CAVAL™
Clinical AI Validation, Attribution & Lineage — NHS Walkthrough
NHS Innovation Service — Technical Positioning
Step 1 of 7 — the problem NHS already named
NHS England guidance — March 2026
Two requirements with no infrastructure underneath them
“Clinicians are accountable for the accuracy of clinical records, and outputs generated by ambient scribes must be reviewed and validated before inclusion in patient records.”
— NHS England, Guidance on AI-enabled ambient scribing products, March 2026
“Audio recordings and transcripts should typically be deleted once a verified summary has been produced, unless there is a clear justification for retaining them.”
— NHS England / ICO, Ambient scribing information governance guidance, March 2026
The gap these two requirements create together
NHS England requires clinicians to review and validate AI output before it enters the record. NHS England also recommends deleting transcripts once summaries are produced. If the transcript is deleted and the only record is the signed note, there is no evidence that the required review actually happened. CAVAL is the evidence layer that confirms the review happened — without requiring transcript retention.
Step 2 of 7 — the clinical encounter
NHS clinical setting
GP consultation with ambient scribe active
A GP sees a patient for a follow-up appointment. An ambient scribe listed on the NHS England AI Supplier List is running in the background, capturing the consultation. The scribe will generate a draft clinical note for the GP to review before signing into the EPR.
What NHS England requires at this moment
The patient must be informed the ambient scribe is in use and given the opportunity to object. The GP must be aware of their obligations. The organisation must have completed a DPIA. All of this is policy. None of it creates a record of what happens at the clinical decision point.
Step 3 of 7 — the AI surfaces output
AI output — ambient scribe draft note
Draft clinical note generated
The ambient scribe produces a draft SOAP note from the consultation. The note is clinically plausible, well-structured, and reads like careful documentation. It contains findings that may or may not accurately reflect what was discussed. The GP must review and validate it before signing into the EPR.
"ai_output": {
"tool_id": "ambient-scribe-v3.2",
"tool_registry": "NHS England AI Supplier List",
"output_type": "draft_clinical_note",
"surfaced_at": "2026-05-14T10:14:22Z",
"content_hash": "sha256:f7c2..."
}
"tool_id": "ambient-scribe-v3.2",
"tool_registry": "NHS England AI Supplier List",
"output_type": "draft_clinical_note",
"surfaced_at": "2026-05-14T10:14:22Z",
"content_hash": "sha256:f7c2..."
}
What CAVAL captures at this moment
The AI output is recorded at the moment it is surfaced — which tool produced it, whether it is listed on the NHS England AI Supplier List, the exact timestamp, and a tamper-evident hash of the draft content. This record is immutable from this point forward. The transcript has not yet been deleted.
CAVAL captures no patient-identifiable information — only metadata necessary for governance.
Step 4 of 7 — the clinician reviews
The moment NHS England requires to be documented — but has no infrastructure for
GP reviews, modifies, and validates the draft note
The GP reads the draft note. She corrects two findings that the scribe captured inaccurately. She adds clinical reasoning that the AI could not have known. She validates the note as an accurate record of the consultation. NHS England says this review must happen. Current EPR workflows do not consistently create a reconstructable record that it did.
"clinician_decision": {
"admissibility": "modify",
"clinician_id_hash": "sha256:3a7f...",
"decision_timestamp": "2026-05-14T10:16:48Z",
"review_duration_sec": 146,
"fields_modified": 2,
"rationale_code": "clinical_correction"
}
"admissibility": "modify",
"clinician_id_hash": "sha256:3a7f...",
"decision_timestamp": "2026-05-14T10:16:48Z",
"review_duration_sec": 146,
"fields_modified": 2,
"rationale_code": "clinical_correction"
}
Step 5 of 7 — the transcript is deleted
NHS England / ICO recommendation
Transcript deleted — summary retained
The organisation follows NHS England and ICO guidance and deletes the audio recording and transcript once the verified summary has been produced. This is the correct data minimisation approach. It reduces storage cost, data protection liability, and ICO exposure. The signed note enters the EPR.
Without CAVAL: the transcript is gone and the review is unverifiable
NHS England required the review to happen. There is now no evidence it did.
With CAVAL: the attribution record survives transcript deletion
CAVAL's tamper-evident attribution record captured the review event before the transcript was deleted. The record of what the AI produced, that the GP reviewed it for 146 seconds, that she modified two fields, and that she validated it as accurate — all of that exists independently of the transcript. The data minimisation goal and the accountability requirement are both satisfied simultaneously.
Patient data and Caldicott alignment
CAVAL stores no patient-identifiable information — only the metadata necessary for governance accountability. This aligns with Caldicott principles by minimising use of patient-identifiable data while preserving the evidence of clinical decision-making.
Step 6 of 7 — the complete attribution record
CAVAL attribution record — complete
What exists when NHS Resolution, CQC, or ICO asks
encounter_idenc_20260514_NHS_0031
ai_toolambient-scribe-v3.2
registry_statusNHS_AVT_verified
output_typedraft_clinical_note
ai_surfaced_at10:14:22 UTC
admissibilitymodify
review_duration146 seconds
fields_modified2
decision_at10:16:48 UTC
transcript_statusdeleted_per_ICO_guidance
record_typetamper-evident
append_onlytrue
vendoragnostic
What this answers
When NHS Resolution asks whether a clinician reviewed AI output before acting on it. When CQC asks whether AI was reviewed before signing. When ICO asks whether data minimisation was applied. When a claimant’s solicitor asks whether the clinician actually read the AI-generated note. The answer exists. Without CAVAL — and without the transcript — it doesn’t.
Step 7 of 7 — where CAVAL sits in the UK regulatory stack
The MHRA AI Airlock finding — 2025
The gap was named. Nobody built the infrastructure.
“Certain alerts — for example, relating to human-AI agreement — could be managed locally by clinical governance or management teams.”
— MHRA AI Airlock Simulation Workshop Report, Post-Market Surveillance, 2025
Newton’s Tree monitors drift and AI performance at population level. CAVAL focuses on that local clinical governance layer — the per-encounter human decision record that population-level monitoring cannot capture.
CAVAL complements the NHS AI Lab’s focus on safe AI deployment by providing the encounter-level attribution record missing from current governance tooling. Attribution events can be surfaced via FHIR R4-compatible resources, enabling integration without workflow disruption. CAVAL’s governance layer can also support ICS-level assurance where AI tools are deployed across multiple Trusts.
How CAVAL fits the UK governance stack
1-3
AI development, validation & population-level monitoring
Newton’s Tree (FAMOS)
4
Per-encounter attribution — human-AI agreement at decision point
CAVAL™ ← this layer
5
Clinical documentation — EPR audit trails, signed notes
EMIS / SystmOne / other EPR systems
6-7
Regulatory & accreditation
CQC, NHS Resolution, MHRA, DTAC, ICO
CAVAL’s current NHS engagement
NHS Innovation Service — Needs assessment complete. Health Innovation Yorkshire & Humber assigned. Technical positioning discussions underway.
MHRA — Current positioning: outside SaMD scope based on current description. Does not inform, drive, or perform clinical management.
DTAC — Confirmed outside device scope pre-prototype. Engage post-pilot.
UK ICO Innovation Advice — Case 00000133 active. Response due May 28, 2026.
DCB0129 — Clinical risk management standard. To be initiated during MVP build. CAVAL’s append-only architecture is DCB0129-aligned by design.
Open standard — CC BY 4.0, published at github.com/cavallayer. Vendor-agnostic across NHS AI deployments.
Pilot co-development — Pilot design and deployment will be co-developed with the participating Trust to respect local governance structures.
1 of 7