Sources

107 controls from 10 published frameworks. Each checklist item cites the controls below. Requirements are short paraphrases; always check the source document.

Control	Clause	Requirement (paraphrase)	Plan items	Review
N01	GOVERN 1.5	Plan ongoing monitoring and periodic review of the risk process, define roles, and set the review frequency.	O01, C05	draft
N02	GOVERN 1.7	Have processes for decommissioning and phasing out AI systems safely, without raising risk.	C04	draft
N03	GOVERN 2.1 and 2.3	Document roles, responsibilities and lines of communication. Executive leadership owns decisions on AI risk.	G01, G02	draft
N04	GOVERN 3.2	Define and differentiate roles for human and AI configurations and for oversight of AI systems.	G01, P10	draft
N05	GOVERN 4.3	Enable AI testing, incident identification and information sharing.	O06	draft
N06	GOVERN 6.1 and 6.2	Address third party AI risks by policy. Have contingency processes for failures or incidents in high risk third party data or AI.	P07	draft
N07	MEASURE 2.4	Monitor the functionality and behavior of the AI system and its components in production.	O01	draft
N08	MEASURE 2.6	Evaluate safety regularly. Safety metrics reflect reliability, robustness, real time monitoring and response times for AI system failures.	O01	draft
N09	MEASURE 2.11	Evaluate and document fairness and bias.	P05, O04	draft
N10	MEASURE 3.1 and 3.3	Track known and emergent risks regularly using intended versus actual performance in deployed contexts. Give end users and affected communities channels to report problems and appeal outcomes.	P01, P02, O03, O05	draft
N11	MEASURE 4.2 and 4.3	Validate performance in the deployment context with domain experts. Identify and document measurable performance improvements or declines.	P01, P04, O03	draft
N12	MANAGE 2.3	Follow procedures to respond to and recover from a previously unknown risk.	O08	draft
N13	MANAGE 2.4	Have mechanisms, with assigned and understood responsibilities, to supersede, disengage or deactivate systems whose performance or outcomes depart from intended use.	C03	draft
N14	MANAGE 3.1 and 3.2	Monitor third party resources and pre trained models regularly. Apply and document risk controls.	P07, C01, C02	draft
N15	MANAGE 4.1	Implement post deployment monitoring plans. They cover user input capture, appeal and override, decommissioning, incident response, recovery and change management.	P10, O01, O05, O08, C02, C03, C04	draft
N16	MANAGE 4.3	Communicate incidents and errors to relevant AI actors, including affected communities. Track, respond to and recover from incidents, and document this.	O06, O08	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
J01	Element 1, leadership	Appoint individuals with technology expertise to lead AI use. Include a multidisciplinary team spanning executive, compliance, IT, safety, clinical, cybersecurity, privacy and stakeholder roles.	G01, G02	draft
J02	Element 1, policy and board	Policies cover selection through lifecycle management and equitable use. The governing board receives regular updates on use, outcomes and adverse events.	G02, G03	draft
J03	Element 3, data use agreements	Vendor data agreements define permitted uses, prohibit re identification, require security compliance and reserve audit rights with penalties.	P06	draft
J04	Element 4, pre deployment requests	Ask vendors how the tool was validated and tested, whether they will tune or validate on a deployment representative sample, and how bias was evaluated.	P03	draft
J05	Element 4, monitoring policy	Write policies naming responsible parties for regular validation, comparison of outputs to known parameters, checks of use case outcomes and confidence, confirmation of data currency, and an AI dashboard.	O01, O03	draft
J06	Element 4, risk based frequency	Monitor more often for tools close to clinical decisions. Administrative tools can be checked periodically.	O02	draft
J07	Element 4, vendor feedback	Establish channels with vendors. Vendors notify the health system of model changes or updates that may need an unplanned performance check. Locally found issues go to vendors.	C01	draft
J08	Element 4, adverse event reporting	Create a process to report adverse events or ongoing errors to leadership and vendors.	O06	draft
J09	Element 5, voluntary blinded reporting	Have a process for confidential, blinded reporting of AI safety events to an independent organization. Record events in internal incident systems. Designated individuals own AI quality and safety.	G01, O07	draft
