How to make AI clinical reports hold up at audit in the UK

An AI clinical report that holds up at audit needs five things: every statement linked to its source, a clinician checking it section by section, a record of what changed from the AI draft, quality checks (QA gates) before approval, and a clinical safety process under DCB0129, the NHS standard for clinical risk management in health IT. This is the framework we built Cerebric around, and the one I would use to judge any tool that drafts clinical reports, ours included.

1. AI can write diagnostic report drafts; the clinician who signs stays responsible#

When clinicians ask me whether AI can write diagnostic reports in the UK, my answer is that the report has to meet the same standard it always did, and responsibility for it still sits with the clinician who signs it.

The software drafts and organises the notes; it does not reach a diagnosis#

By "write", I mean that the software drafts and organises the notes from evidence the clinician has gathered. It does not assess the patient, decide what the findings mean, or reach a diagnosis, and it cannot help make one. Whether a person meets the criteria for a condition is a clinical decision for a qualified clinician.

If a product starts to weigh up the evidence or steer the clinical conclusion, it becomes a different kind of device with a higher bar to clear with the regulator (see section 5).

The GMC requires records that are clear, accurate, contemporaneous and legible#

The General Medical Council's (GMC) Good medical practice, in force since 30 January 2024, requires that formal records of your work, including patients' records, are "clear, accurate, contemporaneous and legible" (contemporaneous meaning written at the time). It says nothing about who, or what, typed the first draft. If the report is wrong, the clinician who signed it is responsible.

So the question is whether you can defend what the report says: in a complaint, at a tribunal, during a Care Quality Commission (CQC) inspection, in a clinical audit, or when a patient asks to see their records. That evidence comes from the system that made the report.

2. An AI clinical report holds up at audit when it has five properties#

A clinical report holds up at audit when, for any sentence, you can show the evidence behind it and the process that produced it. Building Cerebric with UK neurodevelopmental services, I have come to think of this as five properties, each giving part of the evidence an auditor will ask for:

1. A source for every claim: every factual sentence shows where it came from.
2. Checked by a clinician: recorded, section by section.
3. Change tracking: a record of what changed between the AI draft and what was signed.
4. QA gates: checks that must pass before approval.
5. Clinical safety records: DCB0129 paperwork and a named Clinical Safety Officer.

The chain of evidence behind a report that holds up at auditA source for every claimevery sentence cites its sourceChecked by a clinicianrecorded, section by sectionChange trackingAI draft compared with signed versionQA gateschecks pass before approvalClinical safety recordsDCB0129 plus a named CSOA report holds up at audit only when all five are in place, and auditors look at this evidence trail. The clinician checks each section, signs the report and remains fully responsible for it.The five properties of a report that holds up at audit, in the order a report is made.

1. Every statement needs a source, stored with the report when it is drafted#

This means every factual sentence in the report is linked to the evidence it came from: a timestamp in the assessment transcript, an answer on a scored questionnaire, a line in a school report or GP referral.

AI making things up (hallucination) gets most of the attention. For an audit, the bigger problem is that without a source, a true sentence and a made-up one look the same. Two years after an assessment, a tribunal may ask how you knew the patient's symptoms were there before age twelve. You need to point to the exact minute of the recorded assessment where it was discussed.

So the citations must be stored with the report, made when it is drafted and kept after signing, not pieced together from memory when someone asks.

We built Cerebric around this property. Every sentence of an AI-drafted report can be traced back to its source, and the clinician checks each one in Split View, evidence on one side, draft on the other. Whatever tool you use should be able to do the same.

2. The clinician's check must be recorded, section by section#

This is a fixed, recorded process where a named clinician checks each part of the draft against the evidence before signing. If the check is not recorded, an auditor cannot tell whether it happened.

A single "approve" at the end of a twenty-page document tells an auditor little. Section-by-section sign-off (history, informant evidence, mental state, diagnostic reasoning, recommendations) records that a person worked through each part.

The usual objection is time. At the clinics using Cerebric, report writing time fell by 75%, including the clinician's check.

Measured at UK Right to Choose and private neurodevelopmental providers using Cerebric, 2025–26.

