The Governance Gap: Why AI Needs a Program, Not Just a Policy

Most healthcare organizations don't have an AI problem. They have a governance problem that happens to involve AI. Ambient documentation tools, coding assistants, denial-prediction models, scheduling algorithms — these arrive department by department, vendor by vendor, sometimes without appropriate vetting or approvals. The common result is an organization running a dozen AI tools and even more use cases with no single person who could produce a complete list of them if asked. That gap is where risk lives, and it's the gap regulators are increasingly asking about directly.

No One Department Can Own This Alone

AI touches too many disciplines at once to belong to one stakeholder. Privacy owns the question of what data a tool can touch and under what authorization, but not whether the model itself is biased or clinically sound. Security owns access controls and vendor risk but does not build the model or tool. Compliance owns regulatory alignment but isn't positioned to evaluate a model's training data. Clinical leadership understands workflow and patient safety risk but rarely sees a vendor's data lineage documentation. Legal owns contracts but is often looped in when a contract is needed. When everyone governs AI from their own corner, the organization ends up with three partial pictures and no complete one. HHS's expanding Section 1557 nondiscrimination obligations, the FDA's evolving posture on AI-enabled clinical decision support, and the growing list of state laws requiring human sign-off on adverse determinations all assume someone is looking at the whole picture. In practice, that assumption often doesn't hold.

Governance Is More Than a Committee

It's tempting to treat AI governance as solved once a committee exists. A committee is necessary, but it's the visible part of something that has to run underneath it every day. A real program has multiple working parts:

• Workflows. There has to be a defined path for how a new tool or use case gets approved, and that path should scale with risk. A scheduling tool that never touches PHI doesn't need the same scrutiny as a coding assistant processing claims data, and neither needs what a clinical decision-support tool touching diagnosis or treatment requires. Without tiered workflows, either everything gets heavy review and the business stalls, or nothing does and the risk goes unmanaged.
• Policy. A broad, company-wide AI usage policy supported by departmental SOPs sets the rules of the road at the organizational level. It should touch on AI usage, development and deployment, establishing what's permitted, what requires review, what's prohibited outright, and who has authority to decide.
• Training. Workforce members need to know how to request approval for a new tool, and just as importantly, how to check what's already been approved before they start using something on their own. This is where shadow AI takes root; it can stem simply from a workforce that has no idea a review process exists or how to use it.
• Monitoring. Approval isn't the finish line. Tools need to be checked periodically for both risk drift and for whether they're still delivering the value that justified approving them in the first place. A tool that was accurate and useful at launch can quietly stop being either.

Who Belongs in the Room

The committee itself should include compliance, privacy, and security at minimum, alongside clinical leadership where the tool touches patient care, appropriate technical stakeholders such as IT, DevOps, and Product who understand what the model actually does, and legal counsel involved before a contract is signed, not after. But the group only matters if it's empowered. Its decisions should carry real weight, including the ability to say no or to pause a deployment rather than just advisory. A governance body without authority is a discussion group, not a control.

The One Check That Matters Most

Every piece of the program supports a single principle: a person, not a model, is accountable for consequential decisions. Where AI touches diagnosis, treatment, or a coverage determination, someone qualified has to be able to explain, override, or defend the outcome. That "human in the loop" thread runs through nearly every AI law healthcare organizations are contending with right now, regardless of which state wrote it.

The Bottom Line

AI governance isn't a committee you stand up once. It's workflows, policy, training, and monitoring working together, and it only works well when all departments act cohesively according to agreed-on governance structure. Many organizations can have good people in every department but lack that connective tissue that makes an AI governance program run. A good AI governance program builds those connections and ensures they run smoothly.

CohesiveIQ helps healthcare organizations build AI governance programs that hold up to regulatory scrutiny — from policy and workflow design to committee structure and ongoing oversight. Contact us to talk through where your organization stands.

‍