A sixty-second audit for health system leaders

An institution without a documented route from a clinical near-miss to the governance committee does not have governance. It has a charter and a meeting schedule.

The route is what makes the difference.

Most health systems have signed the charter. Few have built the operating architecture the charter assumes exists. If you lead a hospital, a health system, or a governance committee — this audit is for you. It takes sixty seconds. It only works if you answer honestly.

Mark no where no is true. That answer is what you bring to your next governance meeting.

Part One — The Three Absences

Ninety days into its first AI-governance term, a regional health system decided to audit itself before its next committee meeting. What they found — in sequence — were three gaps their charter had never addressed.

You will recognize them.

1. The Inventory. The system had no complete list of every AI-enabled tool in active use — not legacy systems, not vendor-deployed tools, not the shadow AI clinicians had quietly adopted on their own. When the committee asked how many tools were running, no one could answer.

The question for your institution: Do you have a complete inventory of every AI-enabled tool in operational use — legacy, vendor, and shadow?

If you cannot enumerate the tools, you are not governing them. You are governing a population you cannot name.

2. Pause Authority. When the same system asked who had authority to halt a tool whose performance had degraded, the answer was a committee — which met quarterly. There was no named individual with documented authority to act between meetings.

The question for your institution: Is there a named person who can halt a failing AI tool today — not at the next meeting?

If the answer is no, the tool runs until it fails loudly enough to be noticed.

3. The Incident Route. When the system traced what happened after a clinician flagged an algorithmic error, they found the observation had stopped at the department head. It had never reached the governance committee. There was no documented pathway requiring it to.

The question for your institution: If a clinician sees that an algorithm is wrong about a patient — where does that observation go?

If the answer is not to the governance committee, within a fixed window — the near-miss stops at clinical leadership. That is where harm finds its entry point. Through a channel far more expensive than the route a focused ninety days could have built.

One no is enough. The diagnosis is not a rebuke. It is the chapter's own: you have a charter and a meeting cadence. Not yet governance.

Part Two — The Three Workstreams

Governance doesn't fail all at once. It fails in a pattern.

People, process, and technology have to move together — or none of them moves. Pull one out and the failure mode is predictable:

• People without process is enthusiasm without infrastructure. The right people in the room, no mechanism to act.
• Process without technology is procedure without an inventory to govern. A documented route to a tool no one has catalogued.
• Technology without people is deployment without judgment. The tool runs. No one is watching it.

Which of the three is weakest in your institution today? That answer — not the tools you own — tells you where your safety-switch authority is most exposed.Part Three — The Four Assets Real Governance Requires

Based on implementation evidence across health systems building AI governance from the ground up, four assets separate institutions that are governing from institutions that are performing governance.

Check the ones your institution actually has:

• Incident-learning infrastructure — a documented route from clinical near-miss to governance committee, with a fixed response window. Not a suggestion. A route.
• Readiness, diagnosed rather than assumed. An institution that approves a charter without first assessing its own readiness has built a structure the organization may not yet be equipped to support. The audit comes before the charter. Not after.
• Continuous improvement capability — engaged leadership, external training, structured improvement processes, and clinical teams operating with autonomy, accountability, and genuine psychological safety to report what they see.
• Technology implementation clarity — a living inventory of the enablers and barriers specific to your setting, so the governance roadmap can actually be executed rather than aspirationally described.

If you checked fewer than three, the charter is ahead of the infrastructure.

The Reveal

Capacity is built. Not declared.

The first ninety days of AI governance are the work of converting a signed charter into an operating one — building the incident route, assigning pause authority, mapping the inventory. The institution that skips this work does not discover the gap through foresight. It discovers it through the deployments that didn't land, and through the clinical record that cannot defend itself.

This audit is that work, compressed to a page.

The full framework — the Sentinel Operations Charter, the four implementation pathways, the 30/90/180-day maturity trajectory — is inside The Healthcare AI Governance Playbook. It was built for exactly the institution this audit describes: one that has signed the charter and now needs to build what the charter assumed.

Get the complete framework → The Healthcare AI Governance Playbook.