Lesson 1 of 6 · 6 minutes
What AI governance means
Start with one question: what would need to be in place for you to trust an AI tool in a real clinical workflow?
Governance makes responsibility practical
AI governance is the set of responsibilities, decisions, rules and checks used to oversee AI throughout its life. It connects the clinical purpose of a tool with the evidence for using it, the people affected, the permitted data use and the action to take when something goes wrong.
Ethics asks what ought to be done. Regulation establishes obligations where the law applies. Governance organises how people make and document those decisions. Assurance is the evidence that relevant requirements and safeguards have been met. These activities overlap.
Different tools create different risks
Predictive AI may classify an image or estimate a probability. Generative AI creates text, images or other content, such as a consultation summary. An AI agent can also use connected tools and carry out actions. A system that can change a record or send an instruction needs controls over those actions as well as the quality of its words.
A useful first description is precise: 'This tool drafts an outpatient letter for a clinician to verify.' 'It helps with healthcare' does not define a safe scope. Even an administrative output can affect care if an incorrect statement later becomes part of the clinical record.
Five layers to recognise
A framework can be voluntary in general yet become relevant through a contract or local policy. Always ask who issued it, what kind of instrument it is, and where it applies.
| Layer | What it contributes | Example |
|---|---|---|
| Ethical principles | Values used to judge benefits, harms and fairness | WHO health AI guidance |
| Law and regulator guidance | Obligations and explanations of their application | EU AI Act; national medical-device rules |
| Standards and assurance | Structured processes and evidence | ISO/IEC 42001; NHS England DTAC |
| Professional standards | Duties attached to clinical practice | GMC guidance in the UK |
| Local governance | Approval of the particular use, people and workflow | Your organisation's safety, data and procurement processes |
Responsibility is shared across roles
Developers and manufacturers are responsible for the work within their role. A deploying organisation controls local adoption, training, monitoring and support. Clinicians remain responsible for the decisions they take and the records they approve. Patients and affected communities should have opportunities to understand and question AI use.
In the UK, the GMC expressly recognises that developers, employers and clinicians have different responsibilities. The statement 'the doctor is always legally liable for every AI error' is too broad. Accountability needs to be defined, rather than simply pushed to the last person who clicked a button.
Key takeaway
Identify the exact use, the responsible people and the evidence needed. A governance framework is useful when it changes how the service behaves.
You have reached the end of this lesson.
Read to the end, complete the knowledge check if present, and explore all three cases in Lesson 6 to continue.