Joint Commission AI certification: what RUAIH requires

The Joint Commission announced the Responsible Use of AI in Healthcare certification on 1 June 2026. Since then most of what has been written about it has been an announcement rewritten, which leaves the person who actually has to prepare for it no better off.

This page is the other thing. It sets out the five areas the standards are organised around, what evidence each one plausibly asks for, and, just as importantly, which parts the Joint Commission has not published. That distinction matters more here than usual, because a certification three months old attracts a great deal of confident writing about requirements nobody has seen.

What is actually published, and what is not

Published, and quotable:

RUAIH is voluntary. It is a certification programme “designed to recognize organizations in the U.S. that demonstrate they have the governance, safeguards, monitoring processes, and education in place to use AI responsibly in healthcare settings.”

It does not certify AI products. The Joint Commission is explicit: the certification “does not validate or certify individual AI products or tools.” This is the single most misread fact about it. No vendor can be RUAIH certified. If one tells you otherwise, that is a claim worth checking.

You do not need to be Joint Commission accredited to apply. The announcement says so directly, which opens it to organisations that have never been through a Joint Commission survey.

The standards are organised around five major areas: governance; effective data management; risk and bias reduction; monitoring, evaluating and validating safety performance, effectiveness and responsible use; and transparency, education and training.

Not published, as at 7 August 2026: the element-level standards themselves, the scoring method, the fee, the survey format, and how often recertification falls due. Anybody presenting an element-by-element checklist as fact is inferring it. What follows is inference too, and is labelled as such.

The five areas, and the evidence each one will ask for

The Joint Commission has assessed hospitals for seventy years and its method does not vary much: a standard states an expectation, and a surveyor asks you to produce dated evidence that the expectation operated. Not that a policy exists. That it ran.

That single pattern tells you more about how to prepare than any leaked checklist would.

1. Governance

The expectation will be that somebody owns AI, that the ownership is written down, and that the body doing the owning meets and decides things.

Evidence that survives a question: a committee charter naming its seats and its reporting line, minutes from the last three meetings, a decision log showing tools that were approved and at least one that was not, and a documented escalation path to the board quality committee.

The failure mode is a charter with no minutes. A committee that has never declined anything is not governing, it is processing.

2. Effective data management

Expect this to cover what data the model sees, where it came from, who authorised the flow, and what happens to it afterwards.

Evidence: the data flow diagram for each deployed tool, the executed business associate agreement, the contractual position on whether your data trains the vendor’s model, retention and deletion terms, and the record of who approved each of those.

The failure mode is the training-data clause nobody read. It is the single most common gap between what an organisation believes it agreed and what it signed.

3. Risk and bias reduction

Expect a documented assessment per tool, proportionate to what the tool touches. A sepsis prediction model and an ambient scribe do not warrant the same depth.

Evidence: a risk classification for each tool with the reasoning, the subpopulation performance data you asked the vendor for and what they actually provided, and your local validation where you did one.

The failure mode here is subtle and worth naming. Most organisations record the bias assessment they performed. Very few record the bias assessment they asked for and were refused. The second document is more useful, both to you and to a surveyor, because it shows the diligence rather than the conclusion.

4. Monitoring, evaluating and validating

This is the area most organisations will fail on, and the reason is structural rather than lazy. Monitoring is the only one of the five that cannot be created retrospectively. You cannot produce twelve months of drift data in the week before a survey.

Evidence: a defined metric per tool with a threshold, the actual monitoring output over time, the log of alerts and what was done about them, and at least one documented instance of an intervention. A dashboard nobody has read is worth less than a spreadsheet somebody signs monthly.

If you do one thing after reading this page, start the monitoring log. Its value is a function of how long it has been running.

5. Transparency, education and training

Expect two audiences: your workforce and your patients.

Evidence: the training record showing who was trained and when, the patient notification approach where a tool touches care directly, the disclosure position on ambient recording, and the escalation route for a clinician who disagrees with a model’s output.

The failure mode is training that happened once, at go-live, for the people who happened to be on shift.

What to do in the next ninety days

Nothing in this list requires the standards manual to be published, because all of it is evidence you would want regardless.

Build the inventory first. You cannot govern tools you cannot list, and almost every organisation underestimates how many it has once shadow use is counted.

Start the monitoring log second, for the reason above.

Write the committee charter third, and hold a meeting that produces minutes. Ours is set out in the governance committee charter guide, with the seats named.

Then work the gap. The free readiness score runs twenty questions across the same five areas and returns a page naming the artefact you are missing, which is more useful than a number.

How this relates to CHAI, and whether you need both

CHAI published governance playbooks in May 2026 and the Joint Commission certification followed a week later, which has left a lot of people asking which one they are supposed to do. They are not competitors and the answer is not obvious from either organisation’s own materials. That comparison is set out separately.

The controls behind both, mapped against each other and against the NIST AI Risk Management Framework, are in the crosswalk.

A note on what this page is

The Healthcare AI Institute is not affiliated with, endorsed by, or accredited by the Joint Commission or CHAI, and nothing here is official guidance from either. It is an independent reading of published material by a physician executive, written for the person who has to prepare. Where the Joint Commission has published something, it is quoted. Where it has not, this page says so.

Questions people actually ask

Is the Joint Commission AI certification mandatory?

No. The Joint Commission describes RUAIH as a voluntary certification programme. It is not part of accreditation and no organisation loses accredited status by declining it.

Do you have to be Joint Commission accredited to apply for RUAIH?

No. The Joint Commission states that interested healthcare organizations do not need to be accredited by Joint Commission to apply for the certification.

Does RUAIH certify the AI products a hospital uses?

No, and this is the most misunderstood point. The Joint Commission states the certification focuses on the safe, reliable, transparent, and ethical use of AI by healthcare organizations, and that it does not validate or certify individual AI products or tools. It certifies how you govern, not what you bought.

What are the five areas of the RUAIH certification?

Governance. Effective data management. Risk and bias reduction. Monitoring, evaluating and validating safety performance, effectiveness and responsible use. Transparency, education and training.

When did the Joint Commission AI certification launch?

The Joint Commission announced the Responsible Use of AI in Healthcare certification on 1 June 2026, following initial guidance published with CHAI on 17 September 2025.

How long does certification preparation take?

Realistically about a year, because part of the evidence — dated quarterly monitoring, committee minutes, training records — can only accumulate and cannot be backdated. The month-by-month sequence is in the certification timeline guide.