Risk Tiering vs. Governance Tiering: How Health Systems Should Govern AI in 2027
Health systems have adopted AI faster than they can govern it, and that gap was the main topic at the CHIME26 Fall Forum. More than 1,000 digital health leaders met in Denver this November for CHIME's 35th Fall Forum. The question in the room has changed: health systems have stopped asking whether to deploy AI and started asking who is accountable once it is running.
The numbers explain why. A report from the Healthcare Financial Management Association (HFMA) and Eliciting Insights found that 88% of health systems use AI internally, but only 18% have a mature governance structure and a fully formed AI strategy.
This article covers the idea we heard most at CHIME26, moving from risk tiering to governance tiering, and eight takeaways for health systems scaling AI in 2027, each backed by current market research.
What is governance tiering?
Governance tiering sorts AI systems by how much human oversight they need, from whom and how often, instead of only by how risky they are. Risk tiering asks how much harm a tool could do. Governance tiering asks who owns the tool, how closely it is watched and what happens when it changes.
Risk tiering asks how much harm an AI system could cause. It happens once, at approval, and produces a label: low, medium or high risk. It misses model updates, drift and changes in how the tool is used.
Governance tiering asks how much oversight an AI system needs, and from whom. It continues across the AI lifecycle and produces named owners, review frequency and escalation paths.
The two work together. Risk tiering is a sensible first step. Governance tiering is what keeps oversight in place after go-live.
1. Move from risk tiering to governance tiering
The idea we heard most at CHIME26 came from Jason Joseph of Clearwater: move from risk tiering to governance tiering. We agree. A risk tier is a snapshot of the day a tool was approved. It does not say who owns the decision, how often someone checks again or what happens when a vendor updates a model in production.
Clearwater's own research shows why this matters. Its October 2026 report, based on 105 healthcare organizations, found that 91% cannot verify their AI governance. Most have finished the policy phase: committees are chartered and acceptable-use policies are written. The next phase is proving those controls work in practice.
2. Judgment is becoming the new currency
Jason's second point was the one people repeated in the hallways: judgment is becoming the new currency. As AI makes answers cheap, knowing when to trust them becomes what is scarce.
AI is already in clinicians' hands. The AMA's 2026 Physician Survey on Augmented Intelligence found that 81% of physicians use AI in their practices, up from 38% in 2023.
But judgment needs evidence, and you cannot judge a model you cannot see. A study in Health Affairs found that among hospitals using predictive AI, only 61% evaluated models for accuracy on their own data and only 44% evaluated them for bias. Governance does not replace human judgment. It gives that judgment the evidence it needs.
3. Most health systems cannot say who owns AI risk
CIOs, CISOs, Chief AI Officers, compliance leaders and clinical executives each own part of AI risk. Without a single named owner per system, accountability falls between them.
Black Book Research found that only 22% of hospitals are highly confident they could produce a complete, auditable record of their AI use if asked.
4. An AI governance framework is not the same as AI governance
Many health systems have a policy document. Far fewer can show who approved a model, who is monitoring it and what happened at the last incident.
The HFMA and Eliciting Insights survey found that 70% of health system CFOs have some AI governance process, up from 41% in 2024. But Black Book Research found that only 29% have implemented and enforced policies covering model inventory, lineage and sign-offs. Another 48% are still drafting them.
5. Third-party AI is the biggest blind spot
Most AI in a hospital did not come from the hospital. It is built into the EHR, the revenue cycle platform and the imaging stack. In the Health Affairs study, 79% of hospitals said their predictive tools came from their EHR vendor.
Clearwater's report found that 46% of healthcare organizations name third-party AI as their greatest external AI concern, ahead of AI-powered attacks at 34.6%. Yet only 14.3% fully validate their vendors' AI controls.
6. Shadow AI is already in your organization
Staff are using AI tools no one approved, and bans have not stopped it. Visibility has to come before control.
A Wolters Kluwer survey of more than 500 healthcare providers and administrators found that 41% know a colleague using unapproved AI, and 17% have used it themselves. Among those who had, 45% said the main reason was a faster workflow. People are not being reckless. They are filling a gap the organization has not filled.
7. AI governance is underfunded relative to the risk
Black Book Research found that the median hospital allocates 4.2% of its 2026 IT and quality or safety budget to AI governance and safety. Large systems allocate a median of 6.8%, and small hospitals 2.3%. The hospitals with the fewest resources have the least oversight, often for the same vendor tools.
8. AI value comes from measurement, not more pilots
The most practical sessions at CHIME26 were about reducing administrative burden and measuring real results. Deloitte's research finds that health systems talk more and more about AI's value, but their ability to show it financially has not kept up.
The systems closing that gap tie AI to specific targets. Mount Sinai Health System expects about $50 million in bottom-line impact from its AI portfolio in 2026 and reports a return above 3-to-1. You cannot prove value you are not measuring, and you cannot measure what you are not monitoring.
The takeaway: governance is how AI scales
Governance has a reputation for slowing AI down. The data says the opposite: adoption has outrun oversight, and that gap is what keeps AI from scaling. The health systems that move fastest in 2027 will do three things:
Name an accountable owner for every AI system, including vendor AI.
Match oversight to impact, using governance tiers rather than one-time risk labels.
Monitor continuously, so leaders can trust what they approve.
That is why we built ALIGNMT AI. Our platform gives healthcare leaders continuous visibility to govern AI across its whole lifecycle, so their judgment rests on evidence rather than assumptions.
Want to see where your AI governance stands? Request a demo of ALIGNMT AI.
Comments