Healthcare AI Governance
How Do Health Systems Build an AI Governance Committee?
A governance committee is not a slide in a policy deck. It is a standing group with real decision rights over how AI enters clinical and operational workflows.
Health systems build an AI governance committee by adapting the People, Process, Technology, and Operations (PPTO) framework: naming a multidisciplinary committee with clinical, technical, legal, and ethics expertise, defining an intake-to-retirement review process, building monitoring infrastructure, and securing executive sponsorship. Real deployments, from Trillium Health Partners to University of Wisconsin Health, followed this same four-domain path.
framework
The Four-Domain Approach: People, Process, Technology, Operations
Most health systems that build a durable AI governance committee are not inventing the structure from nothing. They are adapting a documented four-domain framework, People, Process, Technology, and Operations (PPTO), developed from real implementation experience at Duke Health and the Health AI Partnership (HAIP), a network Duke coordinates for health delivery organizations and federal agencies working on AI governance.
People: Who Sits on the Committee and What They Bring
The People domain specifies the personnel an AI governance committee actually needs: the committee's structure, the areas of expertise required, defined roles and responsibilities, and a plan for managing membership as people rotate off. In practice this means naming individuals, not just departments, who are accountable for clinical review, technical validation, and ongoing monitoring, rather than leaving the work to whoever happens to be in the room.
Two published health system case studies converge on a similar composition: clinical leadership, data science and technical staff, legal and compliance, ethics, informatics or IT security, and a channel for patient or family input. Neither case study treated any of these as optional; each was added specifically because an earlier ad hoc review process had missed something that discipline would have caught.
Process: Reviewing AI From Intake Through Retirement
The Process domain covers what happens to an AI tool between the moment someone proposes it and the moment it is retired. University of Wisconsin Health's governance committee runs proposals through a model intake form and what its authors call a value stream lifecycle, moving from initial presentation through deployment, periodic review, and, when warranted, decommissioning. That lifecycle view matters because a committee that only reviews a tool once, at launch, has no mechanism for catching drift, a new risk, or a use case that has quietly expanded beyond its original approval.
The PPTO framework's Process domain generalizes this into decision points across the full AI lifecycle, each with a defined documentation requirement, so a reviewer six months later can reconstruct what was approved, on what basis, and what conditions were attached.
Technology: Infrastructure to Actually Enforce the Policy
A governance committee's decisions are only as durable as the infrastructure that enforces them between meetings. The Technology domain covers the permissioning, audit logging, and drift detection a health system needs so that an approved-with-conditions decision, for example, actually gets monitored rather than simply filed. Without this layer, governance becomes a one-time approval event instead of a standing control.
Operations: Executive Sponsorship and Monitoring for Drift
The Operations domain is what keeps a governance committee running past its first year: executive sponsorship, a budget, clear accountability for the committee's own activity, and metrics that show whether governance is actually working, not just whether it exists on an org chart. The PPTO framework's authors added Operations as a fourth domain specifically because the more familiar People, Process, Technology model, borrowed from general IT governance, left out the ongoing work of monitoring AI performance drift and sustaining the committee once the initial policy document was signed.
case study
Two Real Health Systems That Built Committees This Way
Two published case studies illustrate what this looks like in practice, one from a large Canadian hospital system standing up governance from scratch, and one from a US academic health system with several years of committee track record.
Trillium Health Partners: From Ad Hoc Practices to a Formal Committee
Trillium Health Partners, one of the largest university-affiliated community health hospital systems in Canada, based in Mississauga, Ontario, used the PPTO framework to move from what its own team described as ad hoc and inconsistent governance practices to a formal structure. The process started with stakeholder interviews, 13 participants spanning technical, operational, and clinical roles, followed by three design-thinking workshops with five senior leaders from the organization's Digital Health Committee, who reviewed the interview findings and adapted PPTO to Trillium's own context.
The result was a set of approved organizational policies and an officially established AI governance committee, with clinical and executive co-leaders, subcommittees covering clinical, technical, ethical, and research expertise, patient representatives, and a defined path for ethics and legal consultation. The committee was in place by October 2024.
University of Wisconsin Health: A Two-Tier Governance Model in Practice
University of Wisconsin Health built a Clinical AI and Predictive Analytics Committee as its central oversight body, deliberately multidisciplinary: clinical subject matter experts, data science and analytics staff, information services, clinical operations, bioethics, human factors and design specialists, a law school faculty member for the ethics perspective, and diversity, equity, and inclusion staff. Rather than reviewing every AI use case at the same table, the committee commissions algorithm-specific subcommittees for individual applications, which report their findings back up.
