ISO 42001 · NIST AI RMF · WHO AI Ethics
The published source contract for MedXline requires scoped, reviewable assistance with a human decision boundary. This page describes design requirements and repository evidence; it does not claim that every control is deployed or qualified in every environment.
Framework mapping
Self-declared · not certified
Trace retention
Deployment-specific
Decision authority
Human review required
Availability
Feature and region gated
The three anchors
These are voluntary design references, not certifications or production attestations. Each framework links to its publisher and to the corresponding public source mapping.
ISO/IEC
AI Management System — requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation.
Scope: WebLLM on-device assist, federated AI inference, agentic workflows; AI register and lifecycle controls.
NIST (USA)
AI Risk Management Framework — voluntary guidance to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.
Scope: AI lifecycle risk register, model evaluation harnesses, replayable traces, regression gates.
World Health Organization
Ethics and governance of artificial intelligence for health — six principles ensuring AI works to the public benefit of all countries.
Scope: Clinical decision support boundaries (non-authoritative AI surfaces), human-in-the-loop overrides, equity guardrails.
NIST AI RMF 1.0 — applied
Source-level control requirements organized around the four NIST functions. A production claim still requires exact-candidate, deployed evidence.
Cultivate a culture of AI risk management. Define policies, accountability, and skills.
Model register and retirement rules
The source contract requires an owner, stated use, dataset notes, and explicit out-of-scope limits before a model can be qualified.
Compliance Co-Pilot reviewer drafting
AI may draft a decision for human review; AI never finalises identity, payment, or clinical decisions.
Governance review cadence
A production deployment must establish and evidence a recurring review of model cards, evaluation deltas, incidents, and red-team findings.
Recognise context. Identify capabilities, limitations, and stakeholder impacts before deploying AI.
Use-case categorisation
Model cards classify each use as informational, advisory, or operational; only informational + advisory ship without manual gates.
Stakeholder impact assessment
DPIA-aligned assessment for any AI surface that touches PHI, biometrics, or financial decisions.
Out-of-scope claims register
Explicit catalogue of what each surface is not permitted to do (e.g. no diagnosis, no triage authority).
Test, evaluate, and document AI system performance, robustness, fairness, and explainability.
Decision records you can replay
The source contract requires prompts, tool calls, retrieved evidence, and reviewer decisions to be captured where the workflow is authorized to retain them.
Automated tests before each release
Repository evaluation datasets and budgets exist; release proof tied to a specific code version is still required before any release claim.
Bias and fairness checks
Across language, jurisdiction, and gender slices on identity verification and agent answering.
Treat risk. Allocate resources to risks proportionate to impact, and continuously improve.
Incident response runbook
A deployed AI-backed flow must have an approved runbook, named responders, monitoring, and a tested escalation path.
Off switch and slower path
Each AI feature falls back to scripted answers or a human queue when automation is off.
Ongoing misuse checks
A versioned prompt-attack corpus exists in source; release qualification must prove that the candidate ran it successfully.
WHO Ethics & Governance of AI for Health
The intended mapping for clinical and clinical-adjacent AI surfaces. It does not establish WHO endorsement or certification.
Principle 1
Members can decline AI assistance, request a human reviewer, and see exactly which signals informed any decision.
Principle 2
Assistive text only for clinical decisions—clinicians decide. We do not auto-diagnose.
Principle 3
Failed identity checks explain the reason code; every assistive answer ties back to published registry text.
Principle 4
The governance contract requires a named human owner, an appeal route, and a deployment-specific retention schedule backed by legal review.
Principle 5
Country-specific evaluation and professionally reviewed language support are required before enablement; unreviewed translations are not published as supported.
Principle 6
Records can be revisited later; weekly cost and speed review; swaps keep evaluation limits steady.
