AI Governance & Ethics Policy
1. Purpose and Scope
This Policy describes how ReMyll will govern any artificial intelligence capability introduced into the Abastyan Governance OS, including the optional AI assist described in Section 3, and how the AI Governance module helps customers govern their own AI tools. It applies to any AI-enabled feature added to the Service and to ReMyll’s internal development practices.
ReMyll uses the NIST AI Risk Management Framework as its reference for governing AI features and draws on HHS guidance on trustworthy AI. The AI Governance module is designed to help customers document their own obligations, such as decision-support transparency and nondiscrimination requirements, where those apply to them.
2. Principles
Human authority. Any AI feature introduced in the Service will assist compliance professionals; it will not make regulatory determinations, approve corrective actions, or replace documented human review. Every suggestion, whether rules based or AI generated, is labeled as such and is editable and rejectable by an Authorized User.
Transparency. Before any AI feature is released, ReMyll publishes a model card describing its intended use, inputs, known limitations, training data provenance at a category level, and evaluation results. Model cards are available in the Trust Center and within the product.
Fairness. Any AI feature will be evaluated for disparate performance across relevant subgroups before release and on a scheduled cadence thereafter. Features that touch workforce or patient-population attributes receive heightened review.
Privacy. Customer Data, including any incidental PHI, will never be used to train, fine-tune, or evaluate models shared across customers. If a future feature processes Customer Data with a model, that processing will occur within the customer’s tenant boundary.
Accountability. ReMyll leadership owns this Policy. Any AI feature will pass through a documented risk review with sign-off from security and privacy before release.
3. Current Capabilities in the Service
AI assist (optional add-on). Where a customer has added AI assist, Authorized Users may request drafts of corrective actions, plans of correction, root-cause analyses, policies, incident summaries for committees, board and committee narratives, and regulatory change summaries. Before a request is sent, names, contact details, and record numbers are removed from the context. Drafts are produced by a third-party large language model under terms that prohibit training on Customer Data; each draft is checked against the required elements for its document type, labeled as an AI draft, editable, and enters the record only when an Authorized User accepts it, at which point the acceptance is recorded in the audit trail. AI assist is disabled unless the customer enables it.
Rules-based assist (all plans): a completeness review that checks plans of correction and corrective actions against required elements; proposed wording drawn from care-setting templates, applied only when an Authorized User accepts it; precedent drawn from comparable past actions; and pattern detection that counts repeat and cross-site incident categories. Every suggestion is labeled, editable, and recorded in the audit log.
The Service does not make clinical, regulatory, staffing, or eligibility determinations. Any additional AI feature will be introduced only after the review described in Section 4, with notice to customers and the controls described in Section 5.
Website chat assistant: the assistant on abastyan.com uses automated responses to answer questions about the Service and route inquiries. It is labeled as automated, does not access Customer Data, does not learn from visitor conversations, and hands off to a person on request. Its answers are informational and are governed by Section 3 of the Website Terms of Use.
4. Risk Management Lifecycle
Each AI feature, including AI assist, is inventoried with an owner, intended use, data inputs, risk tier, and review date. Before release it will undergo threat modeling, evaluation against a held-out test set, bias testing across defined subgroups, and review for prompt injection and data leakage. At release it will be switchable per customer, and its outputs will be logged with the model version. After release it will be monitored for performance and drift, re-tested for bias on a schedule, and covered by the Security Incident Response Plan.
5. Customer Controls
AI assist is off unless the customer enables it and can be disabled at any time. Accepted AI drafts and rules-based suggestions are distinguishable in the audit trail. Role-level controls and dual approval for AI-assisted changes are on the roadmap and will be announced before release.
6. The AI Governance Module
The Service includes tooling to help customers govern their own AI adoption: an AI tool inventory with intended-use documentation; risk tiering aligned to the NIST AI RMF; vendor AI questionnaires within the Third-Party Risk module; bias-testing schedules and evidence storage; HTI-1 source attribute tracking for predictive decision support interventions; and board and committee reporting on AI oversight. These features provide structure and evidence storage; they do not constitute legal advice or certification of any customer AI tool.
7. Reporting Concerns
Anyone may report a concern about AI behavior in the Service through the Contact us form on abastyan.com. Reports are acknowledged within two (2) business days and reviewed under the AI incident process. ReMyll does not retaliate against individuals who raise concerns in good faith.