AI
Turn EDFlow AI features on per site: the six layers that must all allow a feature, the governance gates G-AI-1 to G-AI-6, budgets, conversation retention, the kill switch, and where flagged conversations go.
AI features are off by default in production. Each one runs only when every layer below allows it; if any layer is unknown or off, the feature stays off and the normal screen works as usual.
The layers
| Layer | Who controls it | Effect |
|---|---|---|
| Hard switch on the deployment | Platform engineers | Every AI function refuses; entry points hidden |
| Platform kill switch | Platform administrators, audited | Entry points disappear within seconds; in-flight answers stop |
| Platform flags | Platform administrators, per environment and site | Per feature |
| Site settings (this page) | Managers with settings.manage, audited | Per feature, languages, budget, retention |
| Governance gates | See below | Patient- and family-facing features in production |
| Budget | Automatic | Features pause when the monthly budget is used up |
Site settings
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
ai.enabled | false | boolean | AI features at this site (F-35.3 layer 4). (Reduces privacy) |
ai.features.patientAssistant | false | boolean | AI feature: patientAssistant. (Reduces privacy) |
ai.features.familyHelper | false | boolean | AI feature: familyHelper. (Reduces privacy) |
ai.features.familyCatchUp | false | boolean | AI feature: familyCatchUp. (Reduces privacy) |
ai.features.testExplainers | false | boolean | AI feature: testExplainers. (Reduces privacy) |
ai.features.machineTranslation | false | boolean | AI feature: machineTranslation. (Reduces privacy) |
ai.features.voiceNative | false | boolean | AI feature: voiceNative. (Reduces privacy) |
ai.features.voiceWeb | false | boolean | AI feature: voiceWeb. (Reduces privacy) |
ai.features.requestDigest | false | boolean | AI feature: requestDigest. (Reduces privacy) |
ai.features.quickReplies | false | boolean | AI feature: quickReplies. (Reduces privacy) |
ai.features.handover | false | boolean | AI feature: handover. (Reduces privacy) |
ai.features.patientMessageDrafts | false | boolean | AI feature: patientMessageDrafts. (Reduces privacy) |
ai.features.askData | false | boolean | AI feature: askData. (Reduces privacy) |
ai.features.insights | false | boolean | AI feature: insights. (Reduces privacy) |
ai.features.weeklyReport | false | boolean | AI feature: weeklyReport. (Reduces privacy) |
ai.features.anomalies | false | boolean | AI feature: anomalies. (Reduces privacy) |
ai.features.mappingAssistant | false | boolean | AI feature: mappingAssistant. (Reduces privacy) |
ai.features.catalogChecks | false | boolean | AI feature: catalogChecks. (Reduces privacy) |
ai.features.contentAuthoring | false | boolean | AI feature: contentAuthoring. (Reduces privacy) |
ai.features.feedbackThemes | false | boolean | AI feature: feedbackThemes. (Reduces privacy) |
ai.features.commandAssistant | false | boolean | AI feature: commandAssistant. (Reduces privacy) |
ai.features.auditExplainer | false | boolean | AI feature: auditExplainer. (Reduces privacy) |
ai.patientLanguages | [] | array | Machine-translated patient languages (each enabled in aiLanguages). (Reduces privacy) |
ai.monthlyBudgetUsd | 500 | 0–100000 usd | Site AI budget per month (AI_DEFAULT_SITE_BUDGET_USD). |
ai.conversationRetentionDays | 7 | 0–30 days | Days AI conversations are kept after the session ends. (Reduces privacy) |
ai.safetyReviewSampleRate | 0 | 0–1 ratio | Random sampling of unflagged conversations; > 0 only with randomSampleApproval. (Reduces privacy) |
ai.selfHarmAutoAlert | true | boolean | Self-harm sends a structured urgent alert; off only with selfHarmAlertWaiver (D-AI-03). (Reduces privacy) |
ai.distressAutoAlertSeconds | 60 | 30–120 seconds | Red-flag distress alert delay (D-AI-03). |
ai.showAssistantByDefault | true | boolean | Show the assistant entry point by default. |
ai.crossSitePeerRanges | false | boolean | Cross-site peer ranges (AI-15, Q-AI-06). (Reduces privacy) |
ai.governance.privacyApproval | — | object | Governance gate record: privacyApproval. (Reduces privacy) |
ai.governance.regulatoryMemo | — | object | Governance gate record: regulatoryMemo. (Reduces privacy) |
ai.governance.evalSignoff | — | object | Governance gate record: evalSignoff. (Reduces privacy) |
ai.governance.piaTra | — | object | Governance gate record: piaTra. (Reduces privacy) |
ai.governance.hazardLog | — | object | Governance gate record: hazardLog. (Reduces privacy) |
ai.governance.staffBriefing | — | object | Governance gate record: staffBriefing. (Reduces privacy) |
ai.governance.mappingAssistantPrivacyApproval | — | object | Governance gate record: mappingAssistantPrivacyApproval. (Reduces privacy) |
ai.governance.randomSampleApproval | — | object | Governance gate record: randomSampleApproval. (Reduces privacy) |
ai.governance.selfHarmAlertWaiver | — | object | Governance gate record: selfHarmAlertWaiver. (Reduces privacy) |
ai.governance.safetyReviewers | [] | array | The designated AI safety review group (§2.4 footnote 8). (Reduces privacy) |
- Features are switched one by one: patient assistant, family helper, test explainers, machine translation, voice, request digest, handover summary, message drafts, Ask your data, insights, weekly report, anomaly alerts, mapping assistant, catalogue checks, content authoring, and more.
- Patient languages for the assistant: each must be reviewed first.
- Monthly budget in US dollars.
- Conversation retention: 0 to 30 days after the session ends (default 7).
- Self-harm auto-alert is on by default and can be turned off only with the ED clinical lead's recorded waiver.
Governance gates
A patient- or family-facing feature can't be turned on in production until every gate is recorded:
| Gate | Evidence | Recorded by |
|---|---|---|
| G-AI-1 | Privacy office approval of the data flows, including processing outside Canada with zero data retention | Privacy officer |
| G-AI-2 | Regulatory memo confirming the non-device intended use | Site manager records receipt of the signed memo |
| G-AI-3 | Clinical lead sign-off of the current evaluation report | A clinical approver |
| G-AI-4 | PIA addendum and TRA update | Privacy officer |
| G-AI-5 | Hazard log reviewed for this release | Clinical lead |
| G-AI-6 | Staff briefing done | Site manager |
Staff-only and aggregate features (digest, handover, drafts for staff, Ask your data, insights, reports, mapping, catalogue checks) need G-AI-1 and G-AI-4 only. The mapping assistant with real hospital feed samples also needs G-AI-1.
Flagged conversations
Conversations where the safety layer flagged distress, self-harm or misuse go to a small safety review group outside the care team. Privacy officers see how that works in AI review. Random sampling of unflagged conversations is off unless the privacy office approves it.
The kill switch
If something looks wrong, ask the platform team to use the kill switch: every AI entry point disappears within seconds across all sites. Your site-level switches stay as they were.
Related
- AI governance for reviewers
- AI assistance and Ask the assistant
Last updated on