AI Governance Framework for Mid-Size Hospitals Starting From Scratch

Key Takeaways

·The AMA's 8-step AI Governance Toolkit is the most practical starting point for hospitals without an existing framework — it's what many community hospitals are already using as their checklist.
·The CHAI Blueprint is the most thorough governance reference available, but its full requirements may be unrealistic for a mid-size hospital to implement immediately. Use it as a target, not a first-year mandate.
·The Joint Commission co-branded AI guidance in September 2025 citing the CHAI Blueprint, effectively signaling expectations to 22,000+ accredited organizations.
·The Duke/Trillium case study is the strongest documented evidence that a non-academic hospital can build governance from scratch using an external partner and a structured model.
·Starting with a focused scope — governing only high-risk or vendor-provided AI initially — is both realistic and well-supported by the evidence.
·Three factors appear consistently across all frameworks: an executive champion, interdisciplinary committee participation, and willingness to bring in outside expertise.

The short answer

Start with the AMA's 8-step governance toolkit as your operational checklist, use the CHAI Blueprint as a reference for where you're headed, and borrow the People-Process-Technology-Operations model from the Duke/Trillium case study to organize your implementation. Embed AI review into committees you already have rather than creating entirely new bureaucracy. Begin governing only high-risk and vendor-provided AI, then expand. The hospitals that struggle are typically the ones who try to build a complete framework before deploying a single tool, or who deploy tools before building any governance at all.

Why Not Just Pick One Framework and Follow It?

The instinct to find a single, authoritative framework and implement it fully is understandable. It's also not what the evidence supports for most mid-size hospitals. The primary frameworks available — the CHAI Blueprint, the AMA toolkit, NIST AI RMF, and the Joint Commission's emerging guidance — were designed at different levels of abstraction and for different audiences. None of them maps cleanly to the operational reality of a 200-bed community hospital with a small IT team and no dedicated AI governance staff.

The CHAI Blueprint, co-branded by The Joint Commission in September 2025, is the most thorough governance reference in healthcare. But critics have noted directly that its requirements for rigorous bias audits on every AI tool are unrealistic for community hospitals. The AMA toolkit is practical but was designed as an entry point, not a complete governance architecture. NIST AI RMF provides excellent conceptual structure but requires significant translation work to apply in a clinical setting.

What the evidence actually supports is using these frameworks in combination: the AMA toolkit as an operational checklist, CHAI as a long-horizon reference, and the PPTO model from Duke as a practical implementation structure. That's not a compromise position. It's what the research shows working.

The AMA 8-Step Toolkit: Your Starting Checklist

The American Medical Association released its AI Governance Toolkit in August 2025, and it has become the default starting checklist for hospitals without an existing framework. It's practical, structured, and specifically designed for health systems that are building governance from scratch. Many community hospitals are already using it.

Establish executive accountability

Name a specific executive — typically the CIO or CMO — as the accountable leader for AI governance. This is not a committee function. Someone specific needs to own the risk and be visible to the board. Without this, every other step tends to stall.

Form a multidisciplinary working group

The working group should include clinical leadership, legal and compliance, IT, quality and patient safety, and frontline staff representation. The CHAI Blueprint and nearly every case study in the literature identify interdisciplinary committee structure as a prerequisite for governance that actually functions.

Assess current policy gaps

Before you can write new policy, you need to know what you already have and where the gaps are. Many hospitals discover during this step that existing IT procurement and clinical decision support policies don't address AI at all, or that vendor contracts signed before 2023 contain no AI-specific provisions.

Develop AI-specific policies

This includes policies covering AI tool inventory and registration, vendor evaluation and due diligence, clinical validation requirements, monitoring and post-deployment review, and patient notification. The scope doesn't need to be exhaustive at first. It needs to cover high-risk use cases.

Define vendor evaluation and project intake processes

Every new AI tool that touches clinical workflows or patient data should go through a defined intake process before deployment. This doesn't need to be complex, but it needs to exist. The absence of a structured intake process is one of the most common gaps found in health system AI governance assessments.

