Deploying AI in a hospital: a go-live checklist

Most hospitals don't struggle to find a promising AI demo. The hard part is the step after it: running AI inside clinical and operational workflows, with patient data, every day, and with someone clearly accountable when it gets something wrong.

This checklist is for IT and operations leaders preparing a first AI use case for go-live. It is deliberately practical. It won't replace your clinical safety, information governance or legal teams, and it isn't legal advice; it helps you arrive at go-live with the questions they will ask already answered.

1. Choose one bounded first use case

A good first use case is narrow, useful and easy to check. Administrative and documentation work often fits better than anything that informs a diagnosis. Examples hospitals commonly consider include drafting summaries for a clinician to review and sign, summarising incoming referral letters, answering staff questions from internal policies, or handling non-clinical patient queries such as appointments and directions.

Before any build, write down:

• who will use it, and in which part of their day;
• exactly what goes in and what comes out;
• what decisions the output informs, and what it must never do on its own;
• how you will measure whether it helps, agreed before go-live rather than after.

Keep the first scope small enough that every output can be checked during the early weeks.

2. Control data access and keep audit logs

• Use the minimum data. Send only the fields the task needs. Keep personal data out of prompts wherever it isn't needed.
• Role-based access. The AI feature should see only what the person using it is allowed to see, enforced by the system rather than by the screen.
• Know where data goes. Record which AI providers are used, in which region data is processed and stored, which settings control retention and training, and which agreements cover each provider.
• Log every AI action. Who used it, when, which records were involved, what the model produced, which model and version, and what the person did with the output. Keep these logs under the same retention and access rules as the rest of your clinical systems.

3. Keep a human in charge of clinical outputs

• Anything touching diagnosis, treatment or medication is a draft until a qualified clinician reviews and accepts it.
• Label AI-generated content clearly in the interface, so nobody mistakes a draft for a decision.
• Make it easy to correct or reject an output, and record those corrections: they are your best signal of quality.
• Agree an escalation route for outputs that look unsafe, and who acts on reports.

4. Test on your own data before go-live

A model that performs well in a vendor demo can behave differently on your documents, terminology, abbreviations, languages and edge cases. Before go-live:

• test in a non-production environment, using data your governance process has approved for testing;
• compare outputs against what your clinicians or staff would have written, using cases they choose;
• test the failure modes on purpose: missing information, conflicting records, the wrong patient context, and outputs that state details not found in the source;
• check how the system behaves when the AI provider is slow or unavailable.

5. Train staff and explain the limits

Short, role-specific training beats a long general session. Cover what the tool is for, what it is not for, how to check an output, how to correct or reject it, and how to report a problem. Name an owner for the use case, so staff know who is accountable for it.

6. Monitor after go-live

• Review a sample of outputs regularly, with clinical input, and track the correction rate.
• Route problems through your normal incident reporting, tagged so AI issues can be found.
• Watch usage and AI cost, with limits that stop a runaway process.
• Re-test whenever the model, the provider or the prompt changes.
• Keep an off switch, and a manual fallback that staff already know.
• Set a review date to decide whether to continue, change or stop.

The regulatory frame depends on your market

What you must do depends on where you operate, and your compliance and information governance teams lead on it. Some examples of the frameworks involved:

• United States: HIPAA's Privacy and Security Rules apply to protected health information, and vendors that handle it on your behalf typically sign a business associate agreement (BAA).
• United Kingdom: NHS organisations work within NHS data security and clinical safety standards, such as the Data Security and Protection Toolkit and the clinical risk management standards for health IT (DCB0129 and DCB0160), alongside UK GDPR.
• United Arab Emirates: health data falls under federal rules and the requirements of health authorities such as the Department of Health – Abu Dhabi, the Dubai Health Authority and the Ministry of Health and Prevention, including requirements on where health data is stored.

Other markets, including Europe and Australia, have their own rules. A delivery partner should work within your compliance and security team's requirements. Certification stays with your organisation and your auditors.

The checklist

• One bounded use case, with users, inputs, outputs and limits written down
• Success measures agreed before go-live
• Minimum data, role-based access, and personal data kept out of prompts where it isn't needed
• Providers, regions, retention settings and agreements recorded
• Every AI action logged and retained under your clinical systems' rules
• Clinician review for any clinical output, with clear labelling and easy correction
• Testing on approved local data, including failure modes and provider outages
• Role-specific staff training and a named owner
• Monitoring, incident reporting, cost limits, an off switch and a review date
• Your compliance and information governance teams' sign-off for your market

How TechTose can help

The AI Deployment Program is for mid-size and larger companies, including hospitals and banks, bringing AI into how they already work: AI running in production inside your business, with a team accountable for it. Your use case and architecture are agreed in a Blueprint, built at a fixed scope agreed in writing, and kept running with monitoring for errors, downtime and AI cost spikes, on your cloud or ours. We sign your NDA before you share code, data or plans.

If you're still at the pilot stage, see how the AI Deployment Program works or talk to us about your use case.