J10	Element 6, risk and bias process	Identify, categorize and document prospective and observed risks and biases, especially safety and access risks. Use model cards.	P01, P02	draft
J11	Element 6, local validation and ongoing bias checks	Check that tool testing covers the populations served. Tune or test on local data. Monitor and audit for bias before deployment and during use.	P04, P05, O04	draft
J12	Element 7, education and training	Provide role specific training and documentation. Define who may use each tool. Decide when training is needed before rollout and whether it must recur.	P09	draft
J13	Element 2, patient privacy and transparency	Protect patient data from unauthorized use or release. Disclose and educate patients and families on AI use. Notify patients when AI directly affects their care and how their data are used. Obtain consent where and when relevant. Policies address transparency for staff and patients.	P08	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
E01	Article 9, risk management system	Run a continuous risk management process across the lifecycle. Identify known and foreseeable risks, estimate them, adopt mitigation and test.	P02, O01	draft
E02	Article 10, data and data governance	Govern training, validation and test data. Examine data for bias and gaps relevant to the intended population.	P05, P06	draft
E03	Article 12, record keeping	Log events automatically over the system lifetime so operation can be traced and monitored.	O01, O03	draft
E04	Article 13, transparency and information to deployers	Supply instructions that state intended purpose, accuracy, known limits and oversight measures.	P01, P03	draft
E05	Article 14, human oversight	Design for effective oversight by people who can understand outputs, override them and stop the system.	P10	draft
E06	Article 15, accuracy, robustness and cybersecurity	Declare accuracy levels. Keep performance robust and resilient to errors, faults and attacks.	P04, C02	draft
E07	Article 17, quality management system	Keep documented procedures for compliance, change management, testing, monitoring and accountability.	G01, C05	draft
E08	Article 26, obligations of deployers	Use the system per instructions, assign oversight to competent staff, monitor operation, keep logs and report problems.	P09, O01, O06	draft
E09	Articles 72 and 73, post market monitoring and serious incident reporting	Collect and analyze performance data after release. Report serious incidents to the authority without delay.	O06, O08	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
H01	170.315(b)(11), source attributes	Make intervention source attributes available to users: origin, funding, release dates, inputs used and how it was validated.	P01, P03	draft
H02	170.315(b)(11), risk analysis	Analyze risks to validity, reliability, robustness, fairness, intelligibility, safety, security and privacy for predictive tools.	P02	draft
H03	170.315(b)(11), risk mitigation	Put documented practices in place to mitigate the risks found in the analysis.	O01, C03	draft
H04	170.315(b)(11), governance	Set policies and controls for how data are acquired, managed and used by the tool.	P06, P08	draft
H05	170.315(b)(11), feedback and export	Let users give feedback on outputs and export it in computable form with the action taken.	O03, O05	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
W01	Principle 1, protect human autonomy	Keep humans in control of health decisions. Protect privacy and obtain valid consent.	P08, P10	draft
W02	Principle 2, promote well being, safety and the public interest	Meet regulatory requirements for safety, accuracy and efficacy. Apply quality control in practice.	P04, O03	draft
W03	Principle 3, transparency, explainability and intelligibility	Publish enough information before deployment so the tool can be understood, debated and challenged.	P01, P08	draft
W04	Principle 4, responsibility and accountability	Name who is responsible. Provide appropriate mechanisms for questioning and redress.	G01, O06	draft
W05	Principle 5, inclusiveness and equity	Design and use for the widest appropriate access. Monitor for bias and unequal performance.	P05, O04	draft
W06	Principle 6, responsive and sustainable	Assess responsiveness during real use. Plan for sustainability and for retirement of tools that no longer perform.	O03, C04	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
