Radiology AI triage assistant (hospital)
More
Recommended next steps
Highest-priority open actions
At a glance
- Owner
- Dr. Elena Novak
- Sponsor
- Chief Medical Information Officer
- Business unit
- Radiology
- Lifecycle stage
- Design
- Architecture
- No amplifiers declared
Top risks driving the decision
- R-CL-01 False-negative deprioritisation
- R-CL-02 Automation bias
- R-RG-01 TGA post-market surveillance obligations
Key conditions
- Local-population validation complete with sensitivity meeting acceptance criteria
- Automation-bias training delivered to all reading radiologists
- Continuous performance monitoring live before go-live
- TGA post-market vigilance process documented and tested
What drives the score
GII points contributed by each CALIBRE factor (score 0 to 4 × weight)
Findings from each capability
- ARA Agentic Risk Analyst
- 10 findings
- CALIBRE Governance intensity
- 10 controls + GII summary
- Secure-RAG Evidence
- 0 citations
Decision narrative
Initiative SAMPLE-05 (Radiology triage AI) is assessed at ARA overall-residual Medium, CALIBRE band High (GII 57.50/100). The advisory (queue-ordering) nature of the system, and the fact that radiologists retain full diagnostic authority, keeps residual risk manageable.
Approve with conditions. Do not proceed to production until the four conditions are met. The dominant residual risk is automation bias, which no software control can fully eliminate; the training and continuous-monitoring controls are the primary mitigations.
Description
A tertiary hospital wants to deploy an AI system that reads incoming CT scans and prioritises the reading queue for radiologists, flagging suspected acute findings (stroke, haemorrhage, pulmonary embolism) for immediate attention. The AI does not diagnose; it re-orders the queue. Model is FDA-cleared but hospital will validate against local population.
How action status is reported
A control is reported as implemented in the attestation only when its action is Complete. Add a link to the evidence where possible.
CALIBRE sets the required controls by band, not by reading the description. If a control does not apply, mark it Waived and put the written justification (or a link to it) in the evidence field. The waiver is shown in the attestation.
| Priority | Action | Status |
|---|---|---|
| High | Complete Local-population validation (500 scans) SAMPLE-05-A-01
|
Open |
| High | Deliver Radiologist automation-bias training SAMPLE-05-A-02
|
Open |
| High | Establish Continuous performance monitoring SAMPLE-05-A-03
|
Open |
| High | Document TGA post-market vigilance process SAMPLE-05-A-04
|
Open |
No actions match
Change the filters to see more.
ARA R-CL-01False-negative deprioritisation
AI misses an acute finding and pushes the case back in the queue.
ARA R-CL-02Automation bias
Radiologists may rely on AI queue ordering and skip suspicious priority-2 cases.
ARA R-RG-01TGA / FDA post-market surveillance obligations
Deployment triggers post-market vigilance and reporting obligations.
ARA CMP-01TGA Software as a Medical Device (Australia) - applicable
AI triage tool used in clinical workflow meets TGA SaMD definition.
ARA CMP-02EU AI Act (European Union) - potentially applicable
If used on EU patients, classified as high-risk AI system under Article 6.
ARA T-AI-01Adversarial imaging
Adversarially perturbed images could manipulate triage order (research-stage risk).
ARA C-01Local-population validation
Prospective validation on 500 local scans before go-live; measure sensitivity by finding type.
ARA C-02Radiologist automation-bias training
Explicit training that AI order is advisory; radiologists retain independent reading obligation.
ARA C-03Continuous performance monitoring
Monthly review of sensitivity, false-negative rate, and time-to-report by AI-priority tier.
ARA C-04TGA post-market vigilance process
Documented incident-reporting workflow to TGA for any adverse event linked to triage order.
CALIBRE CAL-GII-HighGovernance Intensity Index = 57.50/100 (band: High)
CALIBRE band: High. Rule 3: biometric, health or regulated data, floor Moderate: data governance (DATA-01) mandatory.
CALIBRE CAL-XAI-01XAI-01 - Explainability and transparency
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-2.9 | ISO 42001 A.8.2 | EU AI Act Art.13; Art.50; Art.86.
CALIBRE CAL-HITL-01HITL-01 - Human oversight (human-in-the-loop)
CALIBRE core control, required from band High upward. Maps to NIST MAP-3.5 | ISO 42001 A.9.3 | EU AI Act Art.14; Art.26.
CALIBRE CAL-MON-01MON-01 - Runtime monitoring and drift detection
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-2.4; MANAGE-4.1 | ISO 42001 A.6.2.6; A.6.2.8 | EU AI Act Art.72; Art.26.
CALIBRE CAL-ASR-01ASR-01 - Independent pre-deployment assurance
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-1.3 | ISO 42001 A.6.2.4; A.6.2.5 | EU AI Act Art.17; Art.43.
CALIBRE CAL-GOV-02GOV-02 - AI impact and risk assessment
CALIBRE core control, required from band Moderate upward. Maps to NIST MAP-5.1 | ISO 42001 A.5.2; A.5.4 | EU AI Act Art.9; Art.27.
CALIBRE CAL-DATA-01DATA-01 - Data governance and PII protection
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.10 | ISO 42001 A.7.2; A.7.3; A.7.4; A.7.5 | EU AI Act Art.10.
CALIBRE CAL-SEC-01SEC-01 - AI security controls
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.7 | ISO 42001 A.6.2.3 | EU AI Act Art.15.
CALIBRE CAL-SUP-01SUP-01 - AI supply-chain and third-party assurance
CALIBRE core control, required from band Moderate upward. Maps to NIST GOVERN-6.1; MANAGE-3.1 | ISO 42001 A.10.2; A.10.3 | EU AI Act Art.25.
CALIBRE CAL-LIT-01LIT-01 - AI literacy and competence
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-2.2 | ISO 42001 7.2 | EU AI Act Art.4.
CALIBRE CAL-GOV-01GOV-01 - AI use-case registration
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-1.6 | ISO 42001 A.4.2 | EU AI Act Art.49.
No findings match
Change the filters to see more.
Runtime: operating envelope, control tests and authority checks
Operating envelope
No operating envelope
Push one from ARA. Until then every agent action is escalated.
Recent authority checks
Open authorityNo checks recorded for this initiative.
Agent gateways call POST /api/authority/check before acting. Secure-RAG reports control tests to POST /api/test-results.