Selected as Best Overall Capstone
Harvard Medical School Executive Education, "AI in Healthcare," February 2026
As featured in USA Today, Business Insider, Newsbreak
Prepare your AI systems for trusted deployment through practical governance aligned with the EU AI Act, ISO/IEC 42001 and ISO/IEC 23894.
AI Act Audit Readiness Sprint™ — a two-week operational governance assessment for regulated AI workflows.
Built for AI healthcare startups, SaMD and digital therapeutics companies, clinical AI vendors, insurers and care providers deploying AI. The Sprint answers the question buyers and boards keep asking: are you investor-ready, procurement-ready, and AI Act ready?
In two weeks you walk away with a board-ready evidence pack — your AI Act position, prioritised gaps, and a 90-day action plan for one AI workflow.
PRACTITIONER CREDENTIALS
AI governance for healthcare is a new discipline. We invest in formal certification alongside real-world deployment experience to ensure our assessments meet the standard regulators expect.
EXIN Artificial Intelligence Compliance Professional (AICP) · Certificate No. 12602/2026 · July 2026
Governance Framework Alignment
Our assessments are informed by recognised international governance, risk and lifecycle frameworks — so findings map cleanly to the expectations of auditors, procurement teams, and clinical governance boards.
AI Governance
ISO/IEC 42001
AI Risk Management
ISO/IEC 23894
AI Lifecycle
ISO/IEC 5338
Enterprise AI Risk
NIST AI RMF
Data Quality
CEN/CLC/TR 18115:2024
Ethics & Human Rights
ISO/IEC TR 24368
Regulatory Alignment
EU AI Act
Healthcare AI
MDR / IVDR / GMLP
Framework alignment supports a structured, defensible assessment. Framework alignment is used for assessment mapping only; it does not imply certification, accreditation, or formal conformity with any standard. CEN/CLC/TR 18115:2024 (European AI data-governance and quality) aligns with the international ISO/IEC 5259 series.
FREE SELF-ASSESSMENT
Not sure where your AI system may fall under the EU AI Act? Start with the public EU AI Act compliance checker to understand possible risk classification, obligations, and next questions — in under 5 minutes.
Start Free Compliance Check →This is a self-assessment starting point, not legal advice or a substitute for formal regulatory review.
EXPLAINER VIDEO SERIES
Operational Governance Readiness for Healthcare AI
Why Most AI Audits Fail
Most AI audits focus on documentation. They review policies, procedures and controls. However, regulators increasingly expect organisations to demonstrate more than paperwork.
Documentation is necessary. Operational governance is what ultimately matters.
Our approach combines regulatory analysis, governance frameworks and practical implementation guidance to help healthcare AI organisations move from compliance theory toward demonstrable governance capability.
How We Assess AI Governance
Every assessment follows the same defensible logic, applied to one named workflow or deployment context.
Step 1
Classify the AI system — its purpose, risk tier, and exposure under the EU AI Act.
Step 2
Identify the responsible actor — provider, deployer, or both — and where accountability sits.
Step 3
Determine the applicable obligations that follow from the classification and actor role.
Step 4
Assess governance evidence — whether the organisation can actually demonstrate each obligation.
Classification → Actor → Obligation → Evidence. This mirrors how regulators and auditors reason about AI systems — and where most organisations have gaps.
The Problem
Document reviews, model evaluations, and pre-deployment checklists are necessary — but they describe intent, not behaviour. They do not tell you what your AI will actually do in production, on the day it acts.
01
A policy that is not technically enforceable at runtime is a statement of intent. It does not stop an AI from acting beyond its authority.
02
Logs describe what happened. They do not constrain what is allowed to happen, who must approve it, or when an action must halt.
03
Dashboards observe systems after the fact. Operational control means decisions can be bounded, escalated, and reversed in real time.
Regulators increasingly care about what happens while AI is acting — not only what was documented before deployment.
Policies define intent. Runtime governance provides the evidence auditors, clinical boards, and procurement teams increasingly expect.
EU AI Act Alignment
The Readiness Sprint is not legal advice or a formal conformity assessment. It helps your team understand whether one AI workflow has the operational controls and evidence expected in regulated deployment contexts.
Art. 14
Can human authority be exercised at the moment of decision, with clear approval, override, and escalation pathways?
Art. 12
Can the organisation reconstruct what happened, when it happened, who reviewed it, and what action was taken?
Art. 9
Are workflow-level risks identified, classified, monitored, and controlled across the AI lifecycle?
Art. 50
Are users clearly informed when they are interacting with AI, especially in patient-facing, caregiver-facing, or senior-facing workflows?
Art. 5
Are controls in place to prevent manipulation, dependency creation, or exploitation of age, disability, cognitive vulnerability, loneliness, or social isolation?
