Agentic, Robotics, Ambient & Clinical AI: Scale Arrives, So Does the Caution

The National Cyber Security Centre has published interim guidance titled "Managing the cyber risk of agentic AI": its first formal advice on securing autonomous AI systems. Published on 20 August, it sets out seven practical control areas: threat identification, prompt engineering, oversight levels, sandboxing, observability, attribution and emergency shutdown. It is explicit that model-level safeguards alone are not sufficient, since they can be bypassed and may not hold up in higher-risk environments. Full formal guidance is still to come; this is deliberately interim advice for organisations already deploying agents now.

NHS trusts are already the kind of organisation this guidance is written for. Copilot Studio agents built for tasks like FOI requests, complaints handling and helpdesk triage, governed under NHS England's Agent 365 framework, are exactly the class of system the NCSC is describing. Barts Health NHS Trust's six-month AI pilot for patient complaints at Newham Hospital shows several of the NCSC's own principles working in practice before the guidance existed: a bounded scope, mandatory human review of every response, and an explicit statement that AI does not replace the "personal touch" of speaking to patients and families. The trust reports the time spent drafting response letters has more than halved, with a significant reduction in cases needing to be reopened.

The NCSC's seven controls translate into concrete questions for any NHS AI agent already live: have you written down what it is, and isn't, allowed to do (threat identification), are its instructions and constraints precisely specified (prompt engineering), is a human in the loop, on the loop, or is it running unsupervised (oversight), what is it physically allowed to touch (sandboxing), can you reconstruct exactly what it did after the fact (observability), can its actions be traced back to it and not mistaken for a human's (attribution), and who has the authority and the access to switch it off in the next five minutes (emergency shutdown)? Trusts building agents under Agent 365 now have a national reference point to check local practice against, months before any NHS-specific version of this guidance is likely to exist.

Teams at Oxford University Hospitals' Churchill Hospital have marked the milestone of 5,000 robotic surgery procedures. Soft tissue robotic surgery was first introduced there in 2009 using the da Vinci Si system, with da Vinci X and Xi systems added in 2021; the service now spans upper and lower gastrointestinal, hepatobiliary, head and neck, urology, renal and bladder surgery. Consultant surgeon Mr Colin Nnadi called it "a testament to the dedication and teamwork of everyone involved in our robotics journey."

The milestone lands against a specific national target: the Government's 10 Year Health Plan commits the NHS to making robotic-assisted surgery the default for an expanded range of procedures, with NHS England setting an ambition of 9 in 10 keyhole surgeries being robot-assisted within ten years, up from roughly 1 in 5 today. Lisa Glynn, Director of Clinical Services at OUH, described the milestone as "a really important step in the continuing development of our robotics services," with teams "committed to building on this success."

It took Churchill 17 years and three generations of the same manufacturer's platform to reach 5,000 cases. That is the honest timescale behind "default within ten years." It assumes sustained capital investment and trained staff at every trust, not just the ones that started earliest. The national ambition will ultimately be judged on whether trusts without Churchill's head start can compress that curve, not on whether flagship centres can extend one they are already on.

The National CLEAR Programme's expression-of-interest window for CLEARvalidate, a six-month, fully funded pilot to assess the safety and performance of ambient voice technology, closed at 5pm on 21 August. Up to five NHS trusts will be selected to deploy CLEARvalidate across as many as three clinical specialties each, receiving fully funded implementation, onboarding, platform access and expert support to build an evaluation framework tailored to their own priorities and governance arrangements.

Unlike a standard AVT rollout, CLEARvalidate is built as a continuous safety-assurance framework rather than a one-off procurement check. It assesses audio quality, transcription accuracy, preservation of clinical meaning and documentation quality on an ongoing basis, giving participating trusts a running evidence base rather than a single go-live sign-off. Trusts can use the resulting evidence to build a business case for further investment if the technology performs as expected, or to flag where it doesn't.

This lands in the same fortnight HSSIB's own national investigation into AVT patient safety opened its evidence window (see last week's issue), one initiative asking whether AVT is safe from the outside, in public, over roughly two years; the other offering individual trusts a funded, private way to check their own deployment on a six-month cycle starting now. The two are not competing routes. A trust going through CLEARvalidate this year will have concrete local evidence in hand well before HSSIB's 2027 report lands, rather than waiting to find out what the national answer turns out to be.

Calderdale and Huddersfield NHS Foundation Trust confirmed on 18 August that it will go live on 1 September with an EPR-embedded clinical decision support tool built around the Anticholinergic Medication Index (ACMI). The tool automatically calculates and updates a patient's ACMI score, drawn from a bank of 88 commonly prescribed medicines, whenever an anticholinergic medication is prescribed or changed for inpatients and day cases aged 65 and over.

The score appears directly inside the clinician workflow, results review and pharmacy care organiser areas of the EPR, alongside a breakdown of which medications are contributing to the total. The scoring bands are simple and clinically legible: zero to one is low risk, one to two is intermediate, and two or above is high risk, flagging a greater chance of adverse outcomes including delirium and falls in older patients, exactly the population where anticholinergic burden is hardest to track by memory across a multi-drug regimen.

Run the ACMI tool through MHRA's standing test for stand-alone software: it surfaces a calculated risk score and flags contributing medicines for a prescriber or pharmacist to act on, and does not itself alter treatment or act without review, the profile of a decision-support aid rather than a device intended to support diagnosis or treatment on its own. MHRA applied this same logic in July when it drew the equivalent line for ambient voice technology, distinguishing tools that transcribe or flag for clinician review from those that act without one. That distinction determines whether ACMI needs to clear medical device regulation before go-live, and it is worth asking, before 1 September, whether Calderdale and Huddersfield's classification decision and DCB0160 safety case are documented and ready to show, not just assumed.