A Cancer Center's One-Year AI Governance Program Registered 26 Models and Offers a Replicable Blueprint for Healthcare Compliance Teams

What happened

Why it matters

• ·Healthcare organizations face rising regulatory scrutiny under FDA AI/ML guidance and state-level AI disclosure laws, and the absence of a documented model registry or lifecycle process is increasingly treated as a control deficiency rather than a planning gap.
• ·The iLEAP operating model's explicit decision gates for legal and ethics review address a common structural weakness in enterprise AI programs: the failure to route high-risk deployments through compliance functions before go-live, not after an incident.
• ·Including ambient AI pilots alongside conventional predictive models in the same registry and risk framework exposes a governance gap many organizations have not yet addressed, since ambient AI products such as clinical documentation assistants often bypass the procurement and validation controls applied to traditional software.

Governance controls affected

What to do now

• ☐Audit your current model registry to confirm it captures ambient AI tools and nomogram-style decision aids, not only machine learning models, and close any category gaps before your next governance committee review.
• ☐Map your existing AI deployment workflow against the iLEAP gate sequence (legal, ethics, adoption, performance) to identify which gates are absent or informal and assign owners to each within 60 days.
• ☐Review whether your AI Governance Committee has defined quorum, escalation authority, and a standing agenda item for new model registrations, using the Cancer Center's committee structure as a reference benchmark.
• ☐Verify that your risk assessment tool produces a documented risk tier for every registered model and that those tiers are linked to monitoring frequency and human oversight requirements under HOC-001 and MON-001.
• ☐If your organization operates in a clinical or health-adjacent setting, assess whether your current vendor contracts for ambient AI products include performance validation and incident notification obligations equivalent to those you apply to regulated software.

What to watch next

The FDA's evolving guidance on AI/ML-based Software as a Medical Device is expected to impose more prescriptive lifecycle and change management requirements on clinical AI, which would make registry completeness and pre-deployment approval gates like those described in this study a compliance baseline rather than a leading practice. State-level developments, particularly California's Health Care Services AI Act disclosure requirements and emerging Texas and Colorado frameworks, are moving toward mandatory documentation standards that align closely with what this program already produces. Compliance teams should monitor whether CMS or accreditation bodies such as The Joint Commission begin referencing similar governance structures in their AI-related standards, as adoption by accreditors would shift this from voluntary best practice to a certification requirement.