I01	Clause 5, leadership and AI policy	Top management sets an AI policy, assigns roles and commits resources.	G01, G02	draft
I02	Annex A.3, internal organization	Define roles and responsibilities. Provide a process to report concerns.	G01, O07	draft
I03	Annex A.5, assessing impacts of AI systems	Assess impacts on individuals and groups, document results and keep them current.	P02, P05	draft
I04	Annex A.6, AI system life cycle	Set objectives, verification and validation criteria, deployment and operation controls, monitoring and change handling.	P04, O01, C02	draft
I05	Annex A.7, data for AI systems	Document data acquisition, quality, provenance and preparation.	P06	draft
I06	Annex A.8, information for interested parties	Provide user documentation, incident communication and reporting channels.	P08, P09	draft
I07	Annex A.9, use of AI systems	Define responsible use processes, objectives and intended use.	P09, P10	draft
I08	Annex A.10, third party and customer relationships	Allocate responsibilities with suppliers and customers. Assess supplier risk.	P07, C01	draft
I09	Clauses 9 and 10, performance evaluation and improvement	Monitor, audit and review the management system. Correct nonconformity and improve.	O03, C05	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
F01	Description of modifications	State the planned changes to the AI function that will be made after release.	C01, C02	draft
F02	Modification protocol	Define data handling, retraining, performance evaluation and update procedures for each planned change.	C02	draft
F03	Impact assessment	Assess benefits and risks of each modification and how risks are mitigated.	C01, C02	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
R01	Stage 1, usefulness	Justify why AI addresses the problem and why it beats non AI alternatives. Complete a risk benefit and cost benefit analysis.	P01, P12	draft
R02	Stage 1, usefulness	Assess workflow integration, including the effect on patient clinician interaction.	P09, P12	draft
R03	Stage 1, fairness	Define fairness for the use case. Identify subgroups at risk. Set a bias monitoring and mitigation strategy.	P02, P13	draft
R04	Stage 1, fairness and security	For acquired tools, ask the vendor for subgroup performance and parity data. Review third party security practices.	P03, P07	draft
R05	Stage 1, transparency	Document intended use, users and target population with inclusion and exclusion criteria. Choose a documentation format such as a model card.	P01, P11	draft
R06	Stage 1, security and privacy	Keep an AI systems inventory with data processing maps. Run an initial privacy and security risk assessment.	P07, P08	draft
R07	Stage 1, safety	Confirm regulatory and ethical requirements: FDA software criteria, IRB need, consent and adverse event disclosure.	G02, P02	draft
R08	Stage 2, usefulness	Assess usability with human factors methods. Document robustness testing.	P04, P12	draft
R09	Stage 2, safety	Let end users control, direct and override recommendations. Record each override.	P10, O10	draft
R10	Stage 2, safety	Write a risk management plan with adverse events, causes and corrective actions. Define adverse and serious adverse events.	P02, O06, O08	draft
R11	Stage 2, safety	Set reporting and recall procedures and a threshold for reporting potential patient harm. Share concerns with the developer and regulators.	O06, O07	draft
R12	Stage 2, transparency	Label the model in plain language: development, purpose, limits, error rates and underrepresented subpopulations. Update the label when new limits appear.	P01, P11	draft
R13	Stage 2, fairness	Provide simple channels for end user feedback on bias. Review feedback in time to stop escalation.	O04, O05	draft
R14	Stage 2, accountability	Set a governance structure and a change management plan that split developer and implementer duties. Define how the teams communicate.	G02, C02	draft
R15	Stage 2, security and privacy	Set data governance: access controls, secure transfer, encryption, audit trails, retention, third party sharing terms and incident response.	P06, P08, O11	draft
R16	Stage 3, engineering	Follow a data management plan. Use quality assured data with documented lineage that represents the target population. Test robustness across populations.	P04, P05	draft
R17	Stage 4, assess	Run installation qualification and local validation. Run a prospective silent evaluation.	P04, P14	draft
