ISO 42001 · NIST AI RMF · WHO AI Ethics
Every AI surface on ZenoXCare runs under a published management system, declares its scope and limits up front, captures a replayable trace of every decision, and hands borderline cases to a human. AI never finalises identity, payment, or clinical outcomes.
Frameworks aligned
ISO 42001 · NIST AI RMF · WHO
Trace retention
Replayable · 5 years
Decision authority
Human-in-the-loop
Inference modes
On-device WebLLM + cloud
The three anchors
Each framework links to its publisher's authoritative source and to ZenoXCare's internal control mapping.
ISO/IEC
AI Management System — requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation.
Scope: WebLLM on-device assist, federated AI inference, agentic workflows; AI register and lifecycle controls.
NIST (USA)
AI Risk Management Framework — voluntary guidance to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems.
Scope: AI lifecycle risk register, model evaluation harnesses, replayable traces, regression gates.
World Health Organization
Ethics and governance of artificial intelligence for health — six principles ensuring AI works to the public benefit of all countries.
Scope: Clinical decision support boundaries (non-authoritative AI surfaces), human-in-the-loop overrides, equity guardrails.
NIST AI RMF 1.0 — applied
The four NIST functions, each grounded in a concrete control with audit-defensible evidence.
Cultivate a culture of AI risk management. Define policies, accountability, and skills.
AI register & lifecycle policy
Every model and agent has an entry tagged with owner, dataset lineage, intended use, and out-of-scope claims.
Compliance Co-Pilot reviewer drafting
AI may draft a decision for human review; AI never finalises identity, payment, or clinical decisions.
Quarterly governance review
Standing review of model cards, evaluation deltas, incident log, and red-team findings.
Recognise context. Identify capabilities, limitations, and stakeholder impacts before deploying AI.
Use-case categorisation
Model cards classify each use as informational, advisory, or operational; only informational + advisory ship without manual gates.
Stakeholder impact assessment
DPIA-aligned assessment for any AI surface that touches PHI, biometrics, or financial decisions.
Out-of-scope claims register
Explicit catalogue of what each surface is not permitted to do (e.g. no diagnosis, no triage authority).
Test, evaluate, and document AI system performance, robustness, fairness, and explainability.
Replayable trace store
Every agent invocation captures the prompt, tool calls, retrieved chunks, and decision; reviewers can replay end-to-end.
Evaluation harness + regression gates
Public-query router, KYC rubric, and copilot drafts have golden datasets with budgets enforced in CI.
Bias + equity probes
Across language, jurisdiction, and gender slices on identity verification and agent answering.
Treat risk. Allocate resources to risks proportionate to impact, and continuously improve.
Incident response runbook
Auto-KYC incident runbook, on-call rotation, SLOs, and Datadog monitors for AI surfaces.
Kill-switch + degraded-mode plan
Every AI feature has a deterministic fallback (router, scripted response, queue handover) wired in code.
Continuous red-team
Prompt-injection corpus replayed against every release; new findings codified as regression cases.
WHO Ethics & Governance of AI for Health
The WHO principles applied to clinical and clinical-adjacent AI surfaces.
Principle 1
Members can decline AI assistance, request a human reviewer, and see exactly which signals informed any decision.
Principle 2
AI surfaces are non-authoritative for clinical decisions; clinicians retain veto. No diagnostic claims are made.
Principle 3
Every RED identity decision returns the failing signal; every AI answer is grounded in cited registries.
Principle 4
Named human owner for every model; appeal route published; reviewer audit log retained 5 years.
Principle 5
Pan-African baseline; English + planned French/Portuguese; offline-first WebLLM for low-bandwidth regions.
Principle 6
Replayable traces enable post-hoc audit; weekly cost + latency review; model swaps preserve evaluation budgets.
Interoperable by design
We publish documented surfaces for AI search, MCP clients, A2A partners, and on-device assistants — with the trust posture attached to each.
| Protocol | Surface | Trust | Description |
|---|---|---|---|
| MCP (Model Context Protocol) | lib/mcp/server.ts + /api/public/mcp-discovery | public | Read-only tools (compliance registry, intelligence manifest, public stats). No write tools exposed publicly. |
| A2A (Agent-to-Agent) | /.well-known/agent.json (skill: compliance-standards) | public | Agent card with seven example prompts and the canonical machine-readable registry endpoint. |
| Intelligence manifest | /api/public/intelligence-manifest | public | Discovery surface for agentic clients: compliance, country pages, public APIs, and routing intents. |
| Deterministic micro-router | /api/public/ai-routing?q=… | public | Natural-language → URL routing for high-confidence intents. Falls back to suggestions for low-confidence. |
| On-device WebLLM | Service-worker-cached /api/public/intelligence-manifest + answer corpora | public | Stale-while-revalidate caching; answers can be drafted in-browser without sending the user's question to a remote model. |
| On-device WebLLM polish | components/local-assist/assist-polish-button.tsx — surface families: compliance_console, partner_console, member_console, telemedicine, marketing_public | authenticated | Bundled SmolLM2 (or pinned successor) runs entirely in the browser via WebLLM. Polishes user-typed text for grammar and clarity only. The system prompt forbids inventing facts, dates, or regulatory claims. Deterministic regex fallback kicks in when the engine is unavailable. Feature-flagged via NEXT_PUBLIC_LOCAL_ASSIST_ENGINE. |
| On-device WebLLM draft starter | lib/local-ai/independence-applicant-reply-draft.ts — applicant reply on /p/clinicians/independence | authenticated | Generates a SHORT starter reply for an applicant responding to a compliance 'request more information' note on their independent-practice application. Receives ONLY the info-requested note text — no patient, clinical, or financial context. Output uses placeholders like [INSERT YOUR INDEMNITY CERTIFICATE NUMBER] so the model never invents document numbers, dates, or regulatory claims. Deterministic template fallback when the engine is unavailable. Same on-device privacy posture as the polish surfaces; bundled SmolLM2 weights cached in the service worker for offline use. |
| Compliance Co-Pilot | /api/compliance/kyc-reviews/[id]/copilot-draft | authenticated | Drafts a recommended decision for borderline KYC reviews. Reviewer must accept, override, or request more evidence. |
Every field where bundled WebLLM polish is offered. The list auto-updates when developers add new compose surfaces, gated by a CI drift test against lib/ai/assist-polish-surface-registry.ts.
