What your instrument says
NHS provider boards work to a code of governance for the sector and to a board assurance framework that names risks, controls and sources of assurance. The structure is better than most private boards have.
What it assumes is that a control named in the framework is a control that operates. For a control whose operative part is a human reading a machine’s output, that assumption is the thing to test rather than the thing to record.
What it does not answer
Whether the clinician or officer named as the human check has the time, the information and the standing to disagree with the system. Standing matters more here than anywhere: a junior member of staff overruling a tool the trust has bought is making a career decision as well as a clinical one.
Whether a decision could be reconstructed for a coroner, an inquiry or an ombudsman six months later, and by whom. And what the service could still do if the system were unavailable for a fortnight, which is a continuity question that has usually been answered on paper and not tested.
What you can establish before your next meeting
Which systems in use today produce an output a person is expected to act on. How each of them arrived: procurement, pilot, supplier upgrade, or nobody quite knows. Who is named in the assurance framework as the control, and whether that person knows they are.
And the override count, which in this sector is the single most useful number a board can ask for. Staff who have never disagreed with a system have either never had reason to, or have learned that disagreeing is expensive. Those are very different findings and the board should know which it has.
Where this is the wrong call
I do not write AI risk registers, map controls against the EU AI Act, run conformity assessments, build governance frameworks or draft committee papers. Firms that do that work properly exist and several of them are very good. This is the question those exercises leave open: whether the people named in your framework could actually detect a wrong answer, whether anyone has ever overridden a system, and what the organisation could still do if it stopped.
Regulatory position last checked: September 2026. If you are reading this much later, check the dates before you rely on them.
