AI Governance Framework for Mid-Size Hospitals Starting From Scratch

Key Takeaways

·Most mid-size hospitals already have AI to govern. In federal data for 2024, 80% of hospitals with 100 to 399 beds used predictive AI integrated with their EHR.
·The AMA's toolkit, Governance for Augmented Intelligence (2025), lays out eight steps in order, starting with executive accountability. It is the most direct answer to "where do we start?"
·The Joint Commission and CHAI guidance on the responsible use of AI (September 2025) is voluntary, names seven elements, and says it is meant for "healthcare organizations of all sizes."
·CHAI's AI Governance Playbooks (May 2026) are the most detailed of the three. They are voluntary, and CHAI says "implementation will differ based on organizational goals, resources, and maturity."
·Both the guidance and the playbooks describe risk-based oversight. For a hospital with limited staff, that points to governing the highest-risk tools first.
·None of the three requires a new standalone committee. The AMA describes two routes, and the Joint Commission and CHAI guidance says the governance structure "does not need to be its own standalone team."

The short answer

Use the AMA's eight steps as your sequence. Check your work against the seven elements in the Joint Commission and CHAI guidance. Turn to CHAI's playbooks when you need detail on a specific control. Our suggestions for a mid-size hospital: name one accountable executive, build an inventory of the AI you already use, put every new AI tool through one intake process, and run governance through a committee you already have. Start with your highest-risk tools and widen the scope as the program matures.

Most Mid-Size Hospitals Already Have AI to Govern

Starting from scratch on governance rarely means starting from scratch on AI. The federal ONC data brief on hospital use of predictive AI reports that 71% of hospitals used predictive AI integrated with the EHR in 2024, up from 66% in 2023. For hospitals with 100 to 399 beds the figure was 80%. Small hospitals (59%), independent hospitals (37%) and critical access hospitals (50%) were lower, and system-affiliated hospitals were higher (86%).

The same brief asked who is accountable for evaluating these models. A specific committee or task force (66%) and division or department leaders (60%) were the most common answers. So the first job is often to find and connect the oversight that already exists, and only then to design what's missing.

Three Published Sources, Three Different Jobs

These documents were written by different groups for different purposes. Used together, each covers what the others leave out.

The AMA toolkit: the order of work

The AMA STEPS Forward toolkit, Governance for Augmented Intelligence, was developed with Manatt Health and published in 2025. It lays out eight steps for a health system establishing AI governance, with options at each step. It's the closest thing to a project plan of the three.

The Joint Commission and CHAI guidance: what responsible use includes

On September 17, 2025 the Joint Commission and the Coalition for Health AI released guidance on The Responsible Use of AI in Healthcare (RUAIH). It is voluntary and names seven elements: AI Policies and Governance Structures; Patient Privacy and Transparency; Data Security and Data Use Protections; Ongoing Quality Monitoring; Voluntary, Blinded Reporting of AI Safety-Related Events; Risk and Bias Assessment; and Education and Training. It says it aims to equip "healthcare organizations of all sizes."

CHAI's governance playbooks: the detail

CHAI released its AI Governance Playbooks on May 27, 2026. They are organized into four domains (AI Policy, Organizational Structures, Organizational Resources and Organizational Processes) with five subdomains under Organizational Processes, and CHAI says they are "designed for healthcare delivery leaders from organizations of all sizes." CHAI also describes them as "a voluntary, aspirational, and educational resource," not a standard of care.

Two other documents come up often. The NIST AI Risk Management Framework (January 2023) is organized around four functions, Govern, Map, Measure and Manage. It applies across industries, so it takes some translation for a hospital. CHAI's Blueprint for Trustworthy AI (version 1.0, April 2023) is an earlier consensus paper on principles of trustworthy AI. It's useful background, and for day-to-day governance work the playbooks are the more practical CHAI reference.

The AMA's Eight Steps

The step names below are the AMA's. The notes under each draw on the toolkit and the other sources where they say something specific, and we mark our own suggestions as ours.

Establish Executive Accountability and a Governance Structure

The AMA starts with CEO and board commitment and says "a CEO may consider designating one or more C-suite executives to take responsibility for AI." The Joint Commission and CHAI guidance adds that "the fiduciary board of the healthcare organization should be regularly updated on AI use and its outcomes." Our suggestion: make sure one named person has the authority to pause a tool when a safety concern comes up.

Form a Working Group to Detail Priorities, Processes, and Policies

The AMA suggests "an interdisciplinary AI working group to help define priorities, develop policies, and detail governance processes." We suggest clinical leadership, quality and patient safety, IT, legal and compliance, and at least one frontline clinician.

Assess the Current State and Establish Priorities

This is where the inventory starts. The AMA suggests the group "request each department head to inventory AI tools, including AI features used through enterprise technology." CHAI's playbooks call the AI inventory "the foundational operational tool for AI governance."

