Most hospitals have an AI governance committee.

Few can tell you how mature that governance actually is.

Ask a CMIO where their institution sits, and you will get an anecdote — a story about a recent deployment, a pilot, a vendor that fell through. You will not get a level. Because until recently, there was no scale to measure against.

HAIRA changes that.

The Healthcare AI Governance Readiness Assessment — published in Nature's npj Digital Medicine — is a five-level maturity model built from a systematic review of governance guidance. It is not another abstract framework aimed at academic medical centers with a bench of data scientists. It is built for the health systems that are deploying AI right now.

Five levels. Level 1 is initial and ad hoc — governance happens reactively, after something goes wrong. Level 5 is leading — governance is proactive and integrated, and the system is setting the standard rather than following it.

Seven domains. Governance body. Problem formulation. External evaluation. Development and customization. Internal validation and fairness. Deployment and change management. Monitoring.

Here is the part that matters — and it is the part most hospitals will resist hearing.

HAIRA is scored with a minimum-domain rule, not an average. A setting's level is the highest level at which every domain clears the bar. One weak domain caps the whole score.

That is not a scoring quirk. It is the point.

You are only as sovereign as your weakest domain.

A hospital can have a sophisticated governance body and a rigorous validation process, and still sit at Level 1 — because no one owns the monitoring domain, and one unattended domain caps everything else. This is the governance vacuum in numerical form: "no one owns the loop," and the loop is what governs the tool after it goes live.

The stakes are not theoretical. The majority of U.S. hospitals now run predictive models — yet only half assess those models for bias, and only two-thirds for accuracy. That gap between what is deployed and what is actually governed is precisely what a maturity model is built to expose. It is not a report card. It is a map of where the harm will enter.

Here is where the maturity model and the sovereignty question meet.

HAIRA tells you how capable your governance is. It does not, by itself, tell you what the governance is for. A hospital can climb to Level 5 and still have built a machine that treats the patient as a data point and the clinician as an editor of algorithmic output.

Capability without purpose is compliance theater at scale. That is why the readiness question has to be asked twice:

1. How mature is our governance? — HAIRA answers this.
2. Who gains sovereignty here, and who loses it? — that is the test no maturity model can run for you.

Both questions matter. A maturity model tells you where you stand. The sovereignty test tells you what you are standing for. Measure with the first; refuse to deploy without the second.

The time to know your level is before the algorithm speaks — not after the harm reaches the bedside and someone finally asks who was supposed to be watching.

Where does your institution actually stand? Take the free AI Governance Readiness Audit — a sixty-second diagnostic on whether you have governance, or just a charter and a meeting cadence.