Built to connect safely
Public discovery is read-only and planning-only. Authenticated assistance remains feature-gated, human-controlled, and outside the public crawl frontier.
| Protocol | Path / code | Trust | Description |
|---|---|---|---|
| LLM discovery | Public discovery files | public | Publishes bounded, planning-only product information. Discovery never grants write authority or proves a deployment is enabled. |
| Agent discovery | Public agent discovery file | public | Describes the public read-only discovery boundary. Authenticated tools and internal routes are not advertised as public capabilities. |
| Governance Q&A | This page, user initiated | public | Uses the published FAQ corpus. Optional on-device generation begins only after the visitor requests it; the deterministic FAQ remains available without a model. |
| Authenticated assist | Feature and deployment dependent | authenticated | May draft wording or a review suggestion, but never submits, approves, pays, diagnoses, or changes authority without an explicit human action. |
This deliberately omits internal routes and country-specific configuration. Availability depends on the approved deployment, feature state, and the processing disclosure shown at the point of use.
Reviewer notes
Optional drafting support may be enabled for authenticated review notes. A qualified human remains responsible for the final record.
Partner messages
Wording support may clarify a partner-authored message; it cannot manufacture credentials, dates, identifiers, or compliance claims.
Member messages
Assistive wording may be offered only with a visible user action and a clear local-versus-remote processing disclosure.
Clinical documentation
Draft assistance is non-authoritative and must remain reviewable, editable, and explicitly accepted by the responsible clinician.
Defenses, layer by layer
Threats and source controls are catalogued below. A versioned misuse corpus exists, but only exact-candidate CI and deployed observation can prove a specific release.
Input
Threat
Prompt injection from member-supplied text or untrusted retrieval
Control
Inputs marked as data, never as instructions; system prompt pinned; allow-list of tools per agent role.
Tool
Threat
Tool-injection (an agent tricked into calling a destructive tool)
Control
Public AI tools are read-only. Authenticated tools require sign-in, role checks, and safe-retry guarantees so the same action is never applied twice.
Retrieval
Threat
Poisoned or stale knowledge influencing answers
Control
Retrieval is restricted to versioned registries (standards, certifications, jurisdictions). Each chunk carries provenance.
Output
Threat
Hallucinated claims, unsafe code, or PII leakage
Control
Outputs checked against the compliance language scanner; structured outputs checked against safety rules before display.
Identity
Threat
Confused-deputy attacks across assistant-to-system boundaries
Control
Every cross-system call carries a fresh signed envelope with caller, capability, and scope; no ambient authority.
Privacy
Threat
Sensitive context leaving the device
Control
On-device assist serves the offline-first tier; remote assistance disables training and retains zero data.
FAQs
The page that explains our AI governance also demonstrates it — try the on-device assistant below before reading the FAQ. Your question runs entirely in your browser when private on-device assist is available; otherwise it falls back to the published FAQ answers.
The source contract prohibits AI from holding diagnostic or treatment authority. Where an AI feature is enabled, it may surface evidence, draft notes, or summarise for review; the responsible clinician must make and record the decision.
The public source mapping uses ISO/IEC 42001:2023, NIST AI RMF 1.0, and the WHO Ethics & Governance of AI for Health as design references. This is a self-declared mapping, not certification, endorsement, or deployed-compliance proof.
The source controls separate user text from instructions, pin system prompts, scope tools by role, restrict retrieval, and validate structured outputs. A versioned misuse corpus exists in the repository; exact-candidate CI and deployed observation are still required to prove a specific release.
The product contract requires AI assistance to be optional and human review to remain available. Each authorized deployment must verify the actual opt-out, escalation, and audit behavior before making that promise to users.
The public surface exposes bounded LLM discovery files and an agent card under /.well-known. Those documents are read-only planning aids; they do not grant mutation authority or expose authenticated and internal tools.
This site publishes source-level control mappings and archived evaluation budgets. Auditors should request the current evidence package, which must distinguish available source evidence, candidate qualification, deployed observation, and material that is unavailable or requires approved confidential access.
When a surface explicitly says on-device, generation runs in the browser and starts only after the user requests it. Availability is feature- and device-dependent. Users should not assume text stays local unless the point-of-use disclosure says so; remote processing requires a separate, accurate disclosure.
Ask for the current evidence package. We will separate source-level controls, completed qualification, deployment evidence, and unavailable material instead of treating them as interchangeable.
