refresher as tools and guidance evolve.

Recommended competency tiers for NHS communications staff:

• Foundation level (all communications staff). Understanding what generative AI is and is not; recognising hallucination and bias risks; safe use of approved tools; data protection obligations when using AI; when to escalate or seek IG guidance.
• Practitioner level (communications managers and senior practitioners). Critically evaluating AI tools for fitness for purpose; applying equality impact thinking to AI-generated content; briefing IG colleagues on communications use cases; designing review and sense-checking workflows.
• Strategic/leadership level directors of communications and senior leads). Advocating for proportionate AI access within governance frameworks; commissioning and overseeing responsible AI pilots; reporting on AI use to boards and executive teams; contributing to national learning.

The NHS Alliance, supported by the NHS Communications AI Taskforce, is helping to coordinate national training efforts. This will include workshops, seminars and toolkits, mapped to the tiers above. 

Training should build both confidence and competence. We encourage organisations to share learning, feedback and resources that support a thriving, connected communications community as AI capabilities continue to evolve. 

Communications and public relations are vocations that are fundamentally about changing the thoughts, feelings and actions of target populations. Across all industries, but particularly in an area like the NHS, practitioners must constantly be alive to issues around ethics. Engagement activity shares this strong ethical dimension, with questions of who you are listening to (and who you are ignoring), what information you are sharing, what methods you are using, and how much power you are sharing, all requiring significant ethical focus.

We should regularly evaluate all of our approaches and tools from an ethical perspective, from paid advertising in newspapers and the social media platforms we use to the stalls we run at community events, regardless of AI use. However, it is clear that the tools related to AI require specific attention:

• Providers of AI tools emerge from a specific ethical context: what training data they use and how they acquire it; environmental impact to train/create the models; their relationships with surveillance technology and defence industry; their explicitly stated political views.
• The way large language models generate text and make decisions can feel like a ‘black box’, with all the issues around accountability that brings.
• The capabilities are changing extremely quickly, and the use-cases for AI continue to grow, including uses that can combat inequalities, so the ethical case for using them continues to develop.

The NHS Alliance, supported by the NHS Communications AI Taskforce, is helping to coordinate national training efforts. This will include workshops, seminars and toolkits, mapped to the tiers above. 

Training should build both confidence and competence. We encourage organisations to share learning, feedback and resources that support a thriving, connected communications community as AI capabilities continue to evolve. 

8.1 Ethical principles for AI use in NHS communications

This section provides principles, checklists and links to further resources to guide ongoing ethical discussions and adoption within teams.

The CIPR and PRCA both have codes of conduct. The following principles have drawn on these codes, as well as the work of a designated working group of NHS communications professionals, to offer a simple and clear set of ethical principles for NHS communications teams to discuss and consider in their everyday use of AI.

As this framework provides guidance and is not a prescriptive policy, adherence to its principles at an organisational level will be decided by each NHS organisation’s communications director or communications lead. They will ensure compliance within their respective communications departments, as appropriate, through robust mechanisms including staff awareness initiatives, the diligent completion of data protection impact assessments, regular spot-checks, and internal audits. The NHS Communications AI Taskforce will maintain a high-level oversight of the overall progress and adoption of AI in communications across the NHS, but it will not be responsible for direct organisational-level monitoring or compliance enforcement. 

This framework will be reviewed every 12 months by the NHS Communications AI Taskforce. It was first published in October 2025 and has been updated and re-published in October 2026. Due to the pace of change in AI technology, earlier review may be required in response to exceptional circumstances, organisational change or relevant changes in legislation/guidance.

We would highly recommend that communications staff keep up to date with the latest developments in AI technology and relevant legislation and guidance, as this field is rapidly evolving.

The framework will be published on the NHS Alliance website and sent to NHS communications leads.  

12.1 Equality

In developing this framework, an equality impact analysis (EIA) will have been undertaken by September 2025. The framework applies to all staff, regardless of protected characteristics. However, AI systems have been criticised for exhibiting racial or gender bias. Therefore, when assessing new technology, NHS organisations should build in inclusion and diversity into AI design by ensuring the right data is used to train AI systems and that outputs are ‘sense checked’ by a human. This is particularly pertinent when using AI to generate images or other communication content, where visual representation and messaging should be inclusive and free from bias. 

The UK General Data Protection Regulation (GDPR)/Data Protection Act 2018 includes the requirement to complete a data protection impact assessment for any processing that is likely to result in a high risk to individuals. Consideration should be given to any impact the framework may have on individual privacy; please consult your organisation’s information governance team. If you are commissioning a project or undertaking work that requires the processing of personal data, you should complete a data protection impact assessment. The NHS is committed to ensuring that all personal information is managed in accordance with current data protection legislation, professional codes of practice and records management and confidentiality guidance. For more information speak to your organisations data protection lead. 

13.1. General Data Protection Regulation (GDPR): Developments since October 2025

The legal and regulatory landscape for AI and data has continued to evolve since this framework was first published. NHS communicators and their information governance colleagues should be aware of the following:

• Data (Use and Access) Act 2025: This act introduces new provisions relevant to NHS data use, including an updated framework for lawful processing and reinforced interoperability standards. Communications teams involved in any initiative that uses NHS data — including audience insight, campaign analytics or AI-generated content drawn from internal datasets — should ensure their information governance colleagues have reviewed these provisions. 
• DSIT Data and AI Ethics Framework (December 2025): The Government Digital Service has published an updated framework replacing the 2020 Data Ethics Framework, with a new self-assessment tool specifically designed for public sector AI projects. Communications teams running or proposing AI initiatives are encouraged to use this tool as a complement to the DPIA process.
• Algorithmic Transparency Recording Standard (ATRS): NHS organisations that use AI tools in ways that significantly influence decisions affecting patients or the public may be expected to publish an ATRS record. Communications teams should raise awareness of this standard with their digital and IG colleagues when proposing new AI tools. ATRS records are published on the Gov.uk transparency register.

Download the pdf: NHS Communications AI Operating Framework v2