An academic health system brought a shadow AI estate under governance in six weeks — without pausing a single clinical project.
more AI tools found than the committee's own estimate
from first scan to a signed-off inventory
of tools in use given a named owner
The committee had a spreadsheet. It listed around thirty AI tools, assembled from procurement records and whatever departments had volunteered. Nobody believed it was complete, and nobody could say how incomplete it was.
That mattered more than it first appeared. Every governance obligation downstream — policy, monitoring, incident reporting, evidence for review — assumes you already know what you are governing. The committee was being asked to certify an estate it could not see.
The list that came back was roughly four times longer than the committee's estimate — personal AI accounts indistinguishable from the enterprise tenant, and AI features switched on inside tools approved years before those features existed.
The existing policy was sound and almost entirely unenforced, because it lived in a document staff read once at onboarding. Applying it at the point of use is what turned it from guidance into governance.
Vendors update models without asking. Monitoring stayed on after go-live, so a change to an underlying model reached the committee while it still had options.
The existing policy was sound and almost entirely unenforced, because it lived in a document staff read once at onboarding. Applying it at the point of use is what turned it from guidance into governance.
With Vitea, we have complete visibility into how our AI applications are performing and the control to ensure none of them operate outside of policy, whether that's our own internal standards or the regulatory requirements of the states we operate in. For a health system at our scale, that level of oversight is non-negotiable.
The committee did not start with a policy problem. It started with a visibility problem that looked like a policy problem. Once the inventory reflected what was actually running, everything downstream — enforcement, monitoring, evidence — became tractable, and adoption carried on rather than stopping while governance caught up.