Operational Governance Readiness
A nine-domain operational maturity matrix — not a document review. We compare your current state with what regulated agentic AI demands at runtime, in plain commercial language.
| Governance Area | Typical Organisation State | What We Assess |
|---|---|---|
| AI Inventory | Partial register, scattered across teams. | Whether every agentic workflow is identified, owned, and classified by risk and authority. |
| Workflow Risk Classification | Treated as model-level risk, not workflow-level. | Risk tiering of each workflow against EU AI Act exposure, clinical impact, and reversibility. |
| Human Oversight | Human-in-the-loop on paper; review after the fact. | Whether oversight exists at the moment of decision, not as retrospective review. |
| Runtime Controls | Guardrails defined, rarely enforceable in production. | Whether technical controls can bound, halt, or correct an AI action while it is happening. |
| Escalation Pathways | Implicit, undocumented, person-dependent. | Deterministic escalation logic — who is paged, when, and with what authority to override. |
| Auditability | Logs exist; reconstruction of decisions is hard. | Whether any past AI decision can be replayed end-to-end with the evidence regulators expect. |
| Consent Governance | Consent captured upstream, not enforced downstream. | Whether consent is bound to data, agents, and actions at runtime — not stored as a checkbox. |
| Operational Authority Boundaries | Unclear what an AI is allowed to decide vs. recommend. | Risk-tiered AI authority: where autonomy ends and human approval is mandatory. |
| Regulatory Evidence Readiness | Scattered artefacts, no single defensible package. | Whether the organisation can produce regulator-ready evidence on demand for a named workflow. |
| Vulnerable User & Transparency Safeguards | AI is friendly and helpful, but transparency, non-manipulation, and dependency safeguards are implicit. | Whether patient-facing or senior-facing AI workflows clearly disclose AI interaction, avoid persuasive exploitation, maintain non-medical boundaries where required, and escalate appropriately. |
This is operational governance readiness — not a document review. It produces specific, prioritised actions tied to one named workflow or deployment context.
What You Receive
Designed for organisations evaluating regulated AI deployment, governance maturity, or EU AI Act preparedness. Every engagement produces a board-ready package your regulatory, clinical and executive teams can act on immediately.
We assess one specific workflow or deployment context against runtime governance requirements, then deliver a board-ready package your regulatory, clinical, and executive teams can act on immediately.
Fixed scope. Fixed price. Fixed two-week delivery.
Likely AI classification, EU AI Act exposure, and operational governance implications — translated into commercial and clinical decisions. Includes review of transparency duties and vulnerable-user safeguards where the workflow interacts with patients, caregivers, seniors, or other protected groups.
Identifies where current workflows lack enforceable runtime controls — not where documentation is missing.
Visual matrix mapping each workflow to risk tier, allowed autonomy, and required oversight — the spine of operational governance.
Preliminary HAT operational model: escalation pathways, authority boundaries, and where human approval is non-negotiable.
What to fix first, what to fix next, and how to evidence each control to regulators, clinical boards, and procurement.
Assessment of whether the workflow includes adequate transparency, non-manipulation, escalation, and boundary controls for patient-facing, caregiver-facing, or senior-facing AI use cases.
Clarifies your role under the EU AI Act — provider, deployer, or both — and the obligations that follow for the assessed workflow.
Maps the workflow against recognised frameworks — ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 5338, CEN/CLC/TR 18115:2024 and NIST AI RMF — to surface where governance evidence is strong and where it is thin.
Reviews how EU AI Act obligations interact with healthcare-specific regimes (MDR / IVDR / GMLP) for the assessed workflow, so duplicate or conflicting requirements are visible early.
See It Before You Buy
A look at the format and decision-grade clarity each engagement produces — so you can picture exactly what lands in your two-week dossier.
Illustrative examples only — representative of format and depth, not drawn from any specific client engagement. Classifications and obligations are determined per workflow during the Sprint.
How It Works
A focused engagement built for clarity and decision-pressure — not open-ended consulting.
Week 0
Structured 60-minute deep-dive. We agree on the single workflow or deployment context to assess and the decisions the diagnostic must inform.
Weeks 1–2
Runtime governance assessment, oversight architecture review, targeted stakeholder interviews. Mid-sprint direction-check with your team.
End of Week 2
Two-hour executive readout. Final memo, AI Workflow Risk Map, oversight blueprint, and 90-day action plan delivered as one PDF dossier.
Focused engagement. One workflow or deployment context. Not unlimited consulting scope.
AI Governance Maturity
Most organisations are further down this path than they realise — and the gap to audit readiness is usually operational, not documentary.
Level 1
AI is used in pockets. Tools are adopted ahead of governance, with little central visibility or risk classification.
Level 2
Policies, procedures and controls exist on paper. Governance is documented, but not yet demonstrably enforced in practice.
Level 3
The organisation can evidence governance for named workflows on demand — classification, oversight, and accountability are demonstrable.
Level 4
Governance is embedded in day-to-day operations. Oversight, escalation and evidence capture run as routine practice, not exception.
