Policy template
An AI-output attestation policy
your committee can adopt.
Ten clauses. Plain text. Built from the draft-until-attested mechanism and the 2026 laws and CMS programs that now require a licensed human on AI-assisted decisions. Copy it, replace the bracketed fields, and take it to counsel. It is a template, not legal advice.
Scope: clinically meaningful output
This policy applies to any AI-generated content that recommends, denies, orders, codes, summarizes for action, or instructs about an individual patient’s care or coverage, whether the recipient is a patient, a payer, a clinician, or the record. General health information that does not concern an identified patient is out of scope.
How the boundary is drawn →Draft until signed
Every in-scope output is a draft until a named, licensed clinician signs it. No system path may deliver a draft to a patient, a payer, or the chart. Delivery requires the attestation record in clause 6.
Watch the gate hold a draft →Who may sign
The signer is a clinician licensed in the jurisdiction where the patient is located, competent in the clinical area of the output, verified against the CMS NPPES registry, and identified on the record by NPI. A signer may not attest outside their competence.
Where specialty match is in statute →The decision
The signer signs, revises, or declines, and records a rationale in every case. A decline is recorded with the same completeness as an approval. Compensation to signers, if any, is a flat amount per review that does not depend on the decision.
The fee is the same for yes and no →Review integrity
The signer sees the output and the basis for it — the inputs, and any confidence or safety flags — before deciding. Review duration is recorded. [ORGANIZATION] defines a review-velocity ceiling of [N] reviews per hour per signer above which attestations are flagged for audit.
The governance model, live vs designed →The record
Each attestation records the output’s hash, the signer’s NPI, the timestamp, the decision, and the rationale, and is anchored where [ORGANIZATION] cannot alter it after the fact, so that a third party can verify it without [ORGANIZATION]’s cooperation.
Verify a receipt →Fail closed
If no qualified signer is available, the output is not delivered. There is no default approval, no timeout that ships a draft, and no delegation of the signature to a non-clinician or to another model.
The specification →Vendors
Any vendor whose AI output feeds an in-scope decision must, by contract, either supply signers who meet clause 3 or route outputs to [ORGANIZATION]’s signers. The contract states which, and grants [ORGANIZATION] the right to audit attestation records.
What CMS requires of its AI vendors →Law and regulator map
[ORGANIZATION] maintains a list of the statutes and programs that require a licensed human on AI-assisted decisions in the states where it operates, with effective dates, and reviews it on each change. The FDA’s posture on clinician-supervised generative-AI output is tracked as guidance evolves.
The current map, with sources →Ownership and review
This policy is owned by [ROLE, e.g. Chief Medical Information Officer] and reviewed at least annually and whenever an applicable law, program, or vendor changes. Exceptions require written approval by the owner and are recorded.
Score your deployment against it →Plain text
AI-OUTPUT ATTESTATION POLICY (template — adapt with counsel; not legal advice) Source: harnesshealth.ai/policy · retrieved 2026-09-07 1. Scope: clinically meaningful output This policy applies to any AI-generated content that recommends, denies, orders, codes, summarizes for action, or instructs about an individual patient’s care or coverage, whether the recipient is a patient, a payer, a clinician, or the record. General health information that does not concern an identified patient is out of scope. 2. Draft until signed Every in-scope output is a draft until a named, licensed clinician signs it. No system path may deliver a draft to a patient, a payer, or the chart. Delivery requires the attestation record in clause 6. 3. Who may sign The signer is a clinician licensed in the jurisdiction where the patient is located, competent in the clinical area of the output, verified against the CMS NPPES registry, and identified on the record by NPI. A signer may not attest outside their competence. 4. The decision The signer signs, revises, or declines, and records a rationale in every case. A decline is recorded with the same completeness as an approval. Compensation to signers, if any, is a flat amount per review that does not depend on the decision. 5. Review integrity The signer sees the output and the basis for it — the inputs, and any confidence or safety flags — before deciding. Review duration is recorded. [ORGANIZATION] defines a review-velocity ceiling of [N] reviews per hour per signer above which attestations are flagged for audit. 6. The record Each attestation records the output’s hash, the signer’s NPI, the timestamp, the decision, and the rationale, and is anchored where [ORGANIZATION] cannot alter it after the fact, so that a third party can verify it without [ORGANIZATION]’s cooperation. 7. Fail closed If no qualified signer is available, the output is not delivered. There is no default approval, no timeout that ships a draft, and no delegation of the signature to a non-clinician or to another model. 8. Vendors Any vendor whose AI output feeds an in-scope decision must, by contract, either supply signers who meet clause 3 or route outputs to [ORGANIZATION]’s signers. The contract states which, and grants [ORGANIZATION] the right to audit attestation records. 9. Law and regulator map [ORGANIZATION] maintains a list of the statutes and programs that require a licensed human on AI-assisted decisions in the states where it operates, with effective dates, and reviews it on each change. The FDA’s posture on clinician-supervised generative-AI output is tracked as guidance evolves. 10. Ownership and review This policy is owned by [ROLE, e.g. Chief Medical Information Officer] and reviewed at least annually and whenever an applicable law, program, or vendor changes. Exceptions require written approval by the owner and are recorded. Bracketed fields are placeholders for the adopting organization.
Adopting it is the policy. Running it is the pilot.
Clauses 2 through 7 are what the harness does for one output at a time. Bring one synthetic output to the sandbox and watch the record get made.