The Do's and Don'ts

Do
•    Stand up an AI governance committee with real teeth, multidisciplinary membership, and a charter that survives the departure of its champion.
•    Inventory every AI system in your enterprise- including the ones nobody admitted to procuring- and classify each by risk, regulatory exposure, and clinical consequence.
•    Require a model card or equivalent transparency document for every deployment, and demand local validation before go-live. National performance is not local performance.
•    Build the human-in-the-loop into the workflow, not the disclaimer. Centaur cognition, the clinician and the algorithm reasoning together, is the operating model. Cyborg dependency, where the human becomes a rubber stamp, is the failure mode.
•    Monitor continuously for drift, bias, and harm. A model that performed on Tuesday may not be the same model on Friday.
•    Document everything. If the DOJ knocks, the audit trail is your defense.

 

Don't
•    Don't confuse vendor marketing with regulatory compliance. "FDA-cleared" addresses a narrow indication; it does not exempt you from CHAI, ONC, or DOJ exposure.
•    Don't let AI become invisible infrastructure. The moment governance stops asking what is running where, the moment something goes wrong, no one knows where to look.
•    Don't delegate the judgment calls. Polanyi's paradox- we know more than we can tell- means that the tacit clinical knowledge most worth preserving is precisely what the algorithm cannot encode. Wisdom is knowing what not to delegate.
•    Don't treat governance as a one-time exercise. Convolutional Intelligence, or pattern recognition at scale, is the current era; Cognitive Intelligence is coming. Your framework must evolve with the technology, not freeze with the regulation.

 

Why You Need Consultants
AI governance is one of those rare domains where the gap between knowing what to do and actually doing it is the entire game. Health system leaders are not short on frameworks; they are short on the institutional muscle to operationalize them. Consultants earn their keep by translating CHAI's RAIG, ONC's source attributes, the FDA's TPLC expectations, NIST's RMF, and ISO 42001's AIMS clauses into a working committee charter, an inventory methodology, a model card template, and a continuous monitoring dashboard — in months rather than years. They bring pattern recognition across institutions, regulatory fluency no single CMIO can sustain alone, and the political neutrality to tell the CEO that the favored vendor's tool will not pass muster. The do-it-yourself model has produced too many governance committees that meet quarterly, generate beautiful PowerPoints, and govern nothing.

 

Governance Is Not Strategy, and It Is Not IT
Three concepts get conflated, often by the same executive in the same meeting, and the conflation is dangerous.
AI strategy asks where artificial intelligence creates clinical, operational, and economic value, and how the institution should invest, partner, and prioritize. It is a question of ambition. AI governance asks how the institution ensures that whatever it deploys is safe, fair, effective, transparent, and legally defensible. It is a question of stewardship. Data and IT governance ask whether the underlying infrastructure — data quality, lineage, access control, interoperability, cybersecurity — is sound. It is a question of plumbing.

A health system can have brilliant strategy, immaculate IT, and still fail catastrophically at AI governance because no one asked whether the sepsis model worked on the hospital's own patients. The reverse is equally true: rigorous AI governance applied to a strategically incoherent portfolio simply governs the wrong things faithfully. All three must coexist; none substitutes for the others.

 
Three Key Takeaways 

1. Healthcare AI governance is now a six-force operating environment, not a single regulator. The FDA sets the device floor, ONC enforces EHR transparency, CHAI and the Joint Commission supply the operating playbook (and soon accreditation), the EU AI Act sets the global standard, the DOJ and OCR bring the enforcement consequences, and ISO/IEC 42001 provides the certifiable management system that ties them together. No single framework is sufficient; the institutions that thrive will be those that map their governance program to all six simultaneously.

2. Governance, strategy, and IT are three distinct disciplines that cannot substitute for one another. AI strategy asks where to invest (ambition); AI governance asks whether what is deployed is safe, fair, and defensible (stewardship); data and IT governance asks whether the underlying plumbing is sound (infrastructure). A health system can have brilliant strategy, immaculate IT, and still fail catastrophically at AI governance because no one validated the sepsis model on local patients. All three must coexist as parallel programs, each with its own owner, charter, and accountability.

3. The gap between knowing what to do and actually doing it is the entire game — and it is where consultants earn their keep. Frameworks are abundant; institutional muscle to operationalize them is scarce. Translating CHAI's RAIG, ONC's source attributes, the FDA's TPLC expectations, NIST's RMF, and ISO 42001's AIMS clauses into a functioning committee charter, AI inventory, model card template, and continuous monitoring dashboard is work that most health systems cannot do alone in any reasonable timeframe. Governance, in the end, is wisdom written down — and writing it down well is a discipline, not a meeting.

Closing
The era of Convolutional Intelligence has handed medicine extraordinary new capability and an equally extraordinary new set of obligations. The FDA gives us the device floor; ONC gives us the EHR transparency; CHAI and the Joint Commission give us the operating playbook; the EU gives us the global regulatory standard; the DOJ gives us the consequences; ISO 42001 gives us the management system that ties it all together. The institutions that thrive in this environment will treat governance not as a tax on innovation but as the condition of it — the discipline of knowing, with humility and precision, what to delegate to the machine and what to keep for the clinician. Governance, in the end, is wisdom written down.