Update implementation workflows

Clinical staff need to know when AI is in their workflow, what the AI is doing, and what their own responsibility is when they use or override an AI recommendation. Governance that lives only in policy documents without reaching frontline workflows isn't functioning governance.

Set up monitoring and post-deployment review

Governance doesn't end at go-live. AI model performance can shift over time as patient populations change or as the vendor updates the underlying model. Monitoring protocols need to specify who reviews what, how often, and what triggers escalation or suspension.

Build organizational readiness through training

Clinicians and staff who use AI tools need to understand what the tools do and don't do, what failure modes look like, and how to escalate concerns. The research shows consistently that organizations underinvest in this step relative to the technical deployment work.

The CHAI Blueprint: Where You're Headed, Not Where You Start

The Coalition for Health AI Blueprint for Trustworthy AI Implementation Guidance is the most comprehensive governance reference in the field. Its September 2025 co-branding by The Joint Commission was a significant signal: the 22,000+ organizations accredited by TJC now have a clear indicator of where governance expectations are trending, even if the Blueprint isn't a direct compliance requirement today.

The Blueprint covers the full governance lifecycle, from pre-procurement vendor assessment through deployment, monitoring, and decommissioning. It provides detailed guidance on bias assessment, model documentation requirements, performance monitoring, and the organizational structures needed to support each. This is the reference to use when you're designing your eventual governance architecture.

For a mid-size hospital starting from scratch, the practical application of the CHAI Blueprint is to use it as a gap analysis tool and a long-horizon target, not as a first-year implementation mandate. Identify which elements of the Blueprint are within reach now, which require additional infrastructure, and which require resources you don't currently have. That gap map becomes part of your governance roadmap.

What the Joint Commission Co-Branding Actually Means

The Joint Commission's September 2025 guidance citing the CHAI Blueprint doesn't make the Blueprint a compliance requirement in the formal accreditation sense. What it does is signal that TJC surveyors are oriented toward the CHAI framework when assessing AI governance, and that organizations without governance structures aligned to CHAI's categories are increasingly likely to receive observations or recommendations during surveys.

Healthcare executives often ask whether Joint Commission AI guidance creates formal requirements. The more useful question is whether a Joint Commission surveyor asking about your AI governance tomorrow would hear a structured, credible answer. Organizations that can describe an executive-accountable program with a documented inventory and defined oversight processes are in a defensible position. Organizations with no visible governance structure face an increasingly visible gap.

The PPTO Model: Proven Implementation Structure for Community Hospitals

The most instructive case study for mid-size hospitals is the Duke/Trillium Health Partners governance implementation, which used the People-Process-Technology-Operations (PPTO) framework. Trillium is a non-academic hospital — not a large academic medical center with a dedicated AI research team. The fact that they built governance from scratch with external support makes the case study directly applicable.

The PPTO model organizes governance work across four dimensions. These aren't sequential phases; they run in parallel. But organizing the work this way prevents the two most common failure modes: building governance processes that ignore organizational capacity, and standing up technology without the human structures to oversee it.

People

Forming a governance committee with the right functional representation, identifying an executive champion, and defining who has authority to approve, pause, or terminate AI tool use. At Trillium, this meant deliberate committee composition and clear decision authority — not just listing stakeholders.

Process

Co-designing evaluation workflows for new AI tools, establishing intake procedures, and defining how clinical validation happens before deployment. Process design at Trillium was collaborative, involving frontline staff rather than being handed down from IT or compliance.

Technology

Assessing existing infrastructure for gaps that would affect AI deployment, including data pipeline quality, EHR integration capacity, and monitoring tooling. Technology assessment at this stage is about understanding constraints, not selecting platforms.

Operations

Integrating AI governance review into existing operational forums rather than creating parallel governance structures. At Trillium, AI oversight was embedded into clinical quality and IT governance forums already meeting regularly, which reduced organizational overhead significantly.

Right-Sizing Governance for a Mid-Size Institution

Research across six U.S. health systems found that AI governance is resource-intensive regardless of how it's structured. The Duke report explicitly notes that processes should be "standardized and simplified" for smaller systems. This isn't an argument against governance — it's an argument for scoping it realistically at the start.

