AI GRCAPractice Lab
Step 1 of 5Brief
01 · Guided scenario · Health

Read the scenario brief

Demo mode — sign in to save your work

Treat the same governance assignment as a patient-safety and clinical-accountability decision. Delay may create harm, but unsafe launch can also harm patients or service users.

PRACTICE MODELoading

Restoring your saved mode and lab work…

HEALTH WORKING CONTEXT

Health operating brief

The system operates around sensitive health information and may influence clinical or service decisions. Patient safety and clinical accountability are material.

Evidence bar
  • Clinical safety case
  • Patient-group validation
  • Escalation, downtime and human-review protocol
WEEKS 12–16

AI management system simulator

Define the AIMS scope and operating model, then identify the most important implementation gaps.

Practical output
ISO AI Standards Crosswalk · AIMS Scope Statement · AIMS Context Register · AI Policy Extract · AI Objectives · ISO 42001 Operating Procedure · Control Mapping · Gap Assessment
FICTIONAL OPERATING ENTITY
HEALTH ENTITYNorthbridge Health NetworkBase training lab: Northbridge Health Network
“Define the AIMS scope and operating model, then identify the most important implementation gaps.”

Northbridge Health Network plans an AI assistant that summarises referral notes and suggests a service and urgency category. It uses a hosted language model with a local triage classifier; a qualified clinician must review every suggestion before the referral is routed.

IN SIMPLE TERMS

The health network wants AI to shorten referral notes and suggest where and how urgently a patient should be seen. A clinician checks the suggestion, but a poor summary or category could still delay care.

KNOWN FACTS
  • The assistant processes referral notes containing sensitive health information
  • A hosted language model creates the clinical-administration summary
  • A local classifier suggests one of 12 services and an urgency band
  • A qualified clinician can change the service and urgency before routing
  • Validation by patient group and clinical setting has not been completed
COMMERCIAL SIMULATION FILE

Inspect the evidence before you advise

The documents contain incomplete, conflicting and potentially unreliable evidence. Treat each claim according to its source.

OPERATING CONTEXT

The system operates around sensitive health information and may influence clinical or service decisions. Patient safety and clinical accountability are material.

COMMERCIAL PRESSURE

Operational leaders need capacity relief before the winter demand period and argue that delay also creates patient harm.

EXPECTED EVIDENCE
  • Clinical safety case
  • Validation by patient group and use setting
  • Escalation, downtime and human-review protocol
STEERING MEETING BRIEF

Conflicting demands, limited time, unclear ownership

Decision deadline
The steering committee meets in 10 working days. The launch slot will be lost if the decision is deferred beyond this meeting.
Budget constraint
Only GBP 28,000 remains in the assurance budget. Full independent testing was quoted at GBP 46,000, so the team must prioritise risk-based work.
Ownership gap
Product, Risk and Operations each believe another function owns final residual-risk acceptance. The governance charter is silent.
Executive sponsor

“Approve now with post-launch monitoring; delay threatens the business case.”

Risk partner

“Do not approve until critical evidence gaps and the unnamed risk owner are resolved.”

Operations lead

“The existing manual process is already failing service targets and creates its own harm.”

Supplier account director

“The product is proven in comparable organisations, but bespoke evidence requires a paid assurance package.”

OwnerChief Clinical Information OfficerClassificationInternal

Shows the reporting lines and decision rights relevant to the proposed AI use.

Executive sponsor
Chief Clinical Information Officer owns the business outcome and has requested the team to define the aims scope and operating model, then identify the most important implementation gaps. The decision must be judged against clinical safety case.
Delivery chain
Chief Clinical Information Officer -> Product Director -> AI Product Owner -> Data Science Lead -> Operations Manager. Procurement manages the supplier; Information Security and Data Protection are consulted.
Approval ambiguity
The Product Director believes Risk accepts residual risk. Risk states that the accountable business executive must accept it. No committee terms of reference name the final approver.
Three lines
First line operates the system; second line sets policy and challenges risk; Internal Audit has not included the system in its current plan.
YOUR REVIEWER

AIMS steering committee

Would this management system operate repeatedly, or is it only a collection of documents?

Start with evidence, not assumptions.

Record unknowns explicitly. Do not convert a supplier claim into a fact merely because it appears in the business case.

Lab overviewSave & continue