What You Receive with the Clinical AI Exposure Diagnostic™

Deliverable 2: Board Findings Report

A plain-English leadership summary explaining what was found, why it matters, the top findings and what should happen next. Written for readers who do not work in AI governance or data protection every day.

Deliverable 3: RAG Exposure Map

A one-page board-level view across thirteen governance dimensions, using Red, Amber, Green and TBC ratings.

• Red: material evidence gap or unmanaged exposure requiring priority review or action.
• Amber: partial evidence, uncertainty or control weakness requiring remediation or confirmation.
• Green: evidence was available and no immediate priority action was identified on the information reviewed.
• TBC: insufficient evidence to rate with confidence. Further confirmation is required.
• Where a dimension does not apply, it is recorded as not applicable with the reason stated.

Ratings identify evidence positions and priorities for action. A Red rating does not mean that a breach, illegality, regulatory failure or loss of indemnity support has been confirmed. A Green rating does not provide a clean bill of health.

Deliverable 8: 30-Day Priority Action Plan

Prioritised actions for the first 30 days, with named owners, target dates, dependencies and the closure evidence required for each.

Deliverable 1: AI Tool and Use Case Inventory

The master register of declared and shadow AI tools identified during the engagement: owner, users, purpose, patient-data involvement, approval position, human review position and next action for each.

Deliverable 5: DPIA Readiness and Patient Data Exposure Note

High-risk indicators, DPIA readiness position, records of processing and privacy notice gaps, retention and data-flow matters, structured for DPO review and decision.

The note identifies whether DPIA screening is needed or whether a DPIA is likely required or strongly indicated. The final determination remains with your DPO.

Deliverable 4: Ambient Scribe Assessment Sheet

Per-tool evidence status against supplier assurance, data protection, patient transparency, clinical safety and human oversight expectations.

For a Standard Diagnostic, this is recorded as not applicable with the reason stated, because ambient scribes and consultation transcription tools require a separate assessment route. A pack that records what was considered and ruled out is stronger evidence than one that leaves it unmentioned.

Where an ambient scribe, AI transcription or consultation note-generation tool is in use, in trial or planned, the clinic is routed to the six-working-day Ambient Scribe Diagnostic and this sheet is completed in full.

Deliverable 6: Vendor Data Position and Evidence Tracker

A supplier-by-supplier tracker covering data processing agreements, data residency, sub-processors, retention and deletion, model training and data reuse statements, security assurance and international transfer indicators.

ELSA AI assesses the evidence available to the clinic. It does not rank, endorse or criticise suppliers.

Deliverable 7: MDO, PMI and Insurer Disclosure Readiness Note

The current evidence position, the disclosure-readiness gaps and the matters requiring clarification with the relevant medical defence organisation, insurer or private medical insurer.

ELSA AI does not determine coverage, underwriting, disclosure obligations or indemnity support.

Deliverable 9: Source and Guidance Mapping Appendix

Material findings and recommendations mapped to the relevant published source or governance-standard signal, with the status of each source stated.

Guidance and recognised frameworks are not presented as universal legal mandates.