Deployment readiness checklist
Approve the product and the service pathway together.
This checklist is designed for a multidisciplinary go-live review. Each item needs a named owner, evidence location, status, residual risk and approving authority.
Status key: Not started • In progress • Evidence ready • Approved • Not applicable with rationale. A production implementation should move this checklist into the organisation’s controlled assurance system.
Gate 1
Purpose, scope and regulation
| Check | Required evidence | Owner/status |
|---|---|---|
| Intended purpose and users approved | Precise claims, conditions/episodes, setting, users, exclusions and clinical boundary. | Product / Clinical / Regulatory |
| Medical-device status determined | Documented rationale and specialist advice; regulatory route completed where applicable. | Regulatory |
| Provider pathway approved | Service specification, operating hours, capacity, urgent routes, escalation and downtime. | Clinical service owner |
| Benefits and risks stated | Benefits case, evidence gaps, hazard analysis and residual-risk acceptance. | Executive sponsor |
Gate 2
Clinical safety and operation
| Check | Required evidence | Owner/status |
|---|---|---|
| Clinical safety management in place | Named clinical safety officers, clinical risk plan, hazard log, safety case and deployment responsibilities. | Supplier and provider CSOs |
| Protocols configured | Enrolment, capture, review, urgency, escalation, failed contact, safeguarding and closure protocols. | Clinical lead |
| Workforce ready | Rota, capacity model, role descriptions, training, competence, supervision and support. | Operations |
| Incidents and learning ready | Reporting routes, triage, duty of candour interface, device vigilance where applicable and feedback loop. | Patient safety |
Gate 3
Information, privacy and records
| Check | Required evidence | Owner/status |
|---|---|---|
| Roles and lawful conditions mapped | Controller/processor allocation, processing purposes, Article 6 and special-category condition, consent where relied upon. | Information governance |
| DPIA approved | Data flows, necessity, proportionality, risks, consultation and mitigations. | DPO / SIRO |
| Records lifecycle approved | Authoritative record, writeback, original/derivative status, retention, deletion, legal hold and export. | Records manager |
| Transparency complete | Patient, carer and staff privacy information, rights process and contact/complaint routes. | DPO / Communications |
Gate 4
Security, technology and integration
| Check | Required evidence | Owner/status |
|---|---|---|
| Architecture and threat model approved | Data-flow diagrams, trust boundaries, tenant model, image-processing path and support access. | Security architect |
| Security testing passed | Secure development evidence, vulnerability scans, independent penetration test and remediation. | CISO / Supplier |
| Identity and access ready | Authentication, roles, privileged access, joiner/mover/leaver and access review. | IAM owner |
| Resilience demonstrated | Monitoring, backup restore, RTO/RPO, continuity test, downtime process and support model. | Technical service owner |
| Integration reconciled | Identifier matching, API validation, error queues, record writeback and data quality monitoring. | Integration lead |
Gate 5
Accessibility, equality and communications
| Check | Required evidence | Owner/status |
|---|---|---|
| Accessibility tested | WCAG target, automated/manual results, keyboard, screen reader, zoom, reflow, contrast and mobile tests. | Accessibility lead |
| Accessible information workflow live | Identify, record, flag, share, meet and review communication needs. | Service owner |
| Language support commissioned | Professional interpreting/translation route, translated essentials and no unsafe reliance on machine translation. | Equality / Operations |
| Equality impact assessed | Relevant population, barriers, mitigations, alternative routes, metrics and review date. | Equality lead |
| Public claims approved | Website, app store, training and sales wording consistent with evidence and regulatory status. | Clinical / Legal / Regulatory |
Gate 6
Pilot and post-go-live control
| Check | Required evidence | Owner/status |
|---|---|---|
| Pilot protocol approved | Cohort, measures, analysis, safety oversight, stopping rules and version control. | Pilot sponsor |
| Go-live command structure ready | Named decision makers, daily review during launch, escalation contacts and rollback authority. | Programme lead |
| Monitoring dashboard ready | Safety, backlog, performance, quality, equity, complaints, support and availability. | Service owner |
| Change control established | Risk-based approval for software, model, content, protocol, integration and supplier changes. | Change authority |
| Review dates set | 30/60/90-day and annual reviews, policy review and evidence refresh. | Executive sponsor |