CSO Approval Workflow
How clinical safety sign-offs are requested, reviewed and logged for every AI triage update — aligned to DCB0129 & DCB0160 (UK) and equivalent clinical safety standards internationally.
The workflow, end to end
Every AI triage update — from a prompt tweak to a model upgrade — moves through these six gated stages.
- Engineering + Clinical
1. Change Request Raised
Any change to triage logic, prompts, models, red-flag rules or clinical content opens a Clinical Change Request (CCR) — including diff, intended benefit and patient population affected.
- Safety Case
2. Hazard Assessment (DCB0129)
Proposed changes would be mapped against a hazard log with review of risk and mitigations.
- Evidence
3. Evidence Pack Compiled
Tests, bias audits and rollback plans would need review before deployment.
- Human Oversight
4. CSO Review & Sign-Off
The Clinical Safety Officer reviews the hazard log delta and evidence pack. Sign-off is recorded with name, GMC/NMC number, timestamp and decision rationale. Rejections return to step 1 with required actions.
- Progressive Rollout
5. Staged Deployment
A future evaluation would require monitored release stages and clinical oversight.
- Audit Trail
6. Immutable Audit Log (DCB0160)
Every CCR, hazard entry, evidence artefact and sign-off is written to an append-only audit log with cryptographic integrity — available to regulators, commissioning bodies and internal incident reviews on demand.
Built-in guardrails
Red-flag regression: 100% pass-rate gate
No change reaches production if a single red-flag scenario regresses. The gate is enforced in CI before the CSO ever sees the request.
Two-person rule for clinical logic
Changes to triage decisioning require sign-off from the CSO plus an independent senior clinician — never a single approver.
One-click rollback
Every deployment carries a pre-validated rollback artefact. The on-call CSO can revert any change inside 5 minutes, 24/7.
What gets logged
- Change Request ID, author, and linked code/model diff
- Hazard Log delta (new, modified, retired hazards)
- Red-flag regression test results and coverage
- CSO identity, professional registration number, decision and rationale
- Shadow-cohort monitoring metrics vs. baseline
- Deployment timestamp, rollout percentage and rollback artefact hash
- Any post-deployment incidents linked back to the CCR
- Independent second-clinician sign-off (where required)
Audit records are append-only and exportable on request to relevant regulators, the CQC (in the UK) and commissioning bodies.
Discuss the developing hazard log?
Health-system partners and procurement teams can request a walkthrough of our DCB0129 safety case and the most recent CSO sign-off pack.