RUAIH readiness score

Named chair and members covering all seven expertise areas; a decision right that is actually exclusive; a stated cadence; minutes for the last three meetings.

Approved and dated within twelve months. Covers review, implementation, use, ethical standards, safety protocols, data use, privacy and equitable access.

At least one board or board-committee paper in the last twelve months reporting AI use and outcomes — not a technology update, an outcomes update.

One named individual with appropriate technology expertise, with the accountability stated in a job description or charter — not an implied owner.

Every AI tool in the organisation, including those embedded in the EHR and those a department bought without telling anyone. Each entry names data touched, owner, risk tier and go-live date.

The template carries permitted uses, data minimisation, prohibition of re-identification, third-party obligations and audit rights. Executed for every vendor touching PHI.

Dated evidence that access logs for AI systems were actually reviewed, with the reviewer named and exceptions dispositioned.

The plan names AI-specific failure modes — degraded output, an unavailable inference service, a silent vendor model update — and has been exercised.

A rule that sorts tools by proximity to a clinical decision and consequence of error, applied to every entry in the registry — not to the two tools somebody worried about.

Intended use, training population, known limitations and reported performance by subgroup. Obtained from the vendor where one exists; written by you where it does not.

Performance broken out by the subgroups you actually serve, where lawful and available. Vendor-reported fairness on someone else’s population is not this.

A standard question set, answered in writing by the vendor, retained with the contract. Blank sections are themselves a finding.

A written protocol and a result, on your data, for every tool in the top risk tier. A vendor’s published accuracy is an input, not a substitute.

Metrics, thresholds, owner and review frequency, tiered by risk. A plan that says “monitored regularly” fails this row.

Someone looks at it on a schedule, and you can show what changed as a result at least once. A dashboard nobody reads is a 1.

A defined path for staff to report an AI-related safety event, wired into your existing incident system, plus a decision on external voluntary reporting with the route named.

A written rule for when patients are told AI is involved in their care, what they are told, and how consent is handled where relevant — with the actual wording used.

Completion records by role for every tool in the registry. Training that covers limitations and failure modes, not only how to click.

A defined curriculum beyond tool training, and a published glossary so that “model”, “agent” and “automation” mean the same thing in every committee.

Dated evidence that training preceded deployment for the last tool you implemented. Training delivered in week three is a finding.