Level 5
Governance is enforced at the moment AI acts — bounded autonomy, real-time oversight, and replayable evidence built into the system.
Designed For
The Sprint is scoped for healthcare and regulated environments where AI decisions carry real-world consequences.
| Role | Why they engage |
|---|---|
| CEO | Investor and procurement readiness — remove AI as a deal-stage risk. |
| Founder | Resolve EU AI Act uncertainty before it blocks customers or funding. |
| Head of Quality | Generate defensible governance evidence for audits and clients. |
| Compliance Lead | A structured gap assessment against recognised frameworks. |
| Chief Medical Officer | A credible human-oversight model for patient-facing AI. |
| Product Lead | Confirm high-risk classification and the obligations that follow. |
Honest Scope
Clarity on what this Sprint is, and what it deliberately is not, so the engagement is the right fit before we start.
Beyond Readiness
Tier 2 and Tier 3 are enterprise engagements designed for organisations operationalising runtime governance for regulated agentic systems.
Tier 2 — Pricing on request
Detailed oversight architecture for one or more priority workflows.
Tier 3 — Pricing on request
Operational deployment of Runtime Governance Infrastructure.
What Success Looks Like
This is what founders and governance leads actually buy — not a report, but a defensible position and a decision.
The Sprint is a readiness assessment, not legal advice, MDR certification, or a notified-body assessment. It tells you where you stand and what to do next.
Founder, PatientCentricCare.AI
Architect, Physician-as-Pilot™ & Safety OS™
Basel, Switzerland
Frequently asked questions
Most AI readiness audits assess documents and models. We assess whether your organisation is operationally ready to safely govern AI systems at runtime. Policy is not enforcement, logging is not governance, and monitoring is not operational control.
Nine assessment domains for one named workflow: AI inventory, workflow risk classification, human oversight, runtime controls, escalation pathways, auditability, consent governance, operational authority boundaries, and regulatory evidence readiness — including vulnerable-user and transparency safeguards where the workflow is patient-, caregiver- or senior-facing. These map directly to the nine deliverables listed in “What You Receive”.
CHF 1,600 for a startup or single workflow; CHF 2,200 for a regulated healthcare organisation or multi-stakeholder workflow. Fixed scope, delivered over two weeks against one workflow or deployment context. Each Sprint is delivered directly by Andy Squire, and capacity is intentionally limited to ensure depth and defensibility.
A board-ready PDF dossier containing nine deliverables: the Regulatory Positioning Memo, Runtime Governance Gap Assessment, AI Workflow Risk Map, Human-Agent Oversight Blueprint, Prioritised 90-Day Governance Action Plan, Vulnerable User & Transparency Safeguards Review, Provider / Deployer Assessment, Framework Alignment Assessment, and Healthcare Regulatory Interaction Review.
Tier 2 — Runtime Governance Blueprint translates the Tier 1 diagnostic into an enforceable oversight architecture, authority stratification, and escalation logic. Tier 3 — Safety OS / RGI Implementation deploys the runtime governance control layer, audit infrastructure, and operational governance with implementation support. Both are priced upon request.
EU AI Act high-risk obligations become enforceable on 2 August 2026. If your AI lands in a high-risk category, operational, transparency, and human-oversight requirements apply by default. Teams retrofitting under deadline pressure are visible to procurement and regulators as exactly that.
Andy Squire, Founder of PatientCentricCare.AI and Architect of the Physician-as-Pilot Safety OS. 20+ years inside regulated pharma (Roche, Novartis, Takeda) and four AI healthcare programmes (Harvard Medical School, Oxford Saïd, Microsoft/INSEAD, Cambridge).
No. The Readiness Sprint is an operational governance readiness assessment. It does not replace legal advice, formal conformity assessment, notified body review, or regulatory certification. It helps organisations identify practical governance gaps, evidence gaps, and runtime control requirements before procurement, clinical governance, or regulatory scrutiny.
Some AI workflows interact with people who may be vulnerable because of age, disability, illness, cognitive change, loneliness, or dependency. The Readiness Sprint reviews whether the workflow includes transparency, non-manipulation, escalation, and authority-boundary controls so the system supports users without exploiting vulnerability.
No. Safety OS and the Readiness Sprint help organisations operationalise and evidence governance controls aligned with regulatory expectations. Compliance depends on the specific AI system, use case, legal role, risk classification, deployment context, and applicable sector regulations.
PatientCentricCare.AI helps organisations operationalise human authority, bounded autonomy, and runtime governance — before regulatory pressure forces retrofits.
One workflow. Fixed scope. Board-ready evidence pack within two weeks.PatientCentricCare.AI aligns its governance approach with the principles of the EU AI Act and recognised AI governance frameworks including ISO/IEC 42001 and ISO/IEC 23894. Our objective is not simply compliance, but helping organisations deploy AI safely through trusted continuity, transparency and meaningful human authority.