The AI you are probably already running
Most of these arrive as a feature of something you bought rather than as a project anyone called AI. That is exactly why they are missing from the register.
- Triage and prioritisation toolsShapes who is seen first. Needs a named owner and a clinician who can question it.
- Diagnostic and imaging supportThe highest-stakes category in most estates, and the one where oversight has to be recorded rather than assumed.
- Risk stratification and deterioration scoresPredicting who needs attention first. A clinical decision by any other name.
- Ambient scribes and clinical documentationFast-growing, often adopted at service level, and processing consultations in full.
- Patient contact, booking and chatbotsHandling people who may be unwell, distressed or reporting symptoms.
- Capacity, rostering and flow predictionOperational rather than clinical, but it shapes who gets seen and when.
- Research and secondary-use analyticsWhere consent, anonymisation and purpose limitation get complicated fast.
The line that matters runs through the middle of your estate
Some of your AI shapes what happens to a patient, and some of it schedules a room. Those need entirely different levels of scrutiny, and most organisations hold them in the same undifferentiated list — or in no list at all. Drawing that line is the first useful thing you can do, and it is hard to do without a register.
The second problem is discovery. Ambient scribes and assistants arrive service by service, adopted by clinicians solving a real workload problem, and they process consultations in full. They rarely go through the route a diagnostic tool would. By the time anyone central hears about them they are established practice.
What you get
Clinical and non-clinical, separated
Classify each system by what it actually influences, so the tools shaping patient care are triaged separately from rostering and demand forecasting.
Special category data flagged
Health data recorded per system, with lawful basis and DPIA status alongside it, so the systems carrying the most sensitive processing are obvious at a glance.
Human oversight maturity per system
How much a clinician can see, question and overrule — recorded per system rather than assumed because a product is certified.
Shadow AI surveys across services
Ambient scribes and assistants adopted at service level are the fastest-growing part of most estates. Surveys find them before anyone else does.
Incident logging tied to systems
When something goes wrong, the record attaches to the system that caused it, so a pattern across three services reads as a pattern.
Assurance reviews on a schedule
Structured reviews per system with evidence attached, so the position is current rather than reconstructed at procurement time.
What changes
Clinical and non-clinical AI separated
Which systems influence what happens to a patient and which do not, so scrutiny concentrates where the consequences are.
One register, held centrally
Every AI system in one place with a named owner, the data it uses and the oversight around it — the thing every downstream assessment starts by asking for.
The informally adopted tools, found
Ambient scribes and assistants adopted at service level are the fastest-growing part of most estates and the least likely to have been assessed.
Answers ready, not reconstructed
What systems exist, what data they process and who is accountable — recorded continuously, so procurement and assurance questions are an export rather than a fortnight of chasing.
CXO Ready is an aid, not an assurance. It helps you structure your thinking, record what you have done and see where the gaps are. It does not make you compliant, and nothing it produces is legal advice or a regulatory opinion. Scores are indicative. Responsibility for compliance stays with your organisation, and decisions with legal consequences should be taken with a qualified adviser.
Before you start
Questions from healthcare & nhs
How do you separate clinical from non-clinical AI?
By what each system actually influences, recorded per system rather than inferred from what it was called at procurement. Anything shaping diagnosis, triage, treatment or monitoring is classified and triaged separately from rostering, demand forecasting and back-office tools, so scrutiny lands where the consequences are.
Does buying a certified product mean we can stop there?
No. How a product behaves in your setting, with your patients and your workflows, is your question rather than the vendor's. CXO Ready records the oversight, ownership and data handling for the system as you actually run it, which is the part a vendor certificate says nothing about.
Do ambient scribes need governing?
Yes, even though they usually are not shaping the clinical decision. They process entire consultations, at volume, often in settings where patients have not been told. Lawful basis, DPIA status and data handling get recorded per system, and the discovery surveys are usually how they turn up in the first place.
Does the EU AI Act apply to a UK health provider?
Usually not directly, if you treat patients only in the UK. It is still worth holding a position against it, because it increasingly appears in supplier questionnaires and gives you a defensible way to classify systems. CXO Ready scores each system against it alongside GDPR either way.
Where should we start?
By separating clinical from non-clinical, then working through the clinical side in order of consequence. Most organisations find the harder problem is discovery — knowing which services have adopted something — rather than assessment, which is why the surveys usually come first.
More in the full FAQ, or ask us directly.
Other sectors