How to prepare for RUAIH — the order that matters

Most preparation guides list controls alphabetically or by framework section. The useful ordering is different: by which clocks cannot be started retroactively.

1. The inventory — because everything references it

Every framework in this space begins with knowing what you run: model, vendor, care setting, function, risk level. It is unglamorous, it takes a week of asking around, and every subsequent control depends on it. You cannot govern an inventory you do not have.

2. The committee — because decisions need an owner

A chartered governance body with real members and a standing agenda. Not because the charter is hard — it is a document — but because its minutes are accumulating evidence, and minutes only accumulate from the first meeting forward.

3. Baselines and monitoring — the clock that punishes waiting most

For your highest-risk models: lock the performance number the model was approved at, set a threshold with clinical owners, and re-check quarterly, in writing. A year of quarterly attestations takes — exactly a year. This is the evidence category no budget compresses, and the one that will separate the prepared from the certified-in-a-hurry. It is also the reason the interval before the standards manual is the cheap one to work in, which the quiet period argues in full.

4. Training records — same logic, softer clock

Role-specific training, with completion recorded. Backfilling who was trained when is somewhere between painful and impossible.

5. The drafted documents — last, deliberately

Policies, procedures, disclosure standards: a competent week whenever it happens. They go last not because they are unimportant but because they are rushable — and the artifact pack exists precisely so the week becomes a day.

The readiness score tells you which of these five is your actual gap; HAI-OS turns steps 1 and 3 into a living record instead of a spreadsheet that goes stale.