RUAIH evidence — the artifacts an assessor asks to see

The question a surveyor actually asks is never “do you have governance?” It is “show me.” This page lists what show me means across the five focus areas, using the evidence column of the Institute’s published crosswalk.

Governance (area 1)

• AI governance committee charter — the accountable body exists
• Organisational AI policy — the rules of the road, adopted
• AI use-case registry — the inventory everything else references
• Board reporting pack — oversight reaches the top
• Programme resourcing plan — governance has people and budget, on paper

Effective data management (area 2)

• Data use agreement and access policy — what data AI may touch, and how
• Access control and audit log review record — a dated record, not a setting

Risk and bias reduction (area 3)

• Intake and risk-tiering procedure — how new AI gets classified
• Local bias assessment — equity examined on your population
• Vendor AI disclosure request and completed questionnaire — third parties answered in writing

Monitoring, evaluating and validating (area 4)

• Local validation study protocol and result — it worked here, before deployment
• Monitoring plan with named thresholds — the number, the line, the owner
• AI safety event reporting route — where an AI incident goes

Transparency, education and training (area 5)

• Patient disclosure standard — what patients are told, standardised
• Training curriculum and completion records — who was trained, dated

Two artifact species hide in this list. The drafted kind (charters, policies, procedures) can be produced in a focused week — or bought pre-drafted in the artifact pack. The accumulated kind — monitoring records against thresholds, audit-log reviews, training completions — has a date column that cannot be falsified and cannot be rushed. Preparation order follows directly from that distinction, and HAI-OS exists to make the accumulated kind accumulate itself.