compliance_console
Compliance reviewer compose surfaces — KYC reviews, independence queue (acknowledge / request info / reject notes), governance freezes, moderation, appeals, access programs, pilot config, clinician verification.
app/c/ · components/compliance/
partner_console
Partner compose surfaces — independent-practice submission / reply / withdraw, order dispute / confirm / new-order notes, clinician credential submission, patient review notes, ghana discovery settings, investigations fulfillment.
app/p/ · components/partner/
member_console
Member compose surfaces — care concierge conversations, support disputes, account profile, encounter reviews, review appeals, find-care, care triage, patient location.
app/g/ · components/gamer/ · components/concierge/
telemedicine
Telemedicine workspace — patient and clinician compose during a live session.
components/telemedicine/
marketing_public
Public marketing forms — contact form polish (no PII leaves the browser).
app/(marketing)/
Defenses, layer by layer
Threats are catalogued; controls are committed in code; a versioned corpus is replayed in CI on every release.
Input
Threat
Prompt injection from member-supplied text or untrusted retrieval
Control
Inputs marked as data, never as instructions; system prompt pinned; allow-list of tools per agent role.
Tool
Threat
Tool-injection (an agent tricked into calling a destructive tool)
Control
Read-only tools only on the public agent surface; authenticated tools require session + RBAC + idempotency keys.
Retrieval
Threat
Poisoned or stale knowledge influencing answers
Control
Retrieval is restricted to versioned registries (standards, certifications, jurisdictions). Each chunk carries provenance.
Output
Threat
Hallucinated claims, unsafe code, or PII leakage
Control
Outputs validated against the compliance language scanner; structured outputs validated by Zod schemas before display.
Identity
Threat
Confused-deputy attacks across MCP/A2A boundaries
Control
Every cross-protocol call carries a fresh signed envelope with caller, capability, and scope; no ambient authority.
Privacy
Threat
Sensitive context leaving the device
Control
On-device WebLLM serves the offline-first tier; remote inference disables training + retains zero data.
FAQs
The page that explains our AI governance also demonstrates it — try the on-device assistant below before reading the canonical FAQ. Your question runs entirely in your browser via WebGPU (privacy-preserving by construction); falls back to the published FAQ pair when WebLLM isn't available.
No. AI surfaces are explicitly non-authoritative for clinical decisions. Clinicians retain full diagnostic and treatment authority; AI may surface evidence, draft notes, or summarise for review only.
ISO/IEC 42001:2023 for the AI management system, NIST AI RMF 1.0 for risk management, and the WHO Ethics & Governance of AI for Health for the six principles applied to clinical surfaces.
Member-supplied text is treated strictly as data, never as instructions. The system prompt is pinned, tool access is gated by role, retrieval is restricted to versioned registries, and outputs are validated before display. A versioned prompt-injection corpus is replayed in CI on every release.
Yes. Members can decline AI assistance and request a human reviewer for any decision, including KYC, support, and clinical workflows. Opt-outs are recorded and respected platform-wide.
MCP (Model Context Protocol) for read-only tool discovery, A2A (Agent-to-Agent) via /.well-known/agent.json, an intelligence manifest, and a deterministic natural-language micro-router. Each is publicly documented and crawlable.
The replayable trace store, evaluation harness budgets, model cards, prompt-injection corpus, and incident log are all available to auditors under NDA. The quarterly compliance evidence pack bundles them.
On-device WebLLM polish runs in three places: (1) compliance reviewer notes on /c/clinician-independence and /c/admin/kyc-review, (2) the applicant's independent-practice submission message, reply-to-compliance, and withdraw-reason fields on /p/clinicians/independence, and (3) member-facing assist surfaces like Care Concierge offline mode. In every case the model executes inside the browser via WebGPU and the user's text never leaves the device. The button is feature-gated by NEXT_PUBLIC_LOCAL_ASSIST_ENGINE and falls back to a deterministic regex polish when the engine is unavailable.
We share model cards, prompt-injection corpora, and replayable traces with auditors and partners under NDA. Customer trust pages can embed the live posture.