Develop AI Policies

The AMA's list of policy topics includes informed consent ("any required patient consent and notification") and central inventory management for AI tools. Our suggestion: the first policy doesn't need to cover everything. It needs to cover your highest-risk uses and say how new tools get approved.

Define Project Intake, Vendor Evaluation, and Assessment Processes

Our suggestion: one intake path for every new AI tool, including AI features that arrive inside software you already license. It should capture what the tool does, its risk level, what validation the vendor provided, what local checking is needed and who approved it.

Update Standard Planning and Implementation Processes

Fold AI review into the planning and go-live processes the hospital already runs. Our suggestion: staff should know when AI is part of their workflow and what to do when they disagree with it.

Establish an Oversight and Monitoring Process

Ongoing Quality Monitoring is one of the seven elements in the Joint Commission and CHAI guidance. A tool's performance can change after go-live, for example when a vendor updates the model or the patient population shifts. Decide who reviews what, how often, and what triggers a pause.

Support AI Organizational Readiness

Education and Training is also one of the seven elements. Staff who use AI need to know what a tool does and doesn't do, and how to raise a concern.

Start With Your Highest-Risk Tools

The published sources agree that oversight should scale with risk. The Joint Commission and CHAI guidance calls for "risk-based and organizationally appropriate oversight of health AI tools." CHAI's playbooks say organizations "should adopt a risk-based framework across all of the controls, with higher-risk AI solutions requiring more in depth processes," and lower-risk tools following simpler ones.

For a mid-size hospital, our suggestion is to apply the full process first to tools that influence diagnosis, treatment or other high-impact decisions, and a lighter process to administrative tools. Widen the scope once the first round is working. CHAI also notes that many of its controls "may not require entirely new processes, but rather the adaptation or expansion of existing structures already in place."

A New Committee, or One You Already Have?

Either can work. The AMA says health systems vary "depending on the system's structure, size, and current state of governance," and describes two approaches: incorporating AI into existing technology governance, or establishing a new AI governance group. The Joint Commission and CHAI guidance says the governance structure "does not need to be its own standalone team." CHAI's playbooks describe an AI governance committee that "may be a dedicated committee, a subgroup of an existing governance body (e.g., Data Governance Council), or a distributed structure of named individuals."

Our suggestion for most mid-size hospitals is to start inside a committee that already meets and already has the right people, often digital health, clinical informatics or quality. A dedicated group can come later if the workload calls for it.

What One Published Case Study Shows

A 2025 case study in npj Digital Medicine, by researchers from the Duke Institute for Health Innovation and Trillium Health Partners in Ontario, describes building AI governance at "one of the largest university-affiliated community health hospital systems in Canada." The hospital system was early in AI adoption and had no formal governance structure for AI. The team used the People, Process, Technology, and Operations (PPTO) framework.

The work had two stages. Stakeholder interviews with technical, operational and clinical staff identified strengths, gaps and priorities. Then co-design workshops with five senior leaders from the existing digital health committee adapted the framework to the organization. The result was new policies and an AI governance committee. Participants agreed it "should be a subcommittee reporting up to" the digital health committee, rather than a newly formed, separate body.

This is one organization, in Canada, and much larger than a typical 200-bed US hospital, so treat it as an illustration rather than a template. It does show the pattern described above in practice: a governance group built inside an existing reporting line, shaped by interviews with the people who use the tools.

Expect It to Take Real Staff Time

A Duke-Margolis white paper (October 2024) convened six US health systems with established AI governance. The authors write: "We heard from all the health systems that this is a resource-intensive task, and more technical expertise, training, and tools are needed." For a mid-size hospital, most of the first-year cost is the time of the people on the working group. Plan for it the way you would for any other quality program.

Where the Joint Commission Fits

The Joint Commission and CHAI guidance is voluntary and isn't part of accreditation. On June 1, 2026 the Joint Commission launched a voluntary Responsible Use of AI in Healthcare certification built on it, and organizations don't need to be accredited to apply. We haven't found a Joint Commission accreditation standard specific to AI.

A more practical test than any external review is whether you could describe your program clearly to your own board: who is accountable, what AI is in use, and how it is overseen.

A First-Year Sequence

This is our suggestion, built on the AMA's steps. Treat the timing as a starting point. A hospital with fewer AI tools may move faster, and one with many may need longer.

Foundation (AMA steps 1 to 3)

Name the accountable executive. Decide which existing committee will carry AI governance, and add the members it's missing. Build a first inventory of the AI tools in use or under evaluation, including AI features inside the EHR and other enterprise software.

Policy and intake (AMA steps 4 and 5)

Write a first AI policy covering approval of new tools, risk levels and patient notification where required. Stand up the intake process. Review active contracts for the tools on your inventory to see what vendors have committed to disclose and support.

