For hospitals and health systems in the United States, the most detailed public blueprint for organizing AI oversight is the Joint Commission and Coalition for Health AI (CHAI) guidance of September 17, 2025. It asks for a formal governance structure with a designated AI lead, cross-functional membership, and regular reports to the governing board, and it says that structure does not need to be a standalone team. The guidance is voluntary and does not validate any AI product.
Key takeaways
- The guidance lists seven elements, and the first is AI policies and governance structures, covering clinical, administrative, and operational AI tools.
- Governance is described as a function that can sit inside existing quality, safety, and compliance structures, led by a designated individual with technology expertise.
- Monitoring effort is scaled to risk: tools close to patient care decisions are checked more often than documentation helpers.
- A voluntary Joint Commission certification, with a review process guide issued June 1, 2026, turned the guidance into an audit-style review.
- The certification assesses an organization's governance and policies, and Joint Commission makes no claim about its effect on quality of care.
What the 2025 guidance asks an organization to build
The Joint Commission, which accredits hospitals in the United States, published the guidance with CHAI after a September 2024 meeting with industry groups and a survey of its accredited organizations. It reviewed existing frameworks, including the NIST AI Risk Management Framework and the National Academy of Medicine's AI Code of Conduct principles. The document describes itself as initial and high-level, and it applies to tools used in direct patient care, care support such as scheduling and documentation, and operations such as coding and prior authorization.
The first element reads as an organizational chart in words. A formal governance structure should oversee risk-based use of health AI, include a designated person with appropriate technology expertise, and keep the board informed of uses, outcomes, and potential adverse events. The guidance document is published as a PDF by the Joint Commission.
Who sits at the table
The guidance suggests a team that could include executive leadership, regulatory and ethics compliance, information technology, safety and incident reporting, relevant clinical or operational experts, cybersecurity and privacy staff, and representatives of affected populations such as patients, caregivers, and staff. Its stated purpose is to write policies for reviewing and using AI tools, ethical standards, safety protocols, data use rules, and equitable access, and to align those policies with other internal policies and outside regulations.
Governance also covers the full life of a tool: selection, implementation, risk management, lifecycle management, compliance, and oversight, for both third-party and internally built software. The guidance says plainly that this does not need to be its own standalone team.
The seven elements and the question each answers
| Element | Question it answers |
|---|---|
| AI policies and governance structures | Who decides what is used, and who reports to the board? |
| Patient privacy and transparency | Are patients told when AI affects their care? |
| Data security and data use protections | What may vendors do with patient data? |
| Ongoing quality monitoring | Does the tool still work as it did at purchase? |
| Voluntary, blinded reporting of AI safety events | Where do near misses and harms go? |
| Risk and bias assessment | For which patients was the tool tested? |
| Education and training | Do users know the tool's limits? |
Monitoring scaled to risk
The monitoring element explains why oversight cannot end at purchase. Models can change when vendors update them, and input data can drift. The guidance suggests asking how close a tool is to patient care decisions and what could go wrong if it performs poorly. Tools that inform or drive clinical decisions should be checked more often, and tools that help with administrative or documentation tasks can be checked periodically. It also advises reusing quality, patient safety, and compliance structures rather than building new ones.
Event reporting follows the same logic. AI-related near misses, such as an unsafe recommendation or a large performance drop after an update, should be handled like patient safety events and, where appropriate, submitted in de-identified form through a patient safety organization or other existing channels.
From guidance to certification
The guidance said a voluntary certification would follow. The Joint Commission's review process guide, issued June 1, 2026, describes how it works. The review opens with a 60-minute governance session in which program leaders describe their reporting structure, whether expertise is internal or external, and how clinical, operational, compliance, and information technology views are represented. Reviewers then trace individual tools, including a high-risk clinical tool and a third-party vendor tool.
The guide carries a disclaimer: the certification assesses an organization's commitment to responsible use through governance and policies, the organization remains responsible for following applicable laws, and the Joint Commission makes no representation about the effect on quality of care. No outcome data on certified organizations were located for this article.
Limits of this model
- The framework is U.S.-focused. It refers to HIPAA, the Food and Drug Administration, and U.S. patient safety organizations, so Canadian organizations would map the ideas onto provincial privacy law and Health Canada device rules.
- It is voluntary, so it describes good practice and does not establish a legal duty.
- It governs how organizations deploy tools, not whether a given tool is accurate.
- No peer-reviewed comparison of governance structures and patient outcomes was found.
This article describes organizational guidance and is not medical, legal, or compliance advice for any institution or patient.
FAQ
Does a hospital need a separate AI committee?
The guidance says no. The structure can be part of existing teams as long as it has defined responsibility, a designated lead with technology expertise, and a channel to the governing board.
Is the Joint Commission guidance a law?
No. It is voluntary guidance, and the certification built on it is voluntary as well. Laws such as HIPAA and FDA rules apply independently.
Does certification prove an AI tool is safe?
No. The guidance states that it is not intended to validate the effectiveness of AI tools, and the certification review assesses governance and policies. Individual tools still need their own evidence.
Which AI tools does the guidance cover?
It defines health AI broadly: clinical, administrative, and operational tools that use predictive or generative methods, from decision support and imaging to documentation, scheduling, coding, and prior authorization.
Related reading
- Fairness of AI in health care
- Components an AI system depends on
- AI and sustainability
- The role of vectors in AI
More in AI in health.
Last verified: October 2026
Sources
- Joint Commission and Coalition for Health AI Guidance on the Responsible Use of AI in Healthcare (RUAIH), Joint Commission, 2025
- Joint Commission and CHAI release initial guidance to support responsible AI adoption across U.S. health systems, Coalition for Health AI, September 17, 2025
- Responsible Use of Artificial Intelligence in Health Care Certification Review Process Guide, Joint Commission, issued June 1, 2026