Answer a structured questionnaire. Medon returns a tiered checklist with owners, evidence and the source clause behind each item. Your institution sets its own roles and review frequencies in one file.
No policy writing and no spreadsheet of clauses. The questions describe the tool. The rules decide what applies.
What it does, how much it acts alone, where it comes from, who sees it, what patient data it touches. Then what governance already exists.
Low, moderate or high, with the answers that drove it. Unsure answers push the tier up and mark items to confirm.
Each item names the action, the evidence that proves it, the owner role and the framework clause it comes from. Print it or export it.
Your institution file sets owner roles and review frequencies. Until it is filled, each item reads "Set by local policy", so the plan always reflects your decisions.
Read the guideproject: {name: Vendor sepsis early warning in the EHR, clinical_lead: Example Physician, date: 2026-10-04} answers: function: clinical_support autonomy: recommends model_type: predictive source: vendor_embedded users: [clinicians, nurses] affects_care: "yes" patient_level: "yes" harm: serious phi: identifiable updates: vendor_updates workload: "yes" x_owner: yes x_committee: partial x_intended_use: partial x_vendor_validation: yes x_local_validation: no x_monitoring: partial x_vendor_notice: no
# Governance plan: Vendor sepsis early warning in the EHR - Organization: Example Health System - Clinical lead: Example Physician - Date: 2026-10-04 - Risk tier: **high** - Tier reasons: harm is serious ## Before deployment - [~] **P01 Document intended use and limits** (in progress) - Do: Write the intended use, intended users, target population and out of scope uses. State the performance the tool is meant to deliver in this setting. - Evidence: Intended use statement or model card on file. - Owner: Clinical lead named on the project - Source: NIST AI RMF MEASURE 3.1 and 3.3 (N10); NIST AI RMF MEASURE 4.2 and 4.3 (N11); JC and CHAI RUAIH Element 6, risk and bias process (J10); EU AI Act Article 13, transparency and information to deployers (E04); ONC HTI-1 170.315(b)(11), source attributes (H01); WHO AI for health Principle 3, transparency, explainability and intelligibility (W03); CHAI Responsible AI Guide Stage 1, usefulness (R01); CHAI Responsible AI Guide Stage 1, transparency (R05); CHAI Responsible AI Guide Stage 2, transparency (R12); CHAI Applied Model Card Uses and directions (M02) - [ ] **P02 Identify and document risks and biases** (open) - Do: List prospective risks and biases with emphasis on safety and access. Record the mitigations and the residual risk accepted. - Evidence: Risk register entry. - Owner: Director of Quality and Patient Safety - Source: JC and CHAI RUAIH Element 6, risk and bias process (J10); NIST AI RMF MEASURE 3.1 and 3.3 (N10); EU AI Act Article 9, risk management system (E01); ONC HTI-1 170.315(b)(11), risk analysis (H02); ISO/IEC 42001 Annex A.5, assessing impacts of AI systems (I03); CHAI Responsible AI Guide Stage 1, fairness (R03); CHAI Responsible AI Guide Stage 1, safety (R07); CHAI Responsible AI Guide Stage 2, safety (R10); CHAI Applied Model Card Warnings (M03) ...
# Copy this file and edit it for your institution. Nothing here comes from a framework. # Leave a value blank to print "Set by local policy" in the plan. organization: Example Health System roles: governance_lead: Chief Medical Informatics Officer, chair of the AI governance committee clinical_owner: Clinical lead named on the project quality_safety_lead: Director of Quality and Patient Safety vendor_manager: Procurement and vendor management privacy_officer: Privacy Officer training_lead: Clinical education cadence: # Frequencies are your policy choices. Fill by tier. The source documents state none. monitoring: {high: , moderate: , low: } bias_audit: {high: , moderate: , low: } training: {high: , moderate: , low: } board_report: {high: , moderate: , low: } plan_review: {high: , moderate: , low: } local_policy: # Optional: link or name your own policy for any item id. Shown next to the item. # G02: AI Governance Committee charter, policy 4.12 extra_items: [] # Optional local requirements. Same fields as items.yaml. Use ids that start with L.
From a no show model to a closed loop insulin dosing system. Open any project, pick a level of existing governance and read the full report. 100 reports, all synthetic.
This is the real tool, running below. Answer a few questions and watch the plan build.
Administrative tools. Short list, light touch.
Clinical information tools. Patient transparency, local validation, bias audit.
Close to a clinical decision. Suspension criteria, oversight, external reporting.
One file carries everything local. The rest is shared and versioned, so institutions can compare plans.
Python 3.9 or later.
pip install git+https://github.com/DIGlabUAB/medonRole titles, review frequencies by tier, links to your own policies, extra local items.
curl -o mysystem.yaml https://raw.githubusercontent.com/DIGlabUAB/medon/main/src/medon/data/org.example.yamlOne self contained HTML file. Host it on any internal web server.
medon web --org mysystem.yaml -o planner.htmlAdd frameworks and regulations as controls and items. A test fails if a control is never used.
pytestEvery plan item cites the framework clause behind it. Each control carries a review status, so reviewers see what has been checked against the source.
controls mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentcontrols mapped to plan items.
Source documentAdd a framework by writing its clauses as controls in one YAML file. See the contribution guide.
Health systems are asked to govern a growing set of AI tools. The guidance is published. Turning it into a project specific plan takes time that few teams have.
Medon reads a short description of a clinical AI project and writes the plan: a risk tier with reasons, a checklist of actions, the evidence that proves each one, the owner role and the source clause. Existing governance is recognised, so the list shows what is done, in progress and open.
Institutions set their own roles and review frequencies in one file. The planner runs offline in a single HTML page. Code is Apache 2.0. Data is CC BY 4.0. Example plans for 20 kinds of projects are on the scenarios page.
A partnership of the Diagnostic Intelligence Group (DIG) and Health System Information Services (HSIS) at the University of Alabama at Birmingham.
Diagnostic Intelligence Group. Director of AI, CLAIR. Project lead and maintainer.
sbodduluri@uabmc.eduDiagnostic Intelligence Group.
UAB Health System Information Services.
Diagnostic Intelligence Group.
UAB Health System Information Services.
UAB Health System Information Services.
UAB Health System Information Services.
Clinicians and governance leads who check each control against its source. Open seats.
Join as reviewerInstitutions that adopt the planner and share their institution file.
Open an issue