Helpline triage with safeguarding

• With the caller told and able to say no, the call is transcribed live for the adviser only, and the case note is drafted at the end for the adviser to edit and sign.
• Approved guidance and local services for the caller's area appear beside the conversation, each with its source, so advisers stop keeping private lists.
• Phrases that match the helpline's risk indicators, such as self-harm, abuse or a child at risk, are highlighted to the adviser and alerted to the shift supervisor as they are said or typed.
• Emails and webchats with possible risk move up the queue. The AI can raise a contact's priority but never lower it.
• Flags are a backstop. They will miss things, so advisers keep listening exactly as trained and the supervisor's role doesn't change.
• The AI never talks to a caller, never decides a safeguarding referral, and never makes a serious incident decision. People do.

• Charity CommissionSafeguarding and protecting people for charities and trustees (updated 8 October 2026)
  →

  Trustees are responsible for keeping people safe, with clear systems for reporting concerns to the police or social services as soon as they are suspected, and policies reviewed after every serious incident and at least yearly. The AI's role, limits and failure modes belong in the safeguarding policy, approved by trustees.

• Charity CommissionHow to report a serious incident (updated 16 January 2026)
  →

  Serious incidents, including significant harm to beneficiaries and significant data breaches, are reported promptly. Trustees stay accountable even when they delegate the report. A person decides; the AI's logs and the signed case note support the decision. Charities registered in Scotland or Northern Ireland follow OSCR's or CCNI's equivalent rules.

• DfE and DHSCWorking Together to Safeguard Children 2026 and Care Act 2014 section 42 (England)
  →

  Local authorities lead child protection and adult safeguarding enquiries; the helpline's job is to recognise, record and refer. The designated safeguarding lead decides on referrals under the helpline's protocol. Wales, Scotland and Northern Ireland have their own frameworks, so the protocol and the guidance the assistant shows follow the caller's nation.

• Home OfficeCrime and Policing Act 2026: mandatory reporting of child sexual abuse
  →

  The Act (2026) creates a duty for people in regulated activity with children in England to report known child sexual abuse to the police or local authority. It isn't in force yet, and the government will publish guidance first. Check whether any helpline roles fall within it, and make sure the case system records a disclosure and the report made clearly.

• ICOUK GDPR special category data, recording and transcription
  →

  Contacts reveal health, sex life and criminal allegations. That means a DPIA, an Article 9 condition such as the safeguarding condition in the Data Protection Act 2018, and a lawful basis; the Data (Use and Access) Act added safeguarding vulnerable individuals as a recognised legitimate interest. Callers are told at the start and can say no without any change to the service. Audio and transcripts are kept only until the note is signed, in a UK region, and never used to train providers' models.

• MHRASoftware and AI as a medical device
  →

  MHRA guidance on digital mental health technologies says software that assesses or predicts risk in mental health can be a medical device. Keep the intended purpose narrow and written down: the AI highlights what was said against the helpline's own indicators, for a trained person. It gives no risk score about a person and makes no clinical judgement. Get a regulatory view in discovery.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A supervisor on every shift, as now. The AI changes what they can see, not their role.
• The designated safeguarding lead owns the risk indicators and phrase rules, and signs off every change after testing.
• A monthly review of a sample of contacts with no flag, to find what was missed, and of dismissed flags, to check the reasons.
• A short script for telling callers about transcription, and a rule that saying no changes nothing about the help they get.
• Training for advisers and volunteers on what the flags miss, before they use them.
• Support for advisers' wellbeing, since transcripts make hard contacts easier to revisit.

1. 4 weeks

   Discovery

   Map today's contact handling and safeguarding protocol, audit a sample of notes, agree what the telephony and case system allow, and get a regulatory view on intended purpose.

2. Gate · must be true to passBaseline agreed, DPIA and safeguarding policy changes drafted, designated safeguarding lead and trustees briefed.

3. 10–12 weeks

   Pilot

   Notes and guidance first, with a small group of experienced advisers. Risk flags run in shadow mode, visible only to the reviewing team, and are compared with what advisers and supervisors did.

4. Gate · must be true to passMissed-flag and alert rates known and accepted by the safeguarding lead, note quality up, trustee sign-off.

5. 4–6 weeks

   Production

   Flags go live to advisers and supervisors, with monitoring, the banner when flags are off, and a rollback plan.

6. Gate · must be true to passMonitoring, support, rollback plan and training in place.

7. Ongoing

   Scale

   More advisers and volunteers, then webchat and email triage, then other nations' protocols.

8. Gate · must be true to passEach step passes the same review of misses and alert load.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   Advisers start relying on the flag, and silence is read as safety.

   How the design avoids it

   Training on what flags miss, a banner whenever they are off, and a monthly missed-flag review shared with advisers.

2. 2

   Goes wrong

   Indirect disclosures are missed: coded words, young people's language, other languages, a caller who says very little.

   How the design avoids it

   A test set built from reviewed, anonymised contacts, missed-flag rates measured before go-live, and phrase rules the safeguarding lead can change quickly.

3. 3

   Goes wrong

   So many alerts that supervisors stop looking.

   How the design avoids it

   Alert load measured per shift, rules tuned in shadow mode, and dismissals recorded with reasons.

4. 4

   Goes wrong

   Callers aren't told about transcription, or feel pushed to agree.

   How the design avoids it

   A short script, an easy no, and a check that opt-outs get the same service.

5. 5

   Goes wrong

   Flags drift into risk scores, and the tool becomes a medical device without anyone deciding it should.

   How the design avoids it

   A written intended purpose, no scores about people, and a regulatory view before the pilot.

1. Not yet in force
   The mandatory duty to report child sexual abuse in the Crime and Policing Act 2026, for people in regulated activity with children in England. The government will publish guidance before it starts.

   Make the case note record a disclosure, who was told and the report made. Review which roles are in scope when the guidance appears.

2. Published March 2026
   Working Together to Safeguard Children 2026 replaced the 2023 edition, with stronger expectations on child sexual abuse.

   Check the guidance the assistant shows and the helpline's protocol against the new edition.

3. 2027
   After the national commission on regulating AI in healthcare, the MHRA plans a 2027 consultation on how AI devices are qualified and classified, and a full roadmap in spring 2027.

   Write the intended purpose down now and review it as the new guidance lands.

4. Being written
   The ICO's code of practice on AI and automated decision-making, required by SI 2026/425.

   Keep a clear record that a person makes every decision, so the design fits whatever the code asks.

5. In force since 19 June 2026
   The Data (Use and Access) Act's data protection complaints duty: easy to make, acknowledged within 30 days.

   Make sure a caller's complaint about recording or transcription reaches the data protection team with a reference.