CHAI & The Joint Commission's RUAIH: What Your Governance Committee Must Do Before the Audit
The governance vacuum is closing, from the outside in.
For years, health systems governed AI however they saw fit. There was no accrediting-body standard, no national floor. A committee could write a policy—or not. Deploy a model—or not. Whether any of it actually protected patients was left entirely unanchored.
That changed in mid-2025. The Joint Commission and the Coalition for Health AI (CHAI) partnered to build the first national accreditation framework for responsible AI use—reaching more than 80% of U.S. healthcare organizations. On September 17, 2025, they released their foundational guidance: Responsible Use of AI in Healthcare (RUAIH), setting the stage for a formal certification program.
The framework does not demand operational brilliance; it demands seven baseline elements, in writing:
- Formal AI policies and governance structures
- Patient privacy and transparency protections
- Data security and data-use safeguards
- Ongoing quality and output monitoring
- Voluntary, blinded reporting of AI safety events
- Systematic risk and bias assessments
- Role-specific workforce education and training
None of this is exotic to anyone familiar with health system governance. That is precisely the point. The framework does not demand groundbreaking innovation—it demands that the basics exist and that institutions can show their work. While voluntary today, accreditation guidance invariably becomes tomorrow’s non-negotiable floor.
Compliance Is Not Sovereignty
Conforming to the framework proves to an auditor that your institution meets a floor. It does not tell your clinicians or patients whether algorithms are augmenting human expertise or quietly usurping it.
Compliance answers: "Are we following the rules?"
Real governance answers: "Who holds authority over the clinical decision?"
A hospital can clear the accreditation bar while running a culture of passive algorithmic compliance—where clinician overrides are treated as performance variance and care teams learn to suppress their own judgment. True accountability is not the same as software adoption, nor is it settled by a certificate on the wall.
The Three Operational Absences
Before the auditor arrives, test for the three operational gaps where governance quietly fails in practice:
1. The Inventory: Do you maintain a living inventory of every AI-enabled tool in operational use—vendor products, legacy software features, and shadow AI alike? If you cannot name the tools, you cannot govern them.
2. Pause Authority: Is there a named individual with explicit, documented authority to halt an AI tool when performance degrades? If no one holds the explicit power to pull the kill switch, the algorithm will run until it fails publicly.
3. The Escalation Route: When a clinician observes that an algorithm is wrong about a patient, where does that signal go? If it does not reach the governance committee within a fixed, enforced timeframe, the near-miss remains isolated locally—leaving patient safety vulnerable to repeatable harm.
Answering "no" to any of these questions is not a rebuke. It is the framework’s own diagnosis: you have a charter and a meeting cadence, but you do not yet have governance.
Where does your institution stand? Take the free AI Governance Readiness Audit — a sixty-second diagnostic on whether you have governance, or just a charter and a meeting cadence.
