EU AI Act · Healthcare AI
When a hospital asks, “Is your AI still doing what you approved?” — what do you hand them?
Not last year’s PDF. This week’s evidence.
RiskLine verifies your defined EU AI Act controls as your models, prompts and vendors change, and keeps timestamped proof ready before anyone asks.
Clinical safety · Quality · Compliance
- 01Verified
- 02Change detected
- 03Exception
- 04Remediation
- 05Verified
Proof
Watch the evidence build
About 1 minute · voiceover · synthetic data
A synthetic DermAssist walkthrough: approved version, drift breach, open incident, evidence pack.
What your buyer asks
Three questions. Three things you should be able to hand over.
Is it still the AI you approved?
What you hand over
Change log against the approved version, with each material change reviewed and timestamped.
Who is accountable if it gets a case wrong?
What you hand over
Named control owner, oversight step status, and an exception trail when human review was skipped or overridden.
How would you know if it drifted?
What you hand over
Threshold checks, timestamps, and an incident record — not a narrative assembled the week before an audit.
Why now
Snapshot assurance does not survive a live system.
Systems change
A model update, prompt revision, new vendor API, or tooling change can invalidate last quarter’s approval pack overnight.
Buyers ask again
Procurement and clinical governance do not stop at contract signature. They ask what the AI is doing now.
Evidence goes stale
A PDF from March answers a March question. Hospitals need timestamped proof tied to the live system.
What we verify
Selected obligations → controls → evidence
Sold into EU hospitals and health systems. Read by buyers in the UK and US.
| Obligation | Example control | Evidence |
|---|---|---|
| Art. 9Risk management | Documented risk process for the AI system; re-run when the system or use context materially changes. | Versioned risk record, change trigger log, last review timestamp. |
| Art. 12Record-keeping and logging | Logs that show what the system did, when, and under which configuration. | Log presence and format checks, retention window, sample event IDs. |
| Art. 14Human oversight | Named oversight step before high-impact clinical or triage actions; kill-switch path. | Oversight status, owner identity, exception trail when skipped or overridden. |
| Art. 15Accuracy, robustness, cybersecurity | Agreed performance and security thresholds for the approved model version. | Threshold check results, model and version hash, drift or failure incidents. |
| Art. 72Post-market monitoring | Ongoing collection and review of how the system behaves after placement. | Monitoring schedule, findings, remediation status — not a one-time PDF. |
Illustrative mapping of selected obligations to example controls and evidence. Starting set pending expert review. Not legal advice. Does not certify compliance.
Inside the workspace
Inventory, risk, controls, evidence.
DermAssist Triage is on candidate v2.5.0-rc1, which is not the approved v2.4.1. On 18 September 2026 the illustrative sensitivity monitor read 0.907 against a threshold of at least 0.92. Incident INC-DA-2026-04 is open and the candidate is held. Sepsis Sentinel EW remains on approved v1.8.0 with monitors inside the agreed envelope.
High-risk · Drift watch · Dr. Amira Okonkwo
Synthetic dermatology triage classifier that ranks skin-lesion images for urgency of clinician review. Not a medical device and not deployed.
Control status
Evidence
Synthetic data. Not a medical device. Not a certificate.
30-day pilot · optional
If you want to go further, start with one meaningful system.
1–3 AI applications or workflows · 5–15 agreed controls · continuous verification · exception and evidence review · executive findings. No promised legal outcome.
Scope and controls
Agree the systems, the control set, and what “verified” means for each.
Wire verification
Connect classification context and verification checks to the live estate.
Run and exceptions
Continuous checks surface exceptions; owners review and remediate.
Evidence pack
Hand over timestamped findings your buyers can actually read.
Send me this
Leave your details and we will send the evidence pack.
No pilot needed. Tick the box only if you want to talk about one.
FAQ
Straight answers
Is RiskLine a certification or legal-compliance product?
No. It is an advisory verification layer. It helps you operationalise and continuously check defined controls. It does not certify EU AI Act compliance and is not legal advice.
What does a 30-day pilot include?
One to three AI applications or workflows, five to fifteen agreed controls, continuous verification, exception and evidence review, and an executive findings pack. No promised legal outcome.
Do you replace our GRC or quality system?
No. RiskLine sits beside it and produces the timestamped evidence those systems can reference.
Is the demo data real?
No. DermAssist Triage and Sepsis Sentinel EW are synthetic systems built to show the evidence chain. They are not medical devices and are not deployed.
Will you name us as a customer?
Not without written permission.
Another industry?