Cross-Cutting Work Groups
Description
Develop a standardized, risk-proportional set of AI intake controls and evidence expectations that a vendor can complete once and have accepted by many health systems. The goal is to cut duplicated questionnaires and speed a solution's path through AI governance.
Timeline
Q1 2026 - Q4 2026
Deliverables
, a companion to the Subdomain 4.4: Third Party Management Playbook in the CHAI AI Governance Playbook series. It covers the first two phases of third-party management: AI intake and risk assessment. The playbook comes with the CHAI AI Intake Controls and Evidence workbook, which includes:
57 intake controls across 11 domains, each a plain-language yes/no statement, drawn from more than 800 questions in real health system intake questionnaires
Risk-tiered application: 16 baseline controls apply to every vendor, and the rest are added for Low, Medium and High risk tiers
13 evidence packages that group the documents vendors already keep, such as a BAA, SOC 2 report or validation study
CHAI Applied Model Card mapping: 72% of controls are fully or partly answered by a completed Applied Model Card
The 11 control domains are:
Clinical Safety & Effectiveness
Data Integrity & Lineage
Fairness & Non-Discrimination
Governance Structure & Oversight
Impact Measurement & ROI
Legal & Regulatory Compliance
Model Validation & Performance Monitoring
Security & Access Control
System Reliability & Resilience
Transparency & Traceability
User Experience & Workflow Integration
Next Phase: Pilot
The work group will pilot the draft controls with vendor and health system pairs. The pilot will measure vendor effort, whether the evidence is sufficient, review cycle time, and reuse across institutions. Pilot findings will shape the final version. CHAI is looking for health systems and AI vendors to take part, especially pairs already in an active procurement. Contact greg@chai.org.