The number, on the record, once a quarter. Breach the
threshold on an active model and suspension is automatic — continuation is what needs a signature.
Lock a baseline
Insert-only: a new lock supersedes the old on the
record, never edits it. The threshold you choose is the automatic suspension floor.
Accountable sign-offs
status changes need an org admin
You sign as who you are signed in as —
email from the session, your stated role, your rationale, and a hash anchored in the audit chain.
Deployment, suspension, reactivation and retirement require an organisation administrator.
Action
Signed by
Rationale
Signature
approve deployment
2025-10-16
neel@healthcareaiops.com
COO
Pilot across 14 clinicians showed stable note quality; review-and-sign step retained as hard requirement.
4c10266a6361…
The fifteen-control checklist
8/15
The Institute's published RUAIH / CHAI / NIST crosswalk, as a working
checklist for this model. Change a status and it saves — every change lands in the audit
chain. 'Not started' is the honest default; the binder shows the gaps.
Survey binder
The full governance record as one download —
assembled live, with the audit chain's verification verdict inside. This is the document you
hand the surveyor.