RH.
← The Adoption Feed

Monday, 10 August 2026

HSSIB opens a national patient safety investigation into ambient voice technology in hospitals

HSSIB, 2026-08-06

The Health Services Safety Investigations Body has issued a notification of investigation into AVT in acute adult secondary care, to understand how it has contributed, or may contribute, to patient harm. HSSIB's stated reason for opening it is that adoption is accelerating while the safety implications are not fully understood, and that national activity has focused more on efficiency benefits than on safety risk. It also flags that routes for recognising and reporting AI-related incidents are not yet mature. The report is due summer 2027.

Takeaway

Your AVT deployment will be evidence in a national investigation — make sure someone owns the DCB0160 safety case and that clinicians know how to report an AVT-caused documentation error today, not in 2027.

hssib.org.uk

UK health and care

NHS England's review of DCB0129 and DCB0160 is out for consultation until 11 September

NHS England, 2026-06-29

NHS England is consulting on revising both mandatory clinical risk management standards. AI is named as a driver: the revised standards are intended to account for artificial intelligence supporting clinical decisions, complex interconnected systems sharing data across organisations, and technologies including voice recognition and machine learning. It is described as primarily a technical consultation aimed at people with current experience of the standards.

Takeaway

This is the single biggest lever on how much assurance work your AI programme carries for the next five years, and the people who will do that work are in your team — get a response in before 11 September.

engage.england.nhs.uk

CLEARvalidate offers five NHS trusts fully funded independent validation of their AVT

National CLEAR Programme, 2026-07-13

The National CLEAR Programme is funding implementation, onboarding and six months' use of a vendor-neutral assurance platform for five trusts, covering up to three clinical specialties each. It evaluates audio quality, transcription accuracy, clinical meaning and documentation quality, and returns a dashboard plus risk mitigation recommendations. Expressions of interest close 5pm on Friday 21 August; a briefing webinar runs 11 August, 12:30–13:30.

Takeaway

Independent accuracy evidence you did not pay for, at the moment HSSIB starts asking for it — if you have AVT live and no measured error rate, apply this week.

clearprogramme.org.uk

Manchester University NHS FT commits to 6,500 more Copilot licences a year and agents in back-office functions

HTN, 2026-08-10

MFT's board update sets out an expanded Microsoft arrangement: an additional 6,500 Copilot licences annually for three years to corporate staff, plus 1,600 frontline colleagues, with teams building AI agents to automate admin, finance and information governance tasks under human-in-the-loop protections. Alongside it, a Digital and Data Academy funded through the apprenticeship levy opens with eight courses spanning data, AI, automation, cyber security and software engineering, and a new analytics platform, ADAMS, supports work on synthetic data so teams can explore ideas without identifying patients.

Takeaway

Two transferable moves here — funding AI capability from the levy rather than a training budget, and giving teams a synthetic-data sandbox so IG review is not the first gate every idea hits.

htn.co.uk

Mid Cheshire Hospitals publishes a five-stage AI autonomy ladder across four domains

HTN, 2026-08-10

The trust's seven-year digital and data plan to 2033, approved by its board on 30 July, sets out AI deployment across clinical, operational, workforce and patient domains, with each domain mapped against five stages: Support (decisions made by humans only), Recommend (human in the loop), Enable (prepare or initiate, human sign-off required), Automate (execute within safe boundaries, human monitoring and override) and Autonomous (system-led, regulatory compliant). No suppliers are named.

Takeaway

Steal the ladder. It gives a board a single vocabulary for "how much is this thing allowed to decide", which is the argument most AI approval meetings are actually having without saying so.

htn.co.uk

Adoption practice

It is not the engineers burning the token budget

Simon Willison, 2026-08-07, linking 404 Media, 2026-06-24

Willison highlights an anecdote from leaked Accenture meeting audio reported by 404 Media: Accenture's own internal data showed non-engineers, not engineers, driving token consumption, with PDF-to-markdown conversion called out as a significant consumer. The wider piece describes firms retrofitting cost controls after broad rollouts rather than before them.

Takeaway

If your Copilot or API rollout has no per-team metering, your first cost surprise will come from a well-meaning admin team bulk-processing documents — meter before the next licence tranche, not after.

simonwillison.net

The tools we use

Microsoft 365 Copilot

OpenAI is now an enabled subprocessor in Microsoft 365 Copilot by default

Microsoft Learn, enabled 2026-07-24

The setting rolled into the admin centre on 9 July and auto-enabled on 24 July for eligible commercial tenants unless an admin had already set it to "No users". OpenAI-operated models are within the EU Data Boundary except as otherwise disclosed, but Microsoft states they are excluded from in-country processing commitments where those apply. GA, no additional licence; controlled at Microsoft 365 admin center > Copilot > Settings > View all > AI providers operating as Microsoft subprocessors, and needs the AI Administrator role.

