Most talk about responsible AI stays at the level of principles. Fairness, transparency, accountability. Every company has the list. Very few can tell you which document you’d open to check whether any of it is true.
I’ve spent this summer on the other end of that gap, working out what an agentic AI system needs to prove before it touches a clinical workflow. The honest answer is that the interesting decisions live in boring places: capability checklists, vendor scorecards, RFI language. Whether a hospital’s AI is safe has less to do with anyone’s mission statement and more to do with what the procurement contract requires and who is on the hook when the system drifts.
That’s what I want to write about here. Evaluation and oversight, tech policy, the occasional dispatch from a cyber exercise. Shorter than a paper, longer than a take.