The dashboard exists. The metric drifts.
Nobody owns the decision to pause the tool.
HAI-OS is the operating system for that exact failure: a registry of every clinical AI model you run, quarterly attestations judged against locked baselines, automatic suspension when performance breaches the threshold your own clinicians chose, sign-offs that name a person — and a survey-ready binder assembled from the live record in one click.
This is not a screenshot — it is the live platform on a real governance record. Scroll it, open a model, generate a binder. Open it full-screen with the guided walkthrough →
What it does, in the order a surveyor asks
Agent privileging — new
AI that acts — scribes, prior-auth bots, schedulers — governed the way clinicians are: a written scope of action, a proctoring period, action-level audit, and automatic suspension the moment an agent acts outside its scope. Live in the demo · the public framework.
The registry
Every model, its vendor, care setting, clinical function and risk tier. Registration is deliberately light — the inventory is the foundation of every framework, and a registry that demands the full dossier up front stays empty.
Locked baselines
The performance number (AUROC — the standard accuracy metric) a model was approved against, locked and insert-only. A new baseline supersedes the old on the record — it never edits it. The drift threshold is chosen at lock time by the people who know the model.
Automatic drift enforcement
Quarterly attestations compute decay against the locked baseline. Breach the threshold on an active model and suspension is automatic, in the same request, with the audit entry written first. Continuation is what needs a signature.
Accountable sign-offs
You sign as who you are signed in as. Deployment, suspension, reactivation and retirement require an organisation administrator, carry a stated rationale, and anchor a signature hash in the audit chain.
A tamper-evident record
Every governance action lands in a hash-linked chain, per institution. Each entry's SHA-256 covers its content and the previous entry's hash, so a retro-edit breaks verification from that point forward. The chain verifies itself on every load of the overview.
The survey binder
When the surveyor asks for the governance record of your sepsis model, the answer is one download: identity, every baseline, every quarterly look, every signature, the framework crosswalk — and the chain's own verification verdict inside the document.
What it never holds
No patient data, by construction. Models carry metadata; baselines and attestations carry aggregate statistics — an AUROC is a property of a model, not of a person. The free-text fields are capped short and exist for operational notes. Nothing in the schema can hold PHI, which is a stronger claim than a policy that says it should not.
Frameworks
Each model maps its controls to Joint Commission RUAIH (2026), CHAI and the NIST AI RMF, with per-control status and evidence notes. The overview shows implementation progress per framework; the binder carries the full crosswalk.
Licensing
HAI-OS Platform
- Unlimited models, seats by email domain — no roster to maintain
- Registry, agent privileging, drift enforcement, sign-offs, crosswalk, binder export
- The tamper-evident audit chain, verified on every load
- Card below, or invoiced with a BAA where counsel wants one
- No sales call required — demo, purchase and onboarding are fully self-serve, by design
Renews annually; cancel any time before renewal. Receipt and workspace access arrive by email the moment payment completes.
Prefer an invoice, a purchase order, or quarterly payments? →With the RUAIH Enterprise Licence
- The platform ships with the RUAIH Artifact Pack enterprise licence
- Sixteen governance artifacts, editable source, internal reuse rights
- One 60-minute implementation call
The Institute accepts no vendor sponsorship, holds no vendor equity and takes no referral fees. The platform scores no vendors and recommends none — it holds your governance record, which is yours.
The ladder, plainly
Each tier is the one below it, plus the line in bold. Buy the rung you need; upgrade pricing is the difference, not a restart.
| Tier | Price | What it adds |
|---|---|---|
| Artifact Pack | $497 | The sixteen governance artifacts, drafted, single-organisation licence. |
| Enterprise Licence | $1,497 | Internal reuse rights and editable source files, plus one 60-minute implementation call. |
| Membership | $4,500/yr | Quarterly artifact updates and four group calls a year — the pack, kept current. |
| HAI-OS Platform | $15,000/yr | The governance software: registry, automated drift enforcement, sign-offs, survey binders. Includes the enterprise licence. |
What happens after you buy
1. Pay, then sign in
Card checkout takes two minutes. Sign in with your work email at the library — no password, a magic link — and the platform is already yours: you are the organisation's first administrator.
2. Your team just… arrives
Anyone signing in with your organisation's email domain joins your workspace automatically, up to your seat limit. There is no roster to upload and no invitations to chase. Sign-offs that move a model's status stay administrator-only.
3. The cockpit walks you in
Your registry opens with a four-step checklist — register the first model, lock its baseline, sign its deployment, attest the quarter — and a guided walkthrough you can replay any time. Fourteen days in, most of the governance record a surveyor asks for already exists.
4. Support without the sales org
A fourteen-day onboarding sequence lands in your inbox automatically, the walkthrough is replayable forever, and email support is answered by a human within one business day. We built the platform to not need an account manager — that is a design decision, not a staffing gap.
What a security review will ask, answered first
Where it runs
Cloudflare's global edge network. The database is Cloudflare D1 with point-in-time recovery; files sit in Cloudflare R2. No third-party analytics or trackers run inside the platform.
What we hold
Model metadata, aggregate statistics, sign-off records and the audit chain. No PHI can enter by construction. Authentication is passwordless magic-link — there is no password database to breach.
Departed employees
Seats attach by work-email domain at sign-in, and every action re-checks the licence at the moment of use. Removing a person from your organisation removes their access on their next request, not at their next login.
If the licence lapses
Your record is yours. The survey binder export — the full governance record as structured JSON — is available throughout the licence and on exit. We do not hold your evidence hostage to a renewal.
Certifications
No SOC 2 report exists today, and this page will not imply otherwise. The infrastructure providers publish their own attestations; ours is on the roadmap and this sentence will change when it is real.
Agreements
Invoiced annually. Business associate agreement available where your counsel wants one, though the platform is designed so no PHI ever reaches us.