Notes on governance, workforce and adoption.

The governance frameworks written for NHS trusts assume a committee, an information governance team and protected time. Most independent providers have a registered manager and a deputy. Here is what proportionate governance looks like.

The rota tells you whether you have enough people on shift. Only governance tells you whether those people are safe to practise. Most workforce tools address the first question and leave the second untouched.

The failures are made at procurement: purpose undefined, accountability unassigned, data readiness assumed, and vendor assessment mistaken for independent review.

The boundary between administrative software and a medical device is set by intended purpose and by claims. It is not always where people assume.

Applying trust-scale frameworks to SME providers without adaptation produces compliance theatre rather than governance.

Vendors assess whether you can buy. They do not assess whether your data, information governance and consent framework can support what you are buying.

Every framework requires it. Few specify who is responsible at the point of care, how the oversight is recorded, or what happens when the output is wrong.

Inspection methodology is adapting to the presence of AI in care settings. What providers using AI-assisted tools should expect, and what documentation is being requested.

Most AI contracts are written to protect the vendor. The questions that protect the provider, on liability, data sovereignty, audit rights and exit, are rarely asked unprompted.

A pilot that succeeds cannot always be scaled, because the governance conditions that made it safe do not exist at scale. The distinction is a governance question, not a technical one.