Step 3 · Sustain the evidence position
AI Exposure Sentinel™
Quarterly review on an annual agreement · £950 per month, £2,850 per quarter in advance, or £10,500 per year prepaid · + VAT. Annual prepaid is preferred.
What Sentinel is
Your governance baseline is current on the day it is signed off. It does not stay current on its own. Staff adopt new tools. Suppliers change their terms and their sub-processors. Insurers add AI questions to renewal forms. Regulatory expectations move. Within a quarter or two, the documented position and what the clinic is actually doing have drifted apart.
Sentinel keeps your documented governance position current. When your DPO, an inspector, your insurer, your MDO or your board asks how your AI use is controlled, the evidence exists on the day they ask, not three weeks later once someone has rebuilt it.
Why a maintained baseline matters
Governance evidence that is a year out of date is received, by the people who ask for it, much as no evidence would be. A register that no longer matches what staff use. A vendor position taken before the supplier changed its terms. A board paper written twelve months ago. Each is a gap, and each becomes visible only at the moment it is tested. Sentinel closes those gaps on a quarterly rhythm, before they are tested.
What you receive each quarter
Each quarterly review covers six things:
01
Change capture. New or changed AI use, new suppliers, changes to existing supplier terms, and shifts in staff usage patterns since the last review.
02
Register and risk update. Your AI tool register and AI risk register brought back into line with the current position.
03
DPIA and vendor review. DPIA indicators and vendor evidence reassessed where the position has moved.
04
Regulatory horizon scan. Material changes in ICO, CQC, NHS, MDO and recognised standards expectations that bear on your clinic.
05
A written Quarterly Governance Update for the board. The document your board holds as evidence of ongoing oversight. This is the tangible output of each review, not a by-product of it.
06
A check-in call. To walk the update and route any priority actions.
Sentinel also refreshes your RAG exposure map against the established baseline and aligns your registers with actual staff usage patterns where evidence is available.
One quarter each year is an enhanced annual review, aligned to your board cycle.
What Sentinel is not
Sentinel is a periodic professional review by a senior practitioner. It is not real-time monitoring, continuous technical assurance, system watching, or a guarantee of continued compliance. It complements your internal security and information governance teams; it does not replace them. Final legal positions, DPIA approvals and indemnity disclosures remain accountable to your clinic officers.
Who it is for
Sentinel maintains a baseline, so there has to be a baseline to maintain. It is for clinics that have completed the Clinical AI Safe Usage Launchpad™.
One exception: a baseline built elsewhere may be maintained, but only after a separately priced review confirms it is complete enough to maintain.
Who carries out the review
Every Sentinel review is carried out personally by Faisal Ali, AAISM, CISM, CRISC, founder and principal consultant. There is no junior delivery model and no handover.
Pricing
£950 per month, £2,850 per quarter in advance, or £10,500 per year prepaid, + VAT. Annual prepaid is preferred.
It aligns the review cycle to your board year, and at £10,500 it is £900 less than twelve monthly payments.
Review the foundational Diagnostic pathway. Embed controls through the Launchpad first. Then sustain them with Sentinel.
Advisory boundary
ELSA AI provides advisory governance support only. It does not provide: legal advice or legal sign-off; CQC, ICO or NHS approval; insurer coverage or underwriting decisions; MDO indemnity decisions; a completed or signed DPIA; clinical safety case sign-off, DCB0160 authorship or appointment as Clinical Safety Officer; medical device or SaMD classification; certification or any guarantee of compliance. Final legal, data protection, clinical safety, regulatory, insurer and indemnity decisions remain with the client's DPO, legal counsel, Clinical Safety Officer, accountable officers and clinicians.