Healthcare AI governance committee: the charter

Almost every AI governance committee charter you can find online is a generic corporate AI template with the word healthcare inserted. None of them mention medical staff structure, clinical risk classification, or the quality committee the thing has to report into, which are the parts that make it a hospital document rather than a policy exercise.

This is the version that has those parts. Edit it. A charter adopted verbatim from the internet is the first thing a surveyor spots.

The eleven seats, and what each is accountable for

Chair, a clinician. Convenes, owns the agenda, holds the casting vote. Deliberately not the CIO, see below.

Nursing leadership. Most AI in a hospital lands on nursing workflow before it lands on anybody else’s, and nursing is the first to notice when a tool is being worked around rather than used.

Quality and patient safety. Owns the link between this committee and the existing safety machinery, including how an AI-related event enters the normal incident process rather than a parallel one.

Informatics or CMIO. Translates between the clinical question and the technical one. Accountable for whether a tool actually does what the vendor says in your environment.

Information security. Data flows, access, the security review, and the question of what leaves the building.

Privacy or compliance. Regulatory position, patient notification, and the contractual question of whether your data trains somebody else’s model.

Legal. Contract terms, indemnity, liability allocation, and the parts of a vendor agreement that only matter on the worst day.

Data governance. Provenance and quality of the data going in. A model trained on a clean population and deployed on yours is a data governance problem before it is a clinical one.

Health equity. Subpopulation performance, and the standing question of who this tool works less well for. This seat needs a named person, not a distributed responsibility.

Finance. The business case, and the recurring cost that outlives the enthusiasm.

Operations owner for the workflow in question. Rotating rather than permanent. The person who owns the clinic, the ward or the revenue cycle function the tool will actually touch, present for decisions about their area.

Separation to preserve. The person who selects a tool and the person who assesses it should not be the same seat. Where the CMIO is driving adoption, the assessment should sit with quality. This is the structural point most charters miss and it is the one that makes the committee credible.

Why a clinician chairs, not the CIO

An AI governance committee chaired from IT is read, by clinicians and by assessors, as a technology approval body. The decisions in front of it are clinical risk decisions that happen to involve technology, and the difference shows up the first time the committee has to decline something popular.

The CIO’s seat is essential. The chair is a different question.

What the committee decides

Five decisions, and it helps to write them down as the committee’s actual remit, because a committee with an unbounded remit meets and discusses.

Whether a tool may be piloted. Whether a pilot may go into production, which is a separate decision and should be minuted separately. What monitoring each tool carries, at what threshold, and who watches it. When a tool is withdrawn or suspended. Which decisions escalate to the board quality committee.

The fifth is the one people forget, and it is the one an assessor asks about.

Quorum, cadence and the minutes

Quorum. The chair or deputy, plus the quality seat, plus informatics, plus one of privacy, compliance or legal. Set it so the committee cannot approve a clinical tool without a clinical safety voice in the room.

Cadence. Monthly while you are building the inventory and classifying risk. Quarterly once that backlog is clear. Below quarterly it becomes hard to demonstrate that governance operated rather than existed.

The minutes are the deliverable. Everything else is preparation. Minutes that satisfy a question record what was decided, what evidence was in front of the committee, who dissented, and what the review date is. Minutes that record attendance and a list of topics do not.

One test worth applying: can somebody reading the minutes twelve months later tell why the committee said yes? If not, they will not persuade an assessor either.

The decision log

Separate from the minutes, one row per tool: name, owner, risk class, date approved for pilot, date approved for production, monitoring metric and threshold, last review, status.

The most valuable row in it is a tool the committee declined. A committee that has approved everything ever put in front of it has not been governing, and that is visible from the outside.

Escalation to the board

Write the route down and use it at least once. Assessors look for evidence the route has been travelled, not that it appears on an organisation chart.

Escalate: any tool the committee classes as high clinical risk, any AI-related safety event, any decision to deploy against a dissenting seat, and any tool where the contractual position on data could not be resolved.

How this maps to the certification

The governance area is the first of the five in the Joint Commission’s Responsible Use of AI in Healthcare certification, announced 1 June 2026. The evidence a surveyor would ask for is precisely what this charter produces: the charter itself, the minutes, the decision log, the escalation route and proof of use.

The requirement detail is in the certification guide. If you are still deciding between CHAI’s playbooks and the Joint Commission route, the comparison is here.

To see where your governance currently stands, the readiness score scores your artefacts against the same five areas on a four-level scale, where level two is documented and level three is operating. Free, about twenty minutes, and the output names the artefact you are missing.

Disclosure

The Healthcare AI Institute is not affiliated with, endorsed by, or accredited by the Joint Commission or CHAI. This charter is an independent working document, not official guidance from either body, and it is not legal advice. Have your own counsel read anything you adopt.

Questions people actually ask

Who should sit on a healthcare AI governance committee?

Eleven seats cover it: a physician chair, nursing, quality and patient safety, informatics or the CMIO, information security, privacy or compliance, legal, data governance, health equity, finance, and an operations owner. The people who select tools and the people who assess them should not be the same seat.

Who should chair an AI governance committee?

A clinician, not the CIO. AI governance decisions are clinical risk decisions with a technology component, and a committee chaired from IT tends to be read as a technology approval body rather than a safety one.

How often should the AI governance committee meet?

Monthly while you are building the inventory and the risk classifications, moving to quarterly once the backlog is cleared. Meeting less often than quarterly makes it very hard to demonstrate that governance operated rather than merely existed.

What does an AI governance committee actually decide?

Whether a tool may be piloted, whether a pilot may go into production, what monitoring each tool carries and at what threshold, when a tool is withdrawn, and which decisions escalate to the board quality committee.

Does the AI governance committee need to report to the board?

It needs a documented escalation route to a board committee, normally quality and safety. Assessors look for the route and for evidence it has been used, not merely that it exists on a chart.