Takeaway

If your DPIA or supplier list says Microsoft is the only processor for Copilot, it is now out of date — check what your tenant defaulted to and re-paper it.

learn.microsoft.com

Anthropic models in Word, Excel and PowerPoint Copilot process outside the EU Data Boundary

Microsoft Learn, page updated 2026-06-23

A separate admin setting lets Copilot in Microsoft 365 apps use Anthropic models by default for EU, EFTA and UK tenants. Microsoft states plainly that data processing for these models occurs outside the EUDB. It is on by default for tenants created after 25 March 2026; older tenants must check the Message Center for their default. The standalone Anthropic independent processor setting was decommissioned on 1 May 2026, and Word support is listed as arriving summer 2026. GA; sits under the same subprocessors blade, and cannot be changed independently once the global subprocessor setting is scoped to All users or to specific groups.

Takeaway

This is the one to check first — a UK tenant created after March defaults to out-of-boundary processing for Word, Excel and PowerPoint content, and the control is coarser than most people assume.

learn.microsoft.com

Microsoft 365 Admin agent reaches GA at no additional cost

Microsoft Learn / MC1436831, 2026-07-23

Natural-language administration across the Microsoft 365 admin centre and Copilot Chat: users, licences, groups, service health and Message Center. It is automatically available to Entra built-in administrator roles including Global, AI, Teams and SharePoint Administrators, with no Copilot licence required. All write and execute actions need explicit administrator confirmation, actions are logged in workload audit trails, and deployment can be blocked or scoped via admin center > Agents > Registry.

Takeaway

An agent with admin rights arrived in your tenant without a purchase order — decide deliberately whether to scope it in the Agents Registry, and confirm the audit trail lands where your SOC actually looks.

learn.microsoft.com

Wider signal

An agent found a booking API with no authorisation checks and used it

Simon Willison, 2026-08-10, quoting ABC News

Willison quotes the agent OpenClaw describing an Australian gym-booking site: "The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through." Willison files it as a quotation with no commentary of his own.

Takeaway

Agentic tooling exercises authorisation gaps that a human user interface hides. Before you let any agent talk to an internal API, confirm authorisation is enforced server-side rather than by what the front end chooses to render.

simonwillison.net

Coffee break

DCB0129 and DCB0160

The two mandatory clinical risk management standards that govern health IT in the NHS. **DCB0129** binds the *manufacturer* — the supplier building a health IT system must run a clinical risk management process and produce hazard analysis and a Clinical Safety Case Report. **DCB0160** binds the *deploying organisation* — your trust must do its own clinical risk management for the system as configured, in your workflow, with your staff. They are deliberately paired: the supplier's DCB0129 output is an input to your DCB0160 assessment, never a substitute for it.

Both require a named Clinical Safety Officer, a registered clinician, who signs the safety case. The Clinical Safety Case Report is the artefact that matters: it lists the hazards considered, their controls, and the residual risk someone accepted by name.

For AI, DCB0160 is where the real work sits, because the hazards are local — how clinicians check output, what happens when it is wrong, and who notices. NHS England is consulting on revising both standards until 11 September 2026, with AI named as a driver.

Also worth reading

  • Kingston and Richmond NHS FT has moved Lyrebird Health AVT out of a ten-specialty pilot into the emergency department, gastroenterology and gynaecology outpatients, coordinated with the South West London Acute Provider Collaborative. https://htn.co.uk/2026/08/05/__trashed-4/
  • A survey of 1,000 NHS clinicians commissioned by AVT supplier Heidi reports 90% using AI in clinical work and 65% doing so ahead of formal workplace guidance. Supplier-commissioned, so treat the headline number carefully — the shadow-use finding is the interesting one. https://www.digitalhealth.net/2026/08/survey-finds-90-of-nhs-clinicians-use-ai-in-clinical-practice/
  • GitHub Models has completed its retirement, breaking pipelines that called it. Worth a check if any innovation or data team prototyped against those endpoints. https://simonwillison.net/2026/Aug/9/github-models-is-now-retired/
  • MHRA is advising quarantine of medical devices supplied without appropriate UKCA or CE conformity markings — relevant diligence for anyone buying software that may be a regulated device. https://www.gov.uk/government/news/mhra-advises-quarantine-of-medical-devices-supplied-without-appropriate-conformity-markings
  • Bristol NHS FT, newly merged, is the first NHS organisation live on the LocalNHS Drupal open-source platform, with AI search. The supplier behind the AI search is not named. https://htn.co.uk/2026/08/10/bristol-nhs-ft-launches-ai-search-and-website-built-on-open-source-digital-platform/