Clause 8 is the most clinically consequential clause in the standard. It defines who has authority over an AI system's outputs, what happens when that authority is exercised, and how every oversight decision is recorded. Most healthcare providers have none of it.
A 20–25 page pocket guide for Clinical Directors, Medical Directors, and CNOs. Clause 8 broken down sub-clause by sub-clause. EU AI Act Article 14 aligned in full. A complete evidence checklist your team can complete before the next governance committee.
One-time purchase · No subscription · Instant download · 20–25pp PDF · Print-ready
This is not a theoretical question. It is the question a CQC inspector, a coroner, or a patient's legal representative will ask when something goes wrong. ISO 42001 Clause 8 and EU AI Act Article 14 both require a documented answer. Most healthcare providers do not have one.
AI systems are used in UK healthcare for triage scoring, risk stratification, diagnostic decision support, care pathway prioritisation, and clinical documentation. In each case, the AI produces an output that influences a clinical decision. In most cases, there is no documented procedure defining who reviews that output, what authority they have to override it, and how their decision is recorded. The oversight is happening — informally. The evidence that it happened does not exist.
Three regulatory frameworks converge on the same requirement: a documented, operable human oversight structure for AI systems that influence clinical decisions. CQC's Effective and Well-Led Key Lines of Enquiry ask for it. ISO 42001 Clause 8 defines it in precise operational terms. EU AI Act Article 14 mandates it for high-risk AI systems. The absence of documented oversight evidence is simultaneously a CQC Well-Led failure, an ISO 42001 Gap 8 nonconformance, and an EU AI Act Article 14 obligation unmet.
The Accountability Question
When a clinical outcome is adverse and an AI system was involved in the care pathway, the investigation will ask: Was there a documented human oversight procedure? Who reviewed the AI output? Was the review recorded? Could the reviewing clinician override the AI recommendation? Was the override procedure documented and trained? If the answer to any of these is "no" or "we don't know," the absence of governance — not the AI itself — becomes the finding.
Clause 8 is the operational heart of the ISO 42001 standard. It is where governance translates into procedures, procedures into records, and records into evidence. The pocket guide breaks every sub-clause down with healthcare-specific context and a plain-language explanation of what each requirement actually demands of a Clinical Director or CNO.
This sub-clause establishes the operational framework. The guide explains what "plan, implement, control, monitor, and review" means for a clinical team using an AI triage tool — and why each verb requires a separate evidence artefact.
The most commonly misunderstood sub-clause. The guide clarifies that this is an operational assessment — not the pre-deployment risk assessment of Clause 6.1, but an ongoing assessment of actual impact as the system operates in the clinical environment. Different document. Different owner. Different cadence.
The guide maps this sub-clause to CQC's quality improvement evidence requirements — explaining how AI system objectives, properly documented, satisfy both the ISO requirement and the Well-Led evidence that clinical quality is measured and managed.
For healthcare providers, this is the prompt version log, the model update record, and the operational change register — applied to AI. The guide explains the minimum documentation set and how it integrates with existing clinical change management processes.
The guide devotes the most space to this sub-clause. It specifies exactly what "human oversight appropriate to the context and risk" means in a clinical setting — who has oversight authority, what the minimum oversight procedure contains, how overrides are recorded, and how oversight records are reviewed for systemic AI performance issues. This is the sub-clause that maps most directly to EU AI Act Article 14.
The guide specifies three minimum performance indicators for clinical AI systems — override rate, concordance rate, and patient outcome correlation — and explains how to establish a monitoring programme that satisfies both ISO 42001 and CQC's evidence of continuous quality improvement.
The guide maps this sub-clause to the NHS Patient Safety Incident Response Framework (PSIRF) — explaining how AI-related incidents shall be captured in the incident management system, what the AI-specific trigger criteria are, and how AI incident findings feed back into the oversight procedure review cycle.
EU AI Act Article 14 and ISO 42001 Clause 8 share the same underlying intent — ensuring a human can understand, oversee, and intervene in AI system operation. But they use different language and impose obligations on different parties. The guide maps them side by side so your evidence covers both.
EU AI Act Application Note
The EU AI Act creates obligations for providers (manufacturers) and deployers (organisations using AI built by others). Most UK healthcare providers are deployers. Article 14 obligations fall on the deployer — not just on the AI supplier. The pocket guide clarifies exactly which Article 14 obligations apply to the deploying healthcare organisation and which evidence documents each obligation.
Twenty to twenty-five pages structured for clinical leaders — not governance specialists. Each section builds on the last. The evidence checklist at the end is designed to be completed in a single governance committee session.
ISO 42001 is a technical standard written in management system language. This guide translates Clause 8 into the operational and clinical accountability language that Clinical Directors, Medical Directors, and CNOs work in.
What ISO 42001 Clause 8 Actually Requires · 20–25pp · Instant download
Processed by ClickBank · Secure checkout · 60-day money-back guarantee · Instant download
Access the full healthcare series and all four industry guides via the Governance Academy. £97/month · 7-day free trial →
The guide explains what a compliant human oversight procedure shall contain — including every component that Clause 8.5 requires and that Article 14 mandates. It does not write the procedure for you, because a compliant procedure must reflect your specific AI system, your clinical context, and your organisational accountability structure. The guide gives you the specification; you write to the specification. The £167 Integration Guide includes a procedure framework template.
Article 14 obligations apply to deployers of high-risk AI systems as defined in EU AI Act Annex III. For healthcare, Annex III includes AI systems used in the administration and operation of critical health infrastructure and AI used to make decisions materially affecting healthcare access or resource allocation. The guide includes a section on identifying whether your clinical AI systems fall within Annex III scope. If they do not, Article 14 does not apply — but ISO 42001 Clause 8.5 does, regardless. The evidence requirements overlap significantly in any case.
The free guide dedicates approximately 500 words to Gap 8 — enough to identify the gap and understand its CQC inspection risk. This pocket guide dedicates 20–25 pages to it. The difference is depth of operational detail: the free guide tells you what the requirement is and why it matters; the pocket guide tells you exactly what each sub-clause requires, what evidence artefact satisfies it, how to structure your oversight procedure, how to align with Article 14, and how to implement in 90 days. If you need to brief a Clinical Director or write a governance committee paper, you need this guide, not the free version.
Yes. The checklist is formatted for A4 printing with checkbox fields, evidence reference fields, owner fields, and a priority flag column. It is designed to be printed and completed by hand in a governance committee session, then retained as a dated governance committee record. The priority flags identify the 12 items most likely to be examined during a CQC Well-Led inspection — allowing committees to focus the session where inspection risk is highest.
No. The guide is a governance education resource that explains what EU AI Act Article 14 requires of deployers and how those requirements align with ISO 42001 Clause 8. It does not constitute legal advice. Healthcare providers with specific questions about the extraterritorial application of the EU AI Act to their operations, or about their classification as a deployer, should seek qualified legal advice. The guide is designed to prepare organisations to have informed conversations with legal advisers — not to substitute for them.
Clinicians are already reviewing AI outputs. The oversight procedure tells CQC — and a coroner — that the review was intentional, documented, and accountable. Build the evidence before you need to produce it.
One-time · Instant download · 20–25pp PDF · Print-ready checklist included · 60-day guarantee