One governance path that every AI tool passes through, from the enterprise contract to the free browser extension someone found last week. Fill in the owner lines to make it real for your organization.
Log every AI request in one place. If it is not logged, it does not advance.
Where requests are logged:
Score the request against the five risk categories: clinical and patient safety, data and privacy, model and accuracy, operational and workflow, compliance and regulatory.
Who reviews:
Define the allowed use and its limits in writing. Approval covers a scope, not a product.
Who signs:
Launch with metrics, owners, and kill criteria set in advance, not negotiated after the first incident.
Pilot owner:
Recheck on a set cadence. Models drift, vendors pivot, and contracts renew.
Review cadence: