What Your Indemnity Provider Expects When You Use AI
In short This article sets out the disclosure and documentation expectations indemnifiers apply, and argues that the record, not the tool, is what defends a clinician.
Nobody has ever won a claim by saying the software was clever. They win, or at least survive, by showing what the clinician did, what they knew, and why they did it. That is the whole argument of this post: when an AI tool is involved in a patient’s care, your indemnifier is not going to be interested in the tool’s marketing. They will want your record.
If you are choosing or running AI for radiograph reading, triage or front-desk work, this matters more than any feature comparison.
The position, as indemnifiers frame it
The big UK dental indemnifiers (Dental Protection, the Dental Defence Union, and Dental Defence Society among them) have been broadly consistent in what they say. I’d treat the following as the common thread rather than quoting any one policy wording, because wording changes and you should read your own.
- Responsibility stays with the registered clinician. The GDC’s Standards for the Dental Team apply whether a diagnosis came from your eyes or from an algorithm. Software does not hold a GDC registration. You do.
- Use must be within your competence. If you cannot explain, in plain terms, what the tool does and where it fails, you are leaning on it rather than using it.
- Patients should know. Valid consent (Standard 3) means telling patients about material aspects of their care. Whether AI involvement is material is a judgement, and your indemnifier will ask how you made it.
- Data protection is yours as controller. A practice is typically the data controller, the vendor the processor. A breach by the vendor can still land on you.
- Check your cover. Some policies are silent on AI. Silence is not permission. Ask in writing.
None of this is exotic. It is the same logic as for a new CBCT unit or a new composite system, applied to something that is harder to inspect.
Why the record beats the tool
Take a real-world category. Several radiograph-assistance products are CE/UKCA marked as medical devices and used in UK practices, including Pearl’s Second Opinion, Overjet, Videa Health, and Diagnocat for CBCT. Their reported sensitivities for caries detection on bitewings are typically in the region of 70 to 90 percent depending on lesion depth and study. Good, and also not 100.
Do the arithmetic on a mid-sized practice. Say it takes 40 bitewing series a week, 46 working weeks: 1,840 series a year. Suppose each has, on average, one surface where an early proximal lesion is borderline. That is roughly 1,840 borderline judgements. If the software has 80 percent sensitivity on those, it will miss about 370 of them. Your own reading will miss some too. No one is arguing the tool should be perfect. The question a complaint handler asks is simpler: on this patient, on this date, what did you see, what did the software show, and what did you decide?
If the answer is in the notes, you are in a defensible position even when the call was wrong. If it isn’t, you have nothing but recollection eighteen months later.
Three worked examples
1. The overlay that disagreed with you
An associate takes bitewings on a 24-year-old. The AI flags an approximal lesion on the distal of the 46 at what it labels enamel-dentine junction. The associate reads it as a stain and sound enamel and decides to monitor.
Weak note: BWs taken. Caries UL5, monitor.
Defensible note:
BWs x2 taken 14/10/26, grade 1 quality. Clinician review: no radiolucency
46 D that I would treat as cavitated. AI overlay (Pearl SO, v-current)
flagged 46 D, ?EDJ. Not accepted: lesion confined to outer enamel on my read,
patient low caries risk (no new lesions 3 yrs, F toothpaste, diet reviewed).
Plan: monitor, repeat BW 24 months. Discussed with pt, agreed.That is under 70 words. It records the disagreement, the reason, the risk assessment, and the patient’s involvement. If the lesion progresses, the indemnifier has something to work with. Note that the NICE guidance on recall intervals (CG19) supports risk-based intervals, which is exactly what the note reflects.
2. The triage tool that said “routine”
A practice uses an AI chat or phone triage tool for out-of-hours and front-desk requests. A patient writes: “jaw a bit swollen, not sore, since last week.” The tool classifies it as routine and offers an appointment in nine days.
Is that a clinical decision made by a clinician? No, and that is the problem. A swollen jaw can be an odontogenic infection, or something that must not wait. The indemnifier’s question will be: what rules did you set, who approved them, and how often did anyone check?
What you should be able to produce:
- The written escalation rules (for example: any facial swelling, difficulty swallowing or opening, fever, or suspected trauma goes to a human clinician the same day).
- Evidence they were tested before go-live. A simple test log of 30 to 50 scripted messages, with outcomes, is enough to show diligence.
- A monthly sample audit. Pull 20 triaged contacts, have a clinician re-grade them, record the disagreement rate. If 2 of 20 were under-triaged, that is 10 percent, and you have a number to act on.
- A clear patient-facing line stating that the tool is not for emergencies and giving the 111 and 999 routes.
Without those, “the software told them routine” is not a defence. It is an admission that nobody was watching.
3. The scribe and the front desk
Ambient note-taking tools and AI receptionists record speech. That means special category data the moment a patient mentions a condition. The ICO expects a Data Protection Impact Assessment for high-risk processing, and recording clinical conversations plausibly qualifies. You also need a processor contract, clarity on where audio is stored (UK or EU hosting is easier to defend than unspecified), retention periods, and whether the vendor trains models on your data.
A practice that can hand over a DPIA, a signed data processing agreement and a patient notice has answered most of an ICO or indemnifier enquiry before it is asked. A practice that says “we just switched it on” has not.
The documentation pack
Keep one folder, paper or digital, per tool. It should hold:
| Item | Why it matters |
|---|---|
| Vendor’s regulatory status (UKCA/CE class, MHRA registration) and intended-use statement | Shows you used it for what it was built for |
| Date adopted, who approved it, who is the named lead | Shows governance |
| Staff training record with dates and sign-off | Shows competence |
| DPIA and processor agreement | Shows data compliance |
| Written protocol: when to use, when to override, when to escalate | Shows a system, not improvisation |
| Version and update log | Software changes; your record should say which version was live on the day |
| Quarterly audit result | Shows you watched it |
| Patient information wording and consent approach | Shows transparency |
| Written confirmation from your indemnifier | Shows cover |
Allow a half day to build it for the first tool and an hour or two a quarter to maintain it. That is cheap against a single contested case.
Disclosure: to whom, and when
Two audiences.
Your indemnifier. Tell them before go-live, in writing, what the tool is, what it does and who uses it. Do not wait for a renewal form to ask. Ask directly whether anything in the policy excludes or limits AI-assisted work, and keep the reply. If the answer is vague, ask again.
Your patients. A line in the practice leaflet and website, and a short verbal mention when it affects them, is a reasonable starting position: “We use software that highlights areas on your x-rays for the dentist to check. The decision is always the dentist’s.” Where the tool is changing how they interact with you (a chatbot, a recorded call), say so up front. NHS practices should also check what their commissioner or ICB expects in contract terms.
Habits that fail
- Auto-accepting overlays. If you click through every flag, your note says you delegated.
- Never overriding. An override rate of zero over 500 radiographs is suspicious, not reassuring.
- Letting the tool write the note unreviewed. You sign it. Read it.
- No version record. After an update the model is not the one you validated.
- Staff using personal accounts or free chatbots for patient letters. That is a data protection incident waiting for a date.
Where to go next
The wider picture on UKCA marking, the Data (Use and Access) Act changes, ICO expectations and CQC inspection focus is covered in our Regulation, Data and Governance pillar. Read it alongside your own policy schedule.
Then do the practical bit this week. Email your indemnifier one paragraph describing each AI tool in use. Pick one tool and build its folder. At your next clinical meeting, agree a standard wording for recording when you accept or reject an AI finding. Twenty minutes of that is worth more than any vendor’s accuracy claim, because it is the only part of the story you control, and the only part anyone will ask to see.