How to Write an AI Governance Policy for Your Healthcare Organisation

Author: Eunoia Consulting Co. | Published: July 14, 2026

Most healthcare organisations know they need an AI governance policy. Far fewer have one that is specific enough to be actionable, comprehensive enough to cover real risks, and flexible enough to accommodate the pace of AI development. This guide provides a practical framework for writing a policy that works.

The Policy Gap in Healthcare AI Governance

In our work with healthcare organisations across the United States, United Kingdom, and Australia, we consistently encounter the same pattern: organisations that have deployed AI tools — sometimes dozens of them — without a coherent governance policy in place. When we ask about their AI governance framework, we typically receive one of three responses.

The first is a technology policy that was written for software generally and has been loosely extended to cover AI. It addresses procurement and security but says nothing about clinical validation, bias monitoring, or the specific risks of algorithmic decision-making in healthcare.

The second is a high-level statement of principles — a commitment to responsible AI, transparency, and patient safety — that provides no practical guidance for the people making day-to-day decisions about AI deployment.

The third, and most concerning, is nothing at all.

This is not a criticism of the organisations involved. AI governance policy is genuinely difficult to write well. The technology is evolving rapidly, the regulatory landscape is fragmented and changing, and the range of AI applications in healthcare — from administrative automation to clinical decision support to diagnostic imaging — is so broad that a single policy must be flexible enough to accommodate very different risk profiles.

But the absence of a governance policy is not a neutral position. It means that AI deployment decisions are being made ad hoc, without consistent standards, without clear accountability, and without the documentation that regulators and auditors will increasingly require.

What an AI Governance Policy Must Cover

A comprehensive AI governance policy for a healthcare organisation should address the following domains:

1. Scope and Definitions

The policy should define what it covers. In 2026, this is more complex than it sounds. The policy should specify:

• What counts as AI for the purposes of the policy (machine learning models, rule-based algorithms, generative AI, AI-powered software as a medical device)
• Which AI applications are in scope (clinical decision support, administrative automation, patient-facing tools, research applications)
• Which are out of scope (standard software with no AI components, research conducted under separate ethics approval)

A clear scope prevents the policy from being applied inconsistently and ensures that genuinely high-risk AI applications are not excluded by definitional ambiguity.

2. Risk Classification

Not all AI applications carry the same risk. A tiered risk classification system allows the policy to apply proportionate governance without creating unnecessary bureaucracy for low-risk applications.

A practical three-tier system for healthcare:

| Tier | Description | Examples | Governance Requirements | |---|---|---|---| | Tier 1: High Risk | AI that directly influences clinical decisions or patient safety | Diagnostic decision support, medication dosing, sepsis prediction | Full clinical validation, ethics review, senior clinical sign-off, ongoing monitoring | | Tier 2: Medium Risk | AI that influences operational decisions or administrative processes | Scheduling optimisation, coding assistance, patient communication | IT security review, operational validation, departmental sign-off | | Tier 3: Low Risk | AI used for internal productivity or research | Document summarisation, meeting transcription, literature review | Standard procurement process, data privacy review |

3. Procurement and Approval

The policy should define the process for approving new AI applications before they are deployed. This process should include:

• A standardised AI assessment questionnaire that captures the vendor's validation evidence, data practices, regulatory status, and bias testing results
• A defined approval pathway that routes applications to the appropriate review bodies based on their risk tier
• A requirement for a named clinical owner for any Tier 1 or Tier 2 application
• A contractual checklist that ensures AI-specific provisions are included in vendor agreements (performance warranties, audit rights, incident notification requirements)

4. Deployment and Monitoring

Approval is not the end of governance — it is the beginning. The policy should specify:

• What monitoring is required for each risk tier (automated performance dashboards, periodic clinical review, incident reporting)
• Who is responsible for monitoring and with what frequency
• What performance thresholds trigger a review or suspension of the application
• How incidents involving AI (unexpected outputs, performance degradation, patient safety events) are reported and investigated

5. Decommissioning

AI applications that are no longer fit for purpose, that have been superseded by better tools, or that have failed their monitoring requirements must be decommissioned in an orderly way. The policy should specify the process for:

• Deciding when an AI application should be decommissioned
• Communicating the decommissioning to affected staff and patients
• Ensuring that data generated by the application is retained or deleted in accordance with data governance requirements
• Documenting the decommissioning decision and rationale

6. Roles and Responsibilities

The policy should clearly define who is responsible for what. Typical roles in a healthcare AI governance framework include:

• AI Governance Committee: cross-functional body responsible for policy oversight, Tier 1 approvals, and escalated issues
• Clinical AI Owner: named clinician responsible for the clinical validity and ongoing monitoring of a specific AI application
• Chief Information Officer / Chief Digital Officer: responsible for technical standards, security, and vendor management
• Data Protection Officer: responsible for privacy compliance and data governance alignment
• Chief Medical Officer / Clinical Director: responsible for clinical safety sign-off on Tier 1 applications

Writing the Policy: Practical Guidance

The most common failure mode in AI governance policy writing is excessive generality. A policy that commits to 'responsible AI' and 'patient-centred design' without specifying what those commitments require in practice is not a governance document — it is a statement of intent.

Effective policy language is specific, actionable, and testable. Compare these two formulations:

Weak: 'The organisation will ensure that AI systems are regularly monitored to maintain performance standards.'

Strong: 'All Tier 1 AI applications must have an automated performance dashboard reviewed by the Clinical AI Owner on a monthly basis. If a key performance metric falls below the threshold defined in the application's validation plan, the Clinical AI Owner must notify the AI Governance Committee within 5 business days and initiate a formal performance review.'

The strong formulation tells a specific person what to do, when to do it, and what happens if a threshold is breached. It can be audited. The weak formulation cannot.

Keeping the Policy Current

An AI governance policy that is not regularly reviewed becomes an obstacle. As new AI applications are deployed, as the regulatory landscape evolves, and as your organisation's experience with AI governance matures, the policy must be updated to reflect current reality.

We recommend a formal annual review of the policy, with a lightweight quarterly check to identify any urgent updates required by regulatory changes or significant incidents. The review process should involve the same stakeholders who approved the original policy.

Conclusion

Writing an effective AI governance policy requires balancing specificity with flexibility, comprehensiveness with usability, and rigour with pragmatism. It is not a one-time exercise — it is an ongoing commitment to governing AI in a way that protects patients, supports staff, and satisfies regulators.

Eunoia Consulting Co. has helped healthcare organisations across multiple jurisdictions develop AI governance policies that are practical, compliant, and built to last. Contact us to discuss your governance policy needs.