Regulatory Positioning Memo
Likely AI classification, EU AI Act exposure, and operational governance implications — translated into commercial and clinical decisions.
Selected as Best Overall Capstone
Harvard Medical School Executive Education, "AI in Healthcare," February 2026
SSRN Research Preprint Published March 2026
Assess whether your organisation is operationally ready to deploy AI safely, defensibly, and under continuous human governance.
Built for healthcare, pharma, and regulated AI environments under the EU AI Act.
The Problem
Document reviews, model evaluations, and pre-deployment checklists are necessary — but they describe intent, not behaviour. They do not tell you what your AI will actually do in production, on the day it acts.
01
A policy that is not technically enforceable at runtime is a statement of intent. It does not stop an AI from acting beyond its authority.
02
Logs describe what happened. They do not constrain what is allowed to happen, who must approve it, or when an action must halt.
03
Dashboards observe systems after the fact. Operational control means decisions can be bounded, escalated, and reversed in real time.
Regulators increasingly care about what happens while AI is acting — not only what was documented before deployment.
Operational Governance Readiness
A nine-domain operational maturity matrix — not a document review. We compare your current state with what regulated agentic AI demands at runtime, in plain commercial language.
| Governance Area | Typical Organisation State | What We Assess |
|---|---|---|
| AI Inventory | Partial register, scattered across teams. | Whether every agentic workflow is identified, owned, and classified by risk and authority. |
| Workflow Risk Classification | Treated as model-level risk, not workflow-level. | Risk tiering of each workflow against EU AI Act exposure, clinical impact, and reversibility. |
| Human Oversight | Human-in-the-loop on paper; review after the fact. | Whether oversight exists at the moment of decision, not as retrospective review. |
| Runtime Controls | Guardrails defined, rarely enforceable in production. | Whether technical controls can bound, halt, or correct an AI action while it is happening. |
| Escalation Pathways | Implicit, undocumented, person-dependent. | Deterministic escalation logic — who is paged, when, and with what authority to override. |
| Auditability | Logs exist; reconstruction of decisions is hard. | Whether any past AI decision can be replayed end-to-end with the evidence regulators expect. |
| Consent Governance | Consent captured upstream, not enforced downstream. | Whether consent is bound to data, agents, and actions at runtime — not stored as a checkbox. |
| Operational Authority Boundaries | Unclear what an AI is allowed to decide vs. recommend. | Risk-tiered AI authority: where autonomy ends and human approval is mandatory. |
| Regulatory Evidence Readiness | Scattered artefacts, no single defensible package. | Whether the organisation can produce regulator-ready evidence on demand for a named workflow. |
This is operational governance readiness — not a document review. It produces specific, prioritised actions tied to one named workflow or deployment context.
Tier 1 — Strategic Diagnostic
Designed for organisations evaluating regulated AI deployment, operational governance maturity, or EU AI Act preparedness.
We assess one specific workflow or deployment context against runtime governance requirements, then deliver a board-ready package your regulatory, clinical, and executive teams can act on immediately.
Fixed scope. Fixed price. Fixed two-week delivery.
Likely AI classification, EU AI Act exposure, and operational governance implications — translated into commercial and clinical decisions.
Identifies where current workflows lack enforceable runtime controls — not where documentation is missing.
Visual matrix mapping each workflow to risk tier, allowed autonomy, and required oversight — the spine of operational governance.
Preliminary HAT operational model: escalation pathways, authority boundaries, and where human approval is non-negotiable.
What to fix first, what to fix next, and how to evidence each control to regulators, clinical boards, and procurement.
How It Works
A focused engagement built for clarity and decision-pressure — not open-ended consulting.
Week 0
Structured 60-minute deep-dive. We agree on the single workflow or deployment context to assess and the decisions the diagnostic must inform.
Weeks 1–2
Runtime governance assessment, oversight architecture review, targeted stakeholder interviews. Mid-sprint direction-check with your team.
End of Week 2
Two-hour executive readout. Final memo, AI Workflow Risk Map, oversight blueprint, and 90-day action plan delivered as one PDF dossier.
Focused engagement. One workflow or deployment context. Not unlimited consulting scope.
Beyond Readiness
Tier 2 and Tier 3 are enterprise engagements designed for organisations operationalising runtime governance for regulated agentic systems.
Tier 2 — Pricing on request
Detailed oversight architecture for one or more priority workflows.
Tier 3 — Pricing on request
Operational deployment of Runtime Governance Infrastructure.
Founder, PatientCentricCare.AI
Architect, Physician-as-Pilot Safety OS™
Basel, Switzerland
Frequently asked questions
Most AI readiness audits assess documents and models. We assess whether your organisation is operationally ready to safely govern AI systems at runtime. Policy is not enforcement, logging is not governance, and monitoring is not operational control.
Nine governance domains for one named workflow: AI inventory, workflow risk classification, human oversight, runtime controls, escalation pathways, auditability, consent governance, operational authority boundaries, and regulatory evidence readiness.
CHF 1,600 to CHF 2,200, fixed scope, scope-adjusted to organisational complexity. Delivered over two weeks against one workflow or deployment context. One engagement per month to ensure depth and defensibility.
A board-ready PDF dossier including the Regulatory Positioning Memo, Runtime Governance Gap Assessment, AI Workflow Risk Map, Human-Agent Oversight Blueprint, and a prioritised 90-Day Governance Action Plan.
Tier 2 — Runtime Governance Blueprint translates the Tier 1 diagnostic into an enforceable oversight architecture, authority stratification, and escalation logic. Tier 3 — Safety OS / RGI Implementation deploys the runtime governance control layer, audit infrastructure, and operational governance with implementation support. Both are priced upon request.
EU AI Act high-risk obligations become enforceable on 2 August 2026. If your AI lands in a high-risk category, operational, transparency, and human-oversight requirements apply by default. Teams retrofitting under deadline pressure are visible to procurement and regulators as exactly that.
Andy Squire, Founder of PatientCentricCare.AI and Architect of the Physician-as-Pilot Safety OS. 20+ years inside regulated pharma (Roche, Novartis, Takeda) and four AI healthcare programmes (Harvard Medical School, Oxford Saïd, Microsoft/INSEAD, Cambridge).
PatientCentricCare.AI helps organisations operationalise human authority, bounded autonomy, and runtime governance — before regulatory pressure forces retrofits.
Tier 1 — CHF 1,600 – 2,200 · 2-week sprint · one workflow.