.svg)
Where Policy Ends is Vitea's 2026 research report on how health systems govern AI in practice. It combines a CHIME Foundation member survey, a CHIME member focus group, Vitea Lens network data and independent 2026 research.
Most health systems now have AI committees, written policies and intake reviews. Few can apply those decisions at the moment someone uses AI. Of seven surveyed organizations that rate their governance "established," six cannot enforce AI policy in real time.
Partnering to confidently advance healthcare AI innovation.
AI use in health systems has moved faster than the controls meant to govern it. The AMA reports that 81% of U.S. physicians now use AI. Committees and policies exist, but most organizations can't yet see, enforce or verify AI where it's used.
The report follows that gap through detection, real-time control and monitoring, then lays out the financial, legal and clinical costs when they're missing.
What the report covers:
The report sets what leaders say about their AI governance next to what network data shows. Six of the findings:
The report closes each chapter with questions to bring to your team, along with data on how health systems answer them today. Five to start with:
Most AI policies are written for humans to interpret. AI risk shows up in the moment: the prompt, the upload, the drafted note. The report documents common ways AI gets past governance that only acts at intake or audit:
Shadow AI is any AI tool or feature used without the organization's approval or knowledge. In healthcare, that includes consumer apps, browser extensions, personal accounts and AI added to approved software. In Wolters Kluwer Health's 2026 survey, 40% of healthcare professionals had encountered unauthorized AI tools at work.
Real-time enforcement applies AI policy at the moment of use, on the prompt, the upload or the agent's action. The system blocks, redacts, warns or logs automatically, with no one interpreting the policy after the fact.
AI tools keep changing after approval through model updates, new vendor features and shifts in how staff use them. The UPMC Center for Connected Medicine and KLAS found 92% of health systems test third-party AI before deployment.
Several states now have them. Rhode Island and Louisiana require providers to tell patients when AI records or documents a visit. Iowa requires patient consent before AI records and transcribes clinical interactions. Texas has required plain-language disclosure of AI use to patients since January 1, 2026.
RUAIH (Responsible Use of AI in Healthcare) is a voluntary Joint Commission certification launched June 1, 2026. It evaluates five areas, including monitoring and validating AI safety and performance. The report's maturity model shows those areas map most closely to real-time enforcement and continuous assurance. Watch our RUAIH certification webinar.
The report combines a CHIME Foundation member survey fielded for Vitea, a CHIME member focus group held September 3, 2026, and Vitea Lens network data from multi-hospital U.S. health systems. It also draws on 2026 research from the AMA, IBM, ECRI, KLAS and others, and excludes research from AI governance vendors.
.webp)
