The Drafting Fiction: How Regulators Really Govern AI Scribes in Healthcare

Artificial intelligence scribes have quietly become one of the fastest-spreading technologies in modern medicine. These tools use automatic speech recognition and generative language models to listen to clinical consultations, transcribe the conversation and produce structured draft notes that flow into the electronic health record. Vendors promise clinicians less typing, less burnout and better notes, and health systems around the world are listening. Yet a new study published in PLOS Digital Health suggests that the official rulebook governing these systems is scattered, uneven and built on a fragile assumption that has never been properly defined: that a clinician will always catch the machine’s mistakes.

Samuel Oluwatobi Atiku of Aston University in Birmingham conducted a qualitative content analysis of 74 unique English-language official documents issued by regulators, government bodies, medical colleges and health-system organisations. The documents were identified through a staged search of the grey literature, the vast ecosystem of guidance, checklists and policy papers that never appears in journal databases but shapes real clinical practice. Using a hybrid deductive and inductive coding framework, Atiku examined how these documents operationalise responsibility across sixteen governance dimensions, from patient consent to medical device classification. The search closed on 10 May 2026 after the five governance domains under study had been searched and source chasing no longer returned new eligible material.

The study’s central contribution is an analytic concept Atiku calls the drafting fiction. The term does not appear in any of the source documents; it was developed through comparative analysis to describe a recurrent pattern in which artificial intelligence-generated clinical text is treated as provisional, a mere draft, until a clinician reviews and authenticates it. This single convention allows patient reassurance, record integrity and professional accountability to coexist in the same workflow. Patient leaflets tell patients their notes will always be checked. Privacy regulators require that generated text be flagged as unreviewed before it enters a record system. Professional bodies insist that artificial intelligence is not a substitute for clinical judgement. Each institution attaches different consequences to the same moment of authentication.

The contrast between institutional perspectives is striking. When NHS England asks adopters to assign a Clinical Safety Officer and complete DCB0160 safety documentation, it is constructing local safety assurance. When the Information and Privacy Commissioner of Ontario requires that artificial intelligence-generated personal health information be reviewed for accuracy before entry into an electronic medical record, it is constructing a privacy and record-integrity control. When the Medical Council of New Zealand declares that artificial intelligence cannot substitute for clinical judgement, it is constructing professional accountability. These are not repetitions of one rule; they are different routes to the same settlement, in which clinician authentication is expected to absorb risks created by vendors, software, workflow pressures and documentation demands.

Verification emerges as the clearest point of convergence among documents that directly address AI scribes, but the study shows it is an unstable, moving target. The Australasian Institute of Digital Health requires practitioners to confirm that captured information is true, accurate and complete. The Australian Commission on Safety and Quality in Health Care warns that ambient scribes can fabricate diagnoses, omit or add treatment steps, and confuse words such as medication and mediation. Hywel Dda University Health Board flags reversals as subtle as does and does not. NHS England warns of overreliance and automation bias. Testing evidence from the South West Healthcare Centre of Digital Excellence found errors in summaries across every ambient voice technology package evaluated, and observed that supplier accuracy was not consistent over time because underlying algorithms are regularly updated. Clinicians are thus asked to detect lexical errors, omitted care steps, fabricated content and their own eroding vigilance, all at once.

Privacy governance in the corpus extends well beyond secure storage. NHS Scotland directs that patient data from clinical sessions be automatically deleted unless retention is legally required, while Manitoba tells adopters to configure retention to thirty days. Ontario’s guidance is more exacting, warning that it may be virtually impossible to de-identify voice recordings because voiceprint and speaker-recognition technologies can infer identity and personal characteristics. This reframes the spoken consultation as biometric and inferential data, meaning the privacy question is not only whether recordings are deleted but whether voice, transcripts, metadata or derived features can be linked to identity, reused in model improvement or combined with other data in future systems. Patient-facing reassurance about secure environments cannot govern these downstream risks.

The study also reveals how unevenly consent is handled. Transparency is common: NHS England asks adopters to be open about how information is used, and the Australian Commission permits disclosure through waiting-room posters and booking forms. But consent, which gives patients an actual moment of decision, is procedurally thin. Saskatchewan’s checklist requires express written consent and asks whether staff are available for manual notes if consent is withheld. Health PEI provides a patient-facing script stating simply that patients can say no. Ontario requires that patients who refuse receive the same or similar level of care. Yet few documents specify who writes the manual notes, whether appointment templates change, or how refusal pathways are resourced. The study’s interpretation is that consent is not only a rights mechanism but a capacity mechanism, meaningful only when organisations allocate the labour of refusal rather than leaving it to be absorbed invisibly by clinicians.

Medical device classification adds another layer of complexity. NHS England states that products solely generating easily verified transcriptions are likely not medical devices, whereas generative artificial intelligence used for summarisation is high functionality and likely qualifies as one. NHS Scotland translates this into a practical adoption rule, stating that summarising ambient voice technology should be at least Class I and often Class II. Adjacent device regulation, including the FDA’s predetermined change control guidance and international machine-learning device principles, supplies lifecycle mechanisms that direct scribe guidance does not develop. The implication is that classification is not a static label fixed at procurement: a tool may begin as a transcription aid and drift into summarisation, coding suggestions or referral text, each functional change potentially altering its legal and safety significance.

The deepest problem the study identifies is what Atiku terms an underspecified human control assumption. Organisational safety cases, vendor due diligence and data protection assessments narrow product-level uncertainty, but they do not define the encounter-level support clinicians need to detect hallucination, omission, automation bias or model drift. Vendor assurance illustrates the mismatch: contracts can prohibit secondary use and demand security controls, but they cannot prove that a specific note captured a negated symptom correctly. Manitoba points providers toward nine pre-approved vendors, yet Ontario insists every custodian must still exercise its own due diligence. Accountability is closed on the clinician far more clearly than verification is made practicable, and no document states how long careful review should take or how clinics should protect that time.

The study concludes that AI scribe governance is taking shape as a genuine sociotechnical architecture, dispersed across privacy, professional, safety, organisational and device controls, but resting on verification work that guidance names without resourcing or defining. Future guidance, Atiku argues, should define reasonable verification standards, allocate protected review time, resource consent refusal pathways and require monitoring of performance across accents, languages and speech differences. Equity should move from principle to threshold, with pre-deployment testing across locally relevant populations and pause rules where performance gaps emerge. The drafting fiction is useful as a governance compromise, the study suggests, but fragile as a settlement unless the human control it assumes becomes something organisations actually design for, rather than something clinicians are simply expected to perform.

Subject of Research: Regulatory governance of artificial intelligence scribe adoption and use in healthcare

Article Title: Regulating the drafting fiction: A qualitative content analysis of official guidance and regulator documents on AI scribe adoption and use in healthcare

Article References: Atiku, S. O. (2026). Regulating the drafting fiction: A qualitative content analysis of official guidance and regulator documents on AI scribe adoption and use in healthcare. PLOS Digital Health, 5(10), e0001776. https://doi.org/10.1371/journal.pdig.0001776

Image Credits: AI Generated

DOI: 10.1371/journal.pdig.0001776

Keywords: AI scribes, healthcare regulation, clinical documentation, generative AI, patient consent, medical devices, privacy, automation bias, clinical safety, health policy, verification, equity