What I would examine before an AI model goes live

Agree the decision and its consequences

Document who uses the output, which action it influences and what happens when it is wrong. A prioritisation aid and an autonomous decision system require different controls. Identify the owner of the final decision and the situations in which the model must abstain or defer.

Follow the data

Trace sources, permissions, transformations, labelling and exclusions. Check for patient overlap across splits, post-outcome features and information that will not exist at prediction time. Examine whether the evaluation population resembles the intended deployment population.

Interrogate performance

Review discrimination, calibration and decision-relevant error rates. Inspect meaningful subgroups, uncertainty and missingness patterns. A single averaged metric can conceal a weakness precisely where the application matters most. Agree acceptable performance before inspecting the final holdout results.

Test failure and change

For language-model applications, test unsupported answers, malicious instructions in retrieved content, sensitive-data handling and the limits of retrieval. For predictive models, examine drift detection, escalation and retraining triggers. A monitoring dashboard needs a named owner and an actionable response.

Produce an evidence-led finding

A useful review report separates observed defects, missing evidence and recommendations. Each finding should have an impact, an owner and a retest criterion. My proposed review service supports technical assurance and audit preparation; it does not imply accredited certification or replace legal, clinical or regulatory review.

Sources & further reading

• NIST — AI Risk Management Framework

Sources checked 20 September 2026. Implementation commentary reflects a practical review perspective; source material may change.