Queensland Health Artificial Intelligence Framework S2: Stage 2, project delivery requirements (Gate 1): define business objectives, establish project governance and plan proportionate to risk, complexity and cost with clinical governance for clinical workflows and consumer representation, confirm information security provisions can be met, update the risk assessment and categorise risks with management plans, consult stakeholders including consumers and community, obtain legal advice on confidentiality, data access, legislation, intellectual property, auditability of AI decisions, cyber security, TGA, research governance, privacy and cloud or offshoring, evaluate options in detail for value for money with costs, infrastructure and enterprise architecture alignment, data governance and privacy impact assessment, workforce and training needs, follow the procurement framework if going to market, and secure research governance and ethics approval for research partnerships, leading to a written decision on build, partner or procure

What does S2 require?

Stage 2 details the evidence for investment so decision makers can choose between building a model internally, partnering with external parties such as universities or technology companies, or procuring from a vendor, and judge value for money and priority. The initiative owner defines the business objectives the solution will address and how; follows robust project management, establishing governance (project control group, reference group, steering committee, oversight committee, ICT or digital governance) suited to the risk, complexity and cost, with clinical governance for AI affecting clinical workflows and consumer representation considered; ensures the information security provisions of the information security management system can be met for the information's classification, integrity and availability; updates the AI Risk Assessment Tool, categorising risks as low, medium or high with management plans and using it to flag misalignment with the guiding principles; consults the stakeholders identified, including consumer or community engagement where applicable; obtains legal advice on the risks identified, such as patient and commercial confidentiality, data access, health portfolio legislation, intellectual property, auditing, tracking and accountability of AI decision-making, cyber security, TGA requirements, research governance, privacy and cloud or offshoring; explores and comparatively evaluates the options for value for money and achievability, identifying high-level cost and operational affordability, digital infrastructure, integration and support requirements aligned with the Queensland Health Enterprise Architecture (engaging a solution architect and eHealth specialists such as cyber security for large or complex solutions), data requirements and governance at HHS and statewide levels including legislation and the department's privacy impact assessment process where privacy is affected, and workforce and training needs; follows the Queensland Health procurement framework if going to market, including market research, regulatory and financial requirements and an approved vendor evaluation process and panel; and, for research or external partnerships, secures research governance and Human Research Ethics Committee approval in every jurisdiction required. The decision maker, satisfied with the options against the do-nothing scenario, approves progression to the business case, to implementation stages 4 or 5, approval pending funding, redirection to Stage 1 or no approval, in writing with reasons.