RUAIH focus area 2 — Effective data management

AI systems are data systems with opinions. Area 2 asks whether the data side is governed: what an AI may consume, who may reach it, and whether anyone is actually watching.

The two controls

Data governance. The rules for AI’s use of organisational data: purposes, permissions, minimum-necessary discipline, and how outputs are handled as new data in their own right. Evidence: a data use agreement and access policy that names AI explicitly rather than hoping older policy stretches to cover it.

Data security controls. Access restriction and audit logging around AI systems and their data flows — with the emphasis on the word record. The evidence artifact is a dated access-control and audit-log review, because a configuration screenshot proves a setting existed on the day of the screenshot, while a review record proves the control operates.

The practical read

Most health systems enter this area strongest — HIPAA has drilled the disciplines for two decades. The gap is specificity: policies that never mention AI, logs nobody reviews on a schedule, model vendors whose data handling was accepted on a security questionnaire written before generative AI existed. Closing the gap is mostly naming AI in the machinery you already run — and starting the review cadence whose records, like all accumulated evidence, only count from the date they begin.