NHIMG's AI Governance Guide Turns Four Frameworks Into One Operating Model

What happened

Why it matters

• ·Health organizations without a complete AI register are already drawing scrutiny: the IRS deployed high-impact AI with no testing records in 80% of cases, and a New York comptroller audit found SUNY lacked an AI inventory or approval workflow. Health sector compliance teams face the same finding risk, amplified by sector-specific regulators including FDA, CMS, and state-level health AI laws such as Washington State SB 5395 and SB 5886 (AI in Health Care and Right of Publicity).
• ·The guide's discovery requirement for AI in SaaS and vendor tools addresses a real gap. Shadow AI in procured software is routinely missed in point-in-time reviews, and ISACA has warned that point-in-time compliance cannot survive legal scrutiny. Organizations that rely on vendor attestations alone, without active discovery, cannot demonstrate the continuous inventory the guide requires.
• ·Named ownership is the governance control most frequently absent from enforcement findings. Without a named accountable owner for each AI system, escalation paths are informal, decommissioning is delayed, and audit evidence cannot be produced on demand. The guide makes owner assignment a pre-deployment gate, not a post-incident remediation step.

Governance controls affected

What to do now

• ☐Pull your current AI system list and identify every system that lacks a named accountable owner. Assign owners before the next quarterly governance committee meeting.
• ☐Ask your procurement and IT teams to identify AI features embedded in existing SaaS contracts, not only standalone AI tools. Include those systems in your risk register.
• ☐Map each AI system in your inventory to the guide's risk tiers and confirm that higher-risk systems have documented escalation paths and oversight assignments.
• ☐Confirm that your governance committee meets at least quarterly, has a written charter, and produces minutes that could serve as audit evidence.
• ☐Brief your internal audit function on the guide's decommissioning requirements and ask them to verify that retired AI systems have complete shutdown documentation.

What to watch next

Health sector regulators and state legislators are converging on AI inventory and oversight requirements that align closely with the controls this guide recommends. The EU AI Act (Regulation (EU) 2024/1689) conformity assessment obligations for high-risk health AI systems are now in effect, and EU AI Office inspections have already targeted healthcare. Compliance teams should monitor whether FDA updates its AI/ML software guidance to require the kind of continuous registry this guide describes, and whether CMS or OCR issue parallel expectations for health plan and hospital AI programs.