Selected as Best Overall Capstone
Harvard Medical School Executive Education, "AI in Healthcare," February 2026
Assess whether your organisation can evidence safe, defensible AI deployment under continuous human governance — before procurement, audit, or regulatory scrutiny forces retrofits.
Built for healthcare, pharma, and regulated AI environments preparing for EU AI Act, MDR, FDA, and clinical governance expectations.
FREE SELF-ASSESSMENT
Not sure where your AI system may fall under the EU AI Act? Start with the public EU AI Act compliance checker to understand possible risk classification, obligations, and next questions — in under 5 minutes.
Start Free Compliance Check →This is a self-assessment starting point, not legal advice or a substitute for formal regulatory review.
EXPLAINER VIDEO SERIES
Operational Governance Readiness for Healthcare AI
The Problem
Document reviews, model evaluations, and pre-deployment checklists are necessary — but they describe intent, not behaviour. They do not tell you what your AI will actually do in production, on the day it acts.
01
A policy that is not technically enforceable at runtime is a statement of intent. It does not stop an AI from acting beyond its authority.
02
Logs describe what happened. They do not constrain what is allowed to happen, who must approve it, or when an action must halt.
03
Dashboards observe systems after the fact. Operational control means decisions can be bounded, escalated, and reversed in real time.
Regulators increasingly care about what happens while AI is acting — not only what was documented before deployment.
Policies define intent. Runtime governance provides the evidence auditors, clinical boards, and procurement teams increasingly expect.
EU AI Act Alignment
The Readiness Sprint is not legal advice or a formal conformity assessment. It helps your team understand whether one AI workflow has the operational controls and evidence expected in regulated deployment contexts.
Art. 14
Can human authority be exercised at the moment of decision, with clear approval, override, and escalation pathways?
Art. 12
Can the organisation reconstruct what happened, when it happened, who reviewed it, and what action was taken?
Art. 9
Are workflow-level risks identified, classified, monitored, and controlled across the AI lifecycle?
Art. 50
Are users clearly informed when they are interacting with AI, especially in patient-facing, caregiver-facing, or senior-facing workflows?
Art. 5
Are controls in place to prevent manipulation, dependency creation, or exploitation of age, disability, cognitive vulnerability, loneliness, or social isolation?
Operational Governance Readiness
A ten-domain operational maturity matrix — not a document review. We compare your current state with what regulated agentic AI demands at runtime, in plain commercial language.
| Governance Area | Typical Organisation State | What We Assess |
|---|---|---|
| AI Inventory | Partial register, scattered across teams. | Whether every agentic workflow is identified, owned, and classified by risk and authority. |
| Workflow Risk Classification | Treated as model-level risk, not workflow-level. | Risk tiering of each workflow against EU AI Act exposure, clinical impact, and reversibility. |
| Human Oversight | Human-in-the-loop on paper; review after the fact. | Whether oversight exists at the moment of decision, not as retrospective review. |
| Runtime Controls | Guardrails defined, rarely enforceable in production. | Whether technical controls can bound, halt, or correct an AI action while it is happening. |
| Escalation Pathways | Implicit, undocumented, person-dependent. | Deterministic escalation logic — who is paged, when, and with what authority to override. |
| Auditability | Logs exist; reconstruction of decisions is hard. | Whether any past AI decision can be replayed end-to-end with the evidence regulators expect. |
| Consent Governance | Consent captured upstream, not enforced downstream. | Whether consent is bound to data, agents, and actions at runtime — not stored as a checkbox. |
| Operational Authority Boundaries | Unclear what an AI is allowed to decide vs. recommend. | Risk-tiered AI authority: where autonomy ends and human approval is mandatory. |
| Regulatory Evidence Readiness | Scattered artefacts, no single defensible package. | Whether the organisation can produce regulator-ready evidence on demand for a named workflow. |
| Vulnerable User & Transparency Safeguards | AI is friendly and helpful, but transparency, non-manipulation, and dependency safeguards are implicit. | Whether patient-facing or senior-facing AI workflows clearly disclose AI interaction, avoid persuasive exploitation, maintain non-medical boundaries where required, and escalate appropriately. |
This is operational governance readiness — not a document review. It produces specific, prioritised actions tied to one named workflow or deployment context.
Tier 1 — Strategic Diagnostic
Designed for organisations evaluating regulated AI deployment, operational governance maturity, or EU AI Act preparedness.
We assess one specific workflow or deployment context against runtime governance requirements, then deliver a board-ready package your regulatory, clinical, and executive teams can act on immediately.
