Do Assign one named role as accountable for the tool across its life. Document who decides on risk and who runs day to day oversight.
Evidence Owner named in the AI inventory entry.
Sources
Do Present the tool to a group that spans clinical, safety, IT, privacy, compliance and executive roles. Record the decision and conditions.
Evidence Committee minutes or approval record.
Sources
Do Write the intended use, intended users, target population and out of scope uses. State the performance the tool is meant to deliver in this setting.
Evidence Intended use statement or model card on file.
Sources
Do List prospective risks and biases with emphasis on safety and access. Record the mitigations and the residual risk accepted.
Evidence Risk register entry.
Sources
Do Protect patient data from unauthorized use or release. Where the tool directly affects care, notify patients and families, explain how their data are used, and obtain consent where relevant. Address transparency for staff.
Evidence Disclosure text, consent workflow and privacy review.
Sources
Do Define which roles may use the tool. Decide whether training is needed before rollout and whether it must recur. Provide role specific documentation.
Evidence Access rules and training record.
Sources
Do Name the metrics, the responsible parties, the review frequency and the escalation route. Cover functionality and behavior, comparison of outputs to known parameters, use case outcomes, confidence and data currency.
Evidence Monitoring plan with named metrics, owners and frequency.
Sources
Do Monitor more often when the tool is close to a clinical decision. Administrative tools can be checked periodically.
Evidence Monitoring frequency recorded against the risk tier.
Sources
Do Give end users and affected communities a way to report problems and appeal outcomes. Capture user input and overrides.
Evidence Reporting channel and appeal procedure.
Sources
Do Report adverse events and ongoing errors to leadership and to the vendor. Record events in the internal incident system. Send locally found issues to the vendor.
Evidence Incident process that names the tool.
Sources
Do Follow procedures to respond to and recover from a previously unknown risk. Communicate incidents and errors to relevant parties, including affected communities. Record the response.
Evidence Incident response procedure and test or tabletop record.
Sources
Do Put local retraining, retuning and continuous learning under change management. Revalidate before a changed model is used.
Evidence Change control procedure for the tool.
Sources
Do Plan periodic review of this governance plan and define the roles for it.
Evidence Scheduled review in the AI inventory.
Sources
This plan maps your answers to requirements in published governance documents. Medon is a planning aid that supports your governance committee and counsel. Each mapping to a source document carries a review status.