Time to produce a report, before and afterWritingWith Cerebric: draft and checkWriting time removedBefore: your current writing timeWriting, 100%With Cerebric: 75% less, check includedDraft and check, 25%Drafting drops to minutes, but the clinician still reviews and checks every section before signing, and that review is part of what makes the report hold up at audit. Counting the whole pass, draft to signature, clinics using Cerebric cut report writing time by 75% against their own time before. Measured at UK Right to Choose and private neurodevelopmental providers using Cerebric, 2025–26.Measured at UK Right to Choose and private neurodevelopmental providers using Cerebric, 2025–26.

Checking takes much less time than writing, and it is the part only a clinician can do. "I was sceptical about AI in clinical work, but Cerebric genuinely feels like it was built by people who understand the pressures we face. It slots into my workflow without adding friction," a clinical lead at one provider told us. A recorded check lets clinicians who are unsure about AI use the tool and still review everything it drafts.

3. Change tracking shows whether a clinician really reviewed the AI draft#

Change tracking means the system keeps the AI's original draft and records every edit the clinician made before signing.

This matters in both directions. If you changed a great deal, the record shows clinical judgement being used: a strong answer to "did a human really review this?". If you changed nothing, an auditor may fairly ask whether any checking happened at all. Without the record, all you have is someone's word that the draft was read.

An auditor, or a claimant's solicitor, will ask to see it. Copying and pasting from a chat window into your clinical system wipes that record the moment you paste. In Cerebric, sections can be redrafted and edited, and the change history is kept after approval.

Change tracking also shows where the drafting needs improving, because the edits clinicians make most often point to its weak spots.

4. QA gates check for predictable failures before a report can be approved#

A QA gate is a check that must pass before a report can be approved and sent, so quality does not depend on everyone remembering to read carefully.

Diagnostic reports fail in predictable ways:

• a section missing;
• an informant questionnaire mentioned but never scored;
• recommendations that do not match the stated diagnosis;
• the wrong patient details after a template change.

Gates let you check for each of these. In Cerebric, approval runs through QA checklists that each clinic sets up for each report template, and redrafting a section does not skip them.

Auditors want to know that every report, from every clinician, meets the same standard, and how you know. A gate record attached to every report you send is the kind of evidence a CQC inspection looks for under well-led: a written process, applied the same way every time, with records to prove it.

5. DCB0129 and DTAC: the vendor must show a hazard log, safety case and CSO#

Health IT used in UK care, including AI tools that write clinical notes, has to meet clinical safety standards. The main one is DCB0129, a required NHS standard set under the Health and Social Care Act 2012.

The software maker must manage clinical risk from the start and prove it with a hazard log (the risks and how each is handled), a clinical safety case (the written case that the product is safe for what it is meant to do) and a named Clinical Safety Officer, a registered clinician responsible for it.

DCB0160 and the DTAC buying checklist complete the picture, as the table shows. Our guide to DSPT, DTAC and DCB0129 covers each in more detail.

For our part, Cerebric is registered as a UKCA Class I medical device, a documentation and workflow tool whose intended purpose is not to make or inform the diagnosis. The clinician carries out the assessment, reaches the diagnosis and signs the report; Cerebric drafts and organises the notes they check. We run a DCB0129 clinical safety process, and our full position is on our compliance page. Ask any vendor for the same paperwork, and treat vague answers as a big gap.

3. Pasting from a general AI chat tool leaves no evidence for the five properties#

The other common approach is for a clinician to paste case details into a general AI chat tool, get back well-written text, and paste it into the clinical record. Clinicians working this way are usually trying to clear a real backlog with the tools they have, but it leaves no evidence for any of the five properties. There is usually no hazard log, safety case or Clinical Safety Officer either, and often no clear answer on where patient data was processed.

A milder version of the same problem applies to ambient AI scribes. They turn a consultation into a note, with a human check, but a neurodevelopmental diagnostic report pulls together evidence gathered over months (screening, patient and informant questionnaires, school documents, a structured assessment). No scribe was built to track sources across that span; our comparison of AI scribes and assessment platforms explains why.

A better AI model would not fix this, because the gaps are in the process around the model.

4. Sign an AI-drafted report only when you can show evidence for all five properties#

Before any AI-drafted report goes out under your name, you should be able to show evidence for each of the five properties above. For clinical safety, ask who the vendor's Clinical Safety Officer is, and whether they can show you a hazard log, a clinical safety case report and their MHRA registration status.

If you can answer all five, you have a drafting process you can defend. If you cannot, start with the gaps.