FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Occupational health providers
Occupational health providers can use AI for notes, triage, reports and screening, but the clinician remains responsible for every opinion sent to an employer. OH sits between a worker and an employer, so an AI error can harm both and lead to claims from either.
Part of: AI in occupational health providers
In short
Occupational health (OH) clinicians use AI to transcribe assessments, draft management reports, triage referrals, analyse surveillance tests and summarise medical records. Neither the Faculty of Occupational Medicine nor SEQOHS has AI-specific rules, so the duties come from the GMC, NMC and HCPC codes, GMC guidance on reports for employers, the ICO's guidance on workers' health and the Data (Use and Access) Act 2025, which governs solely automated significant decisions from 5 February 2026. NHS state indemnity does not cover OH work for employers, so clinicians and OH companies need their own professional indemnity.
OH work is document heavy and repetitive, which makes it an obvious target for AI tools. Uses can include:
Each use saves time, but each puts an algorithm between the clinician and an opinion that affects a worker's job, pay or safety. For background on what an OH service does, see occupational health service and the employer's OH obligations.
There is no statutory regulator for OH businesses as such. Individual clinicians are regulated by their own bodies, and the professional and accreditation bodies publish guidance and standards.
| Body | Role in OH | AI position |
|---|---|---|
| GMC | Regulates occupational physicians | AI learning resource: apply Good medical practice to AI tools; report incidents (para 73) |
| NMC | Regulates OH nurses | No AI guidance; Code review expected to cover AI |
| HCPC | Regulates OH physiotherapists, OTs and psychologists | Standards apply to AI; guidance promised for autumn 2026 |
| FOM | Professional body; ethics guidance | No AI-specific guidance found |
| SEQOHS | Voluntary accreditation hosted by FOM | Standards do not mention AI |
| ICO | Data protection | Workers' health guidance covers automated decisions; under review after the DUAA |
On 17 September 2026 the GMC, NMC, HCPC and other regulators signed a Joint Statement of Intent to develop UK-wide principles on professionals' use of AI. The detail is set out in AI rules for occupational health explained.
The most directly relevant text is the GMC's guidance on disclosing information for employment, insurance and similar purposes. Paras 4 and 5 deal with the dual obligations of a doctor working for an employer. Para 7 requires reports not to be false or misleading, to stay within the doctor's direct knowledge and to give a balanced opinion. Para 115 requires the worker to understand the scope, purpose and likely consequences, written consent, disclosure of only relevant factual information and, usually, an offer to see the report first. Paras 10 to 12 cover correcting factual errors and withdrawal of consent.
Good medical practice 2024 adds para 69 (clear, accurate, contemporaneous records) and para 73 (reporting incidents involving devices and software). The NMC Code covers privacy and telling people how their information is used (5.1 and 5.2), records (10.1 to 10.3) and indemnity (12.1). HCPC standards 5.1 and 5.2 cover confidentiality and 10.1 to 10.3 records. None of these duties changes because a tool wrote the first draft.
The ICO's guidance on information about workers' health says detailed medical information should be accessed and interpreted by health professionals, and managers usually need only fitness-for-work information. Consent is often not a valid basis in employment, so OH providers and employers usually rely on an Article 6 basis plus an Article 9 condition such as employment law, with DPA 2018 Schedule 1 conditions where required.
Section 80 of the Data (Use and Access) Act 2025 inserted UK GDPR Articles 22A to 22D, fully in force from 5 February 2026. Significant decisions based solely on automated processing of special category data need explicit consent, or a contract or legal requirement plus the substantial public interest condition in Article 9(2)(g). Fitness-for-work and health surveillance decisions with significant effects on workers fall within this. See automated decisions on workers' health.
Individual doctors, nurses and HCPC registrants must hold indemnity by statute under SI 2014/1887, with no minimum limits. No statutory PI requirement for an OH company was identified. NHS state indemnity does not help: the CNSGP and ELSGP scope states occupational health is not covered (with a narrow exception for staff flu vaccination in the 2025/26 programme), and data protection breaches are excluded. NHS Indemnity for employees excludes work for other organisations.
An OH professional indemnity or medical malpractice policy usually responds to claims alleging negligent advice or assessment, whether or not AI was involved, subject to its terms. One medical defence organisation's published AI position says help applies only where a human is the decision maker and excludes autonomous systems, software defects and data breaches. Read more in does OH indemnity cover AI mistakes and on occupational health professional indemnity.
Apex arranges professional indemnity for occupational health clinicians and OH companies. A broker reviews whether your cover protects both the company and its clinicians, and how the policy treats AI-assisted assessments, reports and screening. See also does PI cover AI mistakes.
No. The Faculty of Occupational Medicine and SEQOHS have not published AI-specific rules. The duties come from GMC, NMC and HCPC standards, GMC guidance on reports for employers, ICO guidance on workers' health and UK GDPR Articles 22A to 22D. Regulators have signed a joint statement to develop UK-wide AI principles.
No. NHS Resolution's CNSGP and ELSGP scope states that occupational health is not covered, apart from staff flu vaccination under the 2025/26 programme, and data protection breaches are excluded. OH clinicians and companies need their own professional indemnity.
Not on its own where the decision is significant. A solely automated decision based on health data needs explicit consent, or a contract or legal requirement plus Article 9(2)(g), and safeguards including human intervention. Some indemnity arrangements for clinicians also assume a human made the decision.
Both sides of the relationship. A worker may complain or claim over an inaccurate or overly disclosive report, and an employer may claim if it relied on flawed advice. Professional indemnity usually responds to negligent advice claims, subject to the policy terms.
Tell us about your practice and the work you do. A broker will review how your current cover treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start an indemnity quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