For a mid-size hospital, right-sizing governance means making deliberate choices about scope during the first 12 months. The evidence supports starting with high-risk AI use cases and all vendor-provided AI tools, then expanding governance coverage over time. Trying to govern every algorithm touching a clinical workflow simultaneously is the path to a governance program that exists in policy documents but not in practice.

Common Mistakes When Building Governance From Scratch

·Creating a new standalone AI governance committee rather than embedding review functions into existing clinical quality and IT governance forums
·Attempting to implement the full CHAI Blueprint in year one before the organization has the infrastructure or expertise to support it
·Deploying AI tools while governance is still being designed, creating a retrospective compliance problem
·Treating governance as a compliance project owned by legal rather than a clinical quality initiative owned by clinical leadership
·Failing to build a vendor AI tool inventory before writing governance policy — you can't govern what you haven't documented

Three Factors That Appear in Every Successful Implementation

Across the available evidence, including the Duke/Trillium case study, the AMA toolkit development work, and the CHAI implementation guidance, three factors appear consistently in organizations that successfully build functional AI governance. None of them are technical.

An executive champion with visible authority

Governance committees without executive sponsorship stall. The champion doesn't need to be a technical expert — the CIO or CMO role is more about organizational authority and board visibility than AI fluency. What matters is that someone at the executive level has specifically accepted accountability for AI governance outcomes, not just nominal oversight of a committee.

Interdisciplinary committee structure that includes clinical voices

Governance dominated by IT and compliance departments tends to produce policies that clinicians don't follow and can't explain. Every successful implementation included clinical representation — physicians, nurses, and pharmacists as appropriate — in the governance structure from the start. Clinicians who participate in governance design are more likely to operate within governance expectations and more likely to surface problems early.

External expertise to fill AI knowledge gaps

Most mid-size hospitals don't have staff with deep AI governance expertise on payroll. The Duke/Trillium case study involved external partnership specifically to fill that gap. Organizations that try to build governance entirely from internal resources while simultaneously learning the field tend to either move very slowly or build frameworks that miss critical elements. Bringing in external advisors who have done this before compresses the timeline and improves the result.

A Practical First-Year Roadmap

What this looks like in practice for a hospital starting from scratch in 2026 is roughly a three-phase first year, organized around the AMA toolkit and PPTO model.

Foundation

Name an executive champion. Convene a multidisciplinary working group with clinical, legal, IT, and quality representation. Conduct a vendor AI tool inventory to document every AI tool currently in use or under active procurement evaluation. Complete a gap analysis against both the AMA toolkit and the CHAI Blueprint to understand where you are.

Policy and Process Design

Draft AI-specific governance policies covering tool registration, vendor evaluation criteria, clinical validation requirements, and monitoring expectations. Define the intake process for new AI tools. Embed AI review into at least one existing governance forum. Review all active vendor contracts for missing AI provisions.

Operationalization

Launch the intake process for new tools. Begin reviewing high-risk AI tools currently in use against the new validation criteria. Train clinical staff on the tools they use and on how to surface concerns. Establish a monitoring cadence for deployed AI tools.

Review and Expansion

Conduct a first-year governance review. Assess coverage gaps and update the roadmap for year two. Consider whether to expand governance scope to medium-risk AI tools. Brief the board on the governance program, current AI risk posture, and the year-two plan.

Frequently Asked Questions

Common questions healthcare executives ask when starting an AI governance program.

Can a mid-size hospital realistically implement CHAI Blueprint requirements?

Not immediately, and attempting to do so in the first year is likely counterproductive. The CHAI Blueprint is the most thorough governance reference in healthcare, but its requirements, including rigorous bias audits for every AI tool, assume organizational infrastructure and expertise that most community hospitals don't have at the start of a governance program. The evidence supports using CHAI as a long-horizon reference and gap analysis tool rather than a first-year compliance target. The Joint Commission's co-branding of CHAI guidance in September 2025 signals that alignment with CHAI principles is increasingly expected, but the path to that alignment can be iterative. Starting with the AMA's 8-step toolkit and building toward CHAI alignment over 24 to 36 months is a more realistic and defensible approach.

