What we learned auditing 12 radiology AI tools

Over the past six months, we conducted governance audits of twelve AI tools deployed across four Australian radiology practices. The tools ranged from chest X-ray triage algorithms to mammography CAD systems and fracture detection models. While each practice had different workflows, the compliance gaps we found were remarkably consistent.

The most common issue was incomplete tool registration. Nine of the twelve tools lacked documentation of their TGA classification status, intended use boundaries, or version history. In three cases, the practices were running software versions that differed from what was listed in their records. The second pattern was absent or generic policies. Two practices had AI governance policies, but both were copied from general IT policy templates and contained no clinical-specific provisions.

Performance monitoring was the third major gap. Only one practice had a structured process for tracking AI concordance rates, and even that was a manual spreadsheet updated quarterly. The remaining practices relied on informal radiologist feedback, which was neither documented nor systematic. When we asked about incidents, such as cases where an AI tool produced a clearly incorrect output, all four practices acknowledged they had occurred but none had formal incident logs.

The lesson is not that these practices were negligent. They adopted AI tools in good faith to improve patient care. The gap is structural: without a governance platform, maintaining documentation across multiple tools, staff, and workflows is unrealistic. The practices that subsequently onboarded to Attest were able to close their audit findings within weeks, not because the platform does the thinking for them, but because it provides the structure that makes governance sustainable.