Put it to work (AMA steps 6 to 8)

Run new tools through intake. Review your highest-risk tools already in use. Set a monitoring rhythm for each one, and train the staff who use them on what the tools do and how to raise a concern.

Review and widen

Look back at the year, check your program against the seven elements in the Joint Commission and CHAI guidance, and decide what to add. Brief the board on what's in use, how it's overseen and the plan for year two.

Frequently Asked Questions

Common questions healthcare executives ask when starting an AI governance program.

Which AI governance framework should a mid-size hospital adopt?

We'd use three published sources together rather than adopting one. The AMA's toolkit, Governance for Augmented Intelligence, gives an eight-step sequence. The Joint Commission and CHAI guidance (September 2025) names seven elements of responsible use. CHAI's AI Governance Playbooks (May 2026) give detailed controls to grow into. All three are voluntary, and the guidance and the playbooks both say they are meant for organizations of all sizes.

Can a mid-size hospital realistically use CHAI's governance playbooks?

Yes, a piece at a time. CHAI says "it is assumed and appropriate that implementation will differ based on organizational goals, resources, and maturity," and that higher-risk tools warrant deeper processes than lower-risk ones. CHAI also describes the playbooks as voluntary and not a standard of care. A mid-size hospital can use them internally to see which controls it already has and which to add next.

Does the Joint Commission now require AI governance?

We haven't found a Joint Commission accreditation standard specific to AI. In September 2025 the Joint Commission and CHAI released voluntary guidance on the responsible use of AI in healthcare, and on June 1, 2026 the Joint Commission launched a voluntary certification built on it. Neither is part of accreditation, and organizations don't need to be accredited to apply for the certification. For a definitive answer about your own accreditation program, ask your Joint Commission account executive.

Should we create a new AI governance committee or use an existing one?

Either can work. The AMA describes both routes and says the choice depends on the system's structure, size and current state of governance. The Joint Commission and CHAI guidance says the governance structure "does not need to be its own standalone team," and CHAI's playbooks allow a dedicated committee, a subgroup of an existing body or a set of named individuals. For most mid-size hospitals we suggest starting inside a committee that already meets. In the published Duke and Trillium case study, the new AI governance committee was set up as a subcommittee of the existing digital health committee.

What should our first governance policy cover?

Our suggestion is to start with how new AI tools get approved. A single intake process captures what each tool does, its risk level, what validation the vendor provided, what local checking is needed and who signed off. The AMA's list of policy topics also includes patient consent and notification where required, and central inventory management.

How do we build an AI tool inventory when we don't know everything we have?

Start with what you can find: AI tools under contract, AI features turned on inside the EHR and other enterprise software, and tools departments bought or are piloting. The AMA suggests asking each department head to list their AI tools. CHAI's playbooks use the term shadow AI for tools used without going through the organization's intake and approval, so expect the first inventory to surface some. The goal of the first pass is a maintained register that covers the highest-risk tools.

What does an AI governance program cost a mid-size hospital?

We haven't found published cost figures for mid-size hospitals. The Duke-Margolis white paper reports that all six health systems it convened described AI governance as a resource-intensive task. In the first year, most of the cost is staff time on the working group, plus any outside support you choose to use.

Sources

Lozovatsky M, Thomas M. Governance for Augmented Intelligence: Establish a Governance Framework to Implement, Manage, and Scale AI Solutions. AMA STEPS Forward, developed in collaboration with Manatt Health. American Medical Association, 2025.
The Joint Commission and the Coalition for Health AI. Guidance on The Responsible Use of AI in Healthcare (RUAIH). September 17, 2025. (PDF)
The Joint Commission. Responsible Use of AI in Healthcare certification (program page). Accessed September 20, 2026.
Coalition for Health AI. AI Governance Playbooks: Introduction and Background; Domains 1 to 3; Subdomains 4.1 to 4.5. Released May 27, 2026.
Kim JY, Hasan A, Kueper J, Tang T, Hayes C, Fine B, Balu S, Sendak M. Establishing organizational AI governance in healthcare: a case study in Canada. npj Digital Medicine. 2025;8:522. August 15, 2025.
Parker VJ, Silcox C, et al. AI Governance in Health Systems: Aligning Innovation, Accountability, and Trust. Duke-Margolis Institute for Health Policy white paper. October 28, 2024.
ONC. Hospital Trends in the Use, Evaluation, and Governance of Predictive AI, 2023-2024. Data Brief No. 80. September 2025.
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. January 2023.
Coalition for Health AI. Blueprint for Trustworthy AI Implementation Guidance and Assurance for Healthcare. Version 1.0, April 4, 2023.

What AI Governance Framework Should a Mid-Size Hospital Adopt If We Are Starting From Scratch?