Healthcare AI risk management: an innovator-informed approach from frameworks to practical worksheets for proportionate regulatory evidence capture

Abstract

Introduction: Artificial intelligence (AI)-enabled healthcare systems introduce clinical safety, operational and governance risks across development, deployment and post deployment stages. Although multiple AI risk assessment frameworks exist, they are often cross-sector, lengthy and difficult to operationalise in ways that support proportionate evidence generation and regulatory use.

Methods: We conducted a targeted evidence synthesis and framework mapping exercise drawing on review-level evidence, scientific databases and regulatory sources. Three core review studies informed framework identification and mapping. Selected frameworks and guidance, including NIST AI RMF, the Fraunhofer IAIS AI Assessment Catalogue, ALTAI, the ICO AI and Data Protection Risk Toolkit, MHRA guidance, the NICE Evidence Standards Framework, SPIRIT-AI and CONSORT-AI, were mapped across lifecycle stages using a structured extraction matrix. Framework concepts were translated into healthcare-oriented worksheets and refined through structured engagement with healthcare AI innovators.

Results: Frameworks varied substantially in scope, lifecycle coverage, terminology and implementation approach. Innovator feedback identified recurring themes including cognitive burden, usability, need for clearer intended purpose, lifecycle support, actionable examples and improved regulatory traceability. Participants highlighted challenges applying frameworks across diverse healthcare contexts and AI roles. Worksheet refinement introduced simplified domains, healthcare-specific context prompts, evidence and action fields and stage-aware guidance.

Discussion: AI risk frameworks are necessary but not sufficient for healthcare innovation unless translated into practical tools. A codesigned worksheet approach can support proportionate evidence capture and iterative risk management while remaining adaptable across use cases and maturity levels.