R18	Stage 4, assess	Train end users. Name the business owner accountable for testing. Approve implementation, measurement and mitigation plans before the pilot.	G01, P09	draft
R19	Stage 5, pilot	Pilot first. Assess real world impact, workflow fit, acceptance and downstream effects. Update the risk plan. Decide on scale up from set success criteria.	P15	draft
R20	Stage 6, deploy and monitor	Monitor continuously. Audit regularly. Watch for drift. Set retraining procedures. Document all changes and share findings.	O01, O03, O12	draft
R21	Governance foundation	Assign roles by SOP. Place oversight high enough to decide on resources, incidents and rollback. Provide independent review and train staff.	G01, G02, P09, O14	draft
R22	Stakeholder roles	Name a business owner, a technology owner and an executive sponsor. Give end users a route to report risks.	G01	draft
R23	Independent review	Arrange independent review for objectivity. Share results to build trust.	O14	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
A01	Stage 3, usefulness	Check that training data match the deployment setting and that local data represent the population. Monitor data quality and drift.	P04, O12	draft
A02	Stage 3, fairness	Justify any use of protected attributes. Check proxies and composite scores for hidden bias.	P05, P13	draft
A03	Stage 3, transparency	Document data provenance, lineage and limits. Version control the datasets.	P06, P11	draft
A04	Stage 4, fairness	Keep training and test data independent. Assess performance and parity across subgroups.	P05, P14	draft
A05	Stage 4, security	Assess third party providers. Keep audit records and system documentation. Set up vulnerability reporting.	P03, P07	draft
A06	Stage 5, transparency	Reduce automation bias. Manage clinician disagreement with outputs. Assess what users do after an AI interaction.	P10, O10	draft
A07	Stage 5, security	Run configuration change control. Review audit logs. Keep an incident response plan. Set resilience needs for critical AI services.	O08, O11, C02	draft
A08	Stage 5 and 6, safety	Review regularly whether the system is still relevant or obsolete.	C04, C05	draft
A09	Stage 6, fairness	Monitor drift effects on bias. Name who monitors bias. Assess drift risk between pilot and full deployment.	O04, O12	draft
A10	Stage 6, transparency	Tell patients and affected groups about the AI role. Make end of life processes clear.	P08, C04	draft
A11	Stage 6, security	Notify stakeholders of cybersecurity and privacy incidents. Report unintended uses. Assure the supply chain.	O06, O08	draft
A12	Stage 6, safety	Confirm updates keep the system safe and effective. Analyze impact on safety and benefit.	C01, C02	draft
A13	Governance principle	Provide high level oversight, a bias management structure with clear roles, and mandatory training on ethics, quality, intended use and risks.	G02, P09	draft
A14	Stage 2, fairness and transparency	Define clear decision thresholds. Provide explainability measures for subgroup assessment.	P10, P11	draft

Control	Clause	Requirement (paraphrase)	Plan items	Review
M01	Header	Record name, developer, contact for issues, release stage, release date, version, global availability and regulatory approval.	P11	draft
M02	Uses and directions	State intended use and workflow, primary users, how to use, target population and cautioned out of scope settings.	P01, P11	draft
M03	Warnings	State known risks and limitations, known biases and ethical considerations, and the clinical risk level.	P02, P11	draft
M04	Trust ingredients, AI system facts	State outputs, model type, foundation models, input data, development data, bias mitigation, maintenance, security practices and transparency mechanisms.	P11, P13	draft
M05	Transparency information	State the funding source, third party information and stakeholders consulted.	P03, P11	draft
M06	Key metrics, usefulness, usability and efficacy	Report goal, result, interpretation, test type, test data and validation process.	P04, P11	draft
M07	Key metrics, fairness and equity	Report the same six metric fields for fairness and equity.	P05, P11	draft
M08	Key metrics, safety and reliability	Report the same six metric fields for safety and reliability.	P04, P11	draft
M09	Resources	List evaluation references, clinical trials, publications, reimbursement status and patient consent or disclosure.	P08, P11	draft

Planned: NIST AI 600-1 generative AI profile, CHAI Assurance Reporting Checklists, FDA clinical decision support guidance, HIPAA security rule and state AI laws. Add a framework.