Does the Joint Commission now require AI governance?

The Joint Commission has not issued formal AI governance accreditation requirements in the sense of specific standards with defined compliance thresholds. What TJC did in September 2025 was co-brand guidance aligned with the CHAI Blueprint, signaling to surveyors and accredited organizations where expectations are trending. The practical implication is that organizations with no visible AI governance structure are increasingly likely to receive observations or recommendations during surveys. The more useful framing than 'is it required' is whether your governance posture can survive a surveyor asking about it. If you can describe a structured approach with executive accountability, a documented inventory, and defined oversight processes, you're in a defensible position. If AI governance hasn't been addressed at all, that's a vulnerability regardless of formal requirement status.

Should we create a new AI governance committee or embed AI oversight in existing committees?

The evidence favors embedding rather than creating new structures, particularly at the start. Creating a standalone AI governance committee is organizationally costly, requires a new meeting cadence and committee membership, and often produces governance that sits parallel to rather than integrated with existing clinical quality and IT governance processes. The Duke/Trillium case study embedded AI oversight into existing operational forums, which reduced overhead and improved integration with the decision-making processes that actually govern tool deployment. The AMA toolkit and CHAI guidance both explicitly support this approach. As governance matures and AI use expands, a dedicated AI governance committee may become warranted. But starting there adds complexity without proportionate benefit.

What should our first governance policy cover?

Start with vendor AI tool intake and registration. Every new AI tool that touches clinical workflows or patient data should go through a defined review process before deployment. This single policy addresses the most common governance gap, creates the foundation for everything else, and is achievable without extensive infrastructure. The intake process doesn't need to be complex. It needs to capture what the tool does, what clinical risk category it falls into, what validation the vendor has provided, what local validation is needed, and who approved deployment. Having that process documented and operating is the foundation on which every subsequent governance element builds.

How do we build an AI tool inventory when we don't know everything we have?

Start with the tools you know about: vendor-provided AI tools under active contract, any AI capabilities embedded in your EHR that are turned on, and any tools purchased or piloted by individual departments. The inventory almost always reveals tools that governance wasn't aware of. Useful starting points include IT asset inventory reviews, vendor contract reviews, and direct outreach to department heads asking whether their teams are using AI tools. The goal of the first inventory isn't completeness. It's coverage of the highest-risk tools and creation of a register that can be maintained and expanded over time. CHAI's guidance on AI inventory and the AMA toolkit both describe this as a foundational governance step.

What does an AI governance program actually cost a mid-size hospital?

The research notes that AI governance is resource-intensive, and organizations that underestimate the effort tend to build frameworks that don't get operationalized. In the first year, the primary costs are staff time — which is substantial across a multidisciplinary working group — and any external advisory or consulting support used to accelerate framework development. Technology costs for governance tooling are typically modest at the start. Organizations that have embedded governance into existing committees report lower ongoing operational costs than those that created standalone governance structures. Organizations that have built governance with external partners consistently report that the investment compresses the timeline compared to building entirely from internal resources, typically by a year or more.

Sources

American Medical Association. "AI Governance Toolkit for Health Systems." August 2025.
Coalition for Health AI (CHAI). "Blueprint for Trustworthy AI Implementation Guidance and Assurance for Healthcare." 2023, updated 2025.
The Joint Commission. AI Governance Guidance aligned with CHAI Blueprint. September 2025.
Duke University Health System and Trillium Health Partners. "People-Process-Technology-Operations (PPTO) AI Governance Implementation Case Study." 2024.
NIST AI Risk Management Framework (AI RMF 1.0). National Institute of Standards and Technology. January 2023.
American Hospital Association. "Trustworthy AI in Health Care: A Framework for AI Governance." 2024.
CHIME AI Governance Principles. College of Healthcare Information Management Executives. 2024.

What AI Governance Framework Should a Mid-Size Hospital Adopt If We Are Starting From Scratch?