By the time its governance model was published, the committee had overseen ten successful deployments, two successful retirements, and one successful non-deployment, a use case the committee reviewed and declined, across nine applications total. That non-deployment is worth noting on its own: a governance committee that only ever says yes is not actually governing.
composition
Who Should Be in the Room
Strip the two case studies down to what they share, and the composition question has a consistent answer. A committee needs clinical leadership with real authority to speak for patient safety, technical or data science staff who can assess a model on its own terms rather than the vendor's marketing claims, legal and compliance representation, an ethics voice, and informatics or IT security staff who understand what the tool actually touches once it is live. Most health systems that build this well also create a defined channel for patient or family input, whether a seat at the table or a standing consultation with a patient advisory group.
The detail that gets missed most often is decision rights. A committee that only advises, with no authority to say no to a deployment or require conditions before go-live, tends to collapse into a rubber stamp the first time a clinical department pushes for a fast launch. Both published case studies gave their committees, or a clearly named subset of them, actual authority over the go, no-go, and conditions-attached decision, not just a review-and-recommend role.
differentiation
How Kriv AI Helps
Kriv AI works with health systems standing up or restructuring an AI governance committee: mapping the PPTO domains to your organization's existing committees and reporting lines, drafting the intake and lifecycle review process, and defining the documentation a committee needs to survive its own audit trail. This is advisory and implementation-support work built around the same four-domain structure the published case studies used, not a generic policy template.
Enterprise and regulated-industry engagements, including health system AI governance work, are billed from $200 per hour. A fractional AI governance lead who owns your committee's operating model on an ongoing basis runs $300 to $400 per hour, and specialized advisory work, including committee design and charter drafting, runs $400 to $700 per hour. All engagements carry an $8,000 minimum, reflecting the documentation and cross-functional coordination a real governance committee requires.
Sources
Cited sources
- Kim et al., Establishing organizational AI governance in healthcare: a case study in Canada, npj Digital Medicine (Aug 15, 2025)
- Liao et al., Governance of clinical AI applications to facilitate safe and equitable deployment in a large health system, Frontiers in Digital Health (Aug 24, 2022)
- People, process, technology, and operations framework for establishing AI governance in healthcare organizations, npj Digital Medicine
- Duke Health AI Evaluation and Governance Program, Our Work (Health AI Partnership)
- NIST AI Risk Management Framework 1.0
Related resources
Continue exploring
Straight answers
Frequently asked questions about How Do Health Systems Build an AI Governance Committee?
How do health systems build an AI governance committee?
Health systems build an AI governance committee by adapting the People, Process, Technology, and Operations (PPTO) framework: naming a multidisciplinary committee with clinical, technical, legal, and ethics expertise, defining an intake-to-retirement review process, building monitoring infrastructure, and securing executive sponsorship. Real deployments, from Trillium Health Partners to University of Wisconsin Health, followed this same four-domain path.
Who should sit on a hospital's AI governance committee?
Clinical leadership with authority over patient safety, technical or data science staff who can assess a model independently of vendor claims, legal and compliance, an ethics voice, and informatics or IT security staff, plus a defined channel for patient or family input. Just as important as who sits on the committee is whether it has real authority to say no to a deployment, not just a review-and-recommend role.
What is the PPTO framework for AI governance?
PPTO stands for People, Process, Technology, and Operations, a four-domain framework developed from Duke Health's implementation experience and the Health AI Partnership network. It extends the more familiar People, Process, Technology model used in general IT governance by adding Operations: the executive sponsorship, budget, and drift monitoring that keep a committee functioning after its first policy document is signed.
What does an AI governance committee actually review, from intake to retirement?
University of Wisconsin Health's governance committee runs each AI use case through a model intake form and a lifecycle that moves from initial proposal through deployment, periodic review, and decommissioning when warranted. By the time its model was published, the committee had overseen ten successful deployments, two successful retirements, and one successful non-deployment across nine applications.
How did Trillium Health Partners build its AI governance committee?
Trillium Health Partners moved from ad hoc governance practices to a formal committee through 13 stakeholder interviews across technical, operational, and clinical roles, followed by three design-thinking workshops with senior leaders from its Digital Health Committee. The result, in place by October 2024, included clinical and executive co-leaders, subcommittees for clinical, technical, ethical, and research review, and patient representation.
Does Kriv AI help health systems set up an AI governance committee?
Yes. Kriv AI works with health systems to map the PPTO domains to their existing committee structure, design the intake and lifecycle review process, and draft the documentation a committee needs. Enterprise and regulated-industry engagements start at $200 per hour, with an $8,000 minimum per engagement.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call