Fixed scope. Fixed price. Fixed two-week delivery.
Likely AI classification, EU AI Act exposure, and operational governance implications — translated into commercial and clinical decisions. Includes review of transparency duties and vulnerable-user safeguards where the workflow interacts with patients, caregivers, seniors, or other protected groups.
Identifies where current workflows lack enforceable runtime controls — not where documentation is missing.
Visual matrix mapping each workflow to risk tier, allowed autonomy, and required oversight — the spine of operational governance.
Preliminary HAT operational model: escalation pathways, authority boundaries, and where human approval is non-negotiable.
What to fix first, what to fix next, and how to evidence each control to regulators, clinical boards, and procurement.
Assessment of whether the workflow includes adequate transparency, non-manipulation, escalation, and boundary controls for patient-facing, caregiver-facing, or senior-facing AI use cases.
How It Works
A focused engagement built for clarity and decision-pressure — not open-ended consulting.
Week 0
Structured 60-minute deep-dive. We agree on the single workflow or deployment context to assess and the decisions the diagnostic must inform.
Weeks 1–2
Runtime governance assessment, oversight architecture review, targeted stakeholder interviews. Mid-sprint direction-check with your team.
End of Week 2
Two-hour executive readout. Final memo, AI Workflow Risk Map, oversight blueprint, and 90-day action plan delivered as one PDF dossier.
Focused engagement. One workflow or deployment context. Not unlimited consulting scope.
Beyond Readiness
Tier 2 and Tier 3 are enterprise engagements designed for organisations operationalising runtime governance for regulated agentic systems.
Tier 2 — Pricing on request
Detailed oversight architecture for one or more priority workflows.
Tier 3 — Pricing on request
Operational deployment of Runtime Governance Infrastructure.
Founder, PatientCentricCare.AI
Architect, Physician-as-Pilot Safety OS™
Basel, Switzerland
Frequently asked questions
Most AI readiness audits assess documents and models. We assess whether your organisation is operationally ready to safely govern AI systems at runtime. Policy is not enforcement, logging is not governance, and monitoring is not operational control.
Nine governance domains for one named workflow: AI inventory, workflow risk classification, human oversight, runtime controls, escalation pathways, auditability, consent governance, operational authority boundaries, and regulatory evidence readiness.
CHF 1,600 to CHF 2,200, fixed scope, scope-adjusted to organisational complexity. Delivered over two weeks against one workflow or deployment context. One engagement per month to ensure depth and defensibility.
A board-ready PDF dossier including the Regulatory Positioning Memo, Runtime Governance Gap Assessment, AI Workflow Risk Map, Human-Agent Oversight Blueprint, and a prioritised 90-Day Governance Action Plan.
Tier 2 — Runtime Governance Blueprint translates the Tier 1 diagnostic into an enforceable oversight architecture, authority stratification, and escalation logic. Tier 3 — Safety OS / RGI Implementation deploys the runtime governance control layer, audit infrastructure, and operational governance with implementation support. Both are priced upon request.
EU AI Act high-risk obligations become enforceable on 2 August 2026. If your AI lands in a high-risk category, operational, transparency, and human-oversight requirements apply by default. Teams retrofitting under deadline pressure are visible to procurement and regulators as exactly that.
Andy Squire, Founder of PatientCentricCare.AI and Architect of the Physician-as-Pilot Safety OS. 20+ years inside regulated pharma (Roche, Novartis, Takeda) and four AI healthcare programmes (Harvard Medical School, Oxford Saïd, Microsoft/INSEAD, Cambridge).
No. The Readiness Sprint is an operational governance readiness assessment. It does not replace legal advice, formal conformity assessment, notified body review, or regulatory certification. It helps organisations identify practical governance gaps, evidence gaps, and runtime control requirements before procurement, clinical governance, or regulatory scrutiny.
Some AI workflows interact with people who may be vulnerable because of age, disability, illness, cognitive change, loneliness, or dependency. The Readiness Sprint reviews whether the workflow includes transparency, non-manipulation, escalation, and authority-boundary controls so the system supports users without exploiting vulnerability.
No. Safety OS and the Readiness Sprint help organisations operationalise and evidence governance controls aligned with regulatory expectations. Compliance depends on the specific AI system, use case, legal role, risk classification, deployment context, and applicable sector regulations.
PatientCentricCare.AI helps organisations operationalise human authority, bounded autonomy, and runtime governance — before regulatory pressure forces retrofits.
Tier 1 — CHF 1,600 – 2,200 · 2-week sprint · one workflow.