Healthcare has every reason to be excited about AI.
Clinicians are under huge pressure. Administrative teams are stretched. There are still far too many processes that rely on someone manually moving information from one place to another. Give people a tool that can save them time today and, understandably, they’re want to use it.
That’s one reason AI adoption has moved so quickly. But governance rarely moves at the same speed.
Semble’s latest research found that 52% of private healthcare providers have adopted AI scribes or transcription tools, while just 39% have a comprehensive, enforced policy governing how those tools access and handle patient data.
I find that gap concerning – although not entirely surprising.
Adoption moves at the pace of convenience. Someone finds a tool that could make their working day easier, sees that it works and starts using it. But governance moves at the pace of agreement.
Essentially, you need to understand the risks, decide how the organisation is comfortable using the technology and get the right people aligned. In healthcare, where the data is sensitive and the consequences of an error can extend into patient care, there’s a lot to consider.
The gap between those two speeds is where risk starts to build.
What happens when there are no clear boundaries?
If an organisation formally rolls out an AI tool without giving staff guidance on how to use it, people have to make their own judgement. Most people will make sensible decisions, but healthcare providers can’t build their approach to information security or clinical safety around the assumption that everyone will interpret the boundaries in the same way.
Staff need to understand what a tool has been approved for and where its limits are. They need to know what information can be entered into it, what needs human review and who to speak to when something doesn’t look right. Without that clarity, you create room for very different interpretations of acceptable use.
That could mean sensitive information being processed somewhere it shouldn’t be, or an inaccurate AI-generated output making its way into a clinical record. A transcription tool might misunderstand a word or struggle with a particular accent, for example, and that error then becomes part of the information someone else relies on.
Governance should help people use AI well. It should make the safe route clear enough that staff don’t have to guess.
A policy on paper only tells you so much
One of the most interesting findings in the research was the difference between what senior leaders and operational teams believe is happening. Among owners, directors and C-suite leaders, 73% said their organisation had an AI policy in place. Among operations and practice managers, that fell to 42%.
That gap should make leaders curious.
If the people setting the policy believe it’s being enforced, while the people closer to day-to-day use are less convinced, there may be parts of the organisation leadership can’t see.
Good governance needs some way of testing policy against reality. What are people actually doing? Which tools are they using? Are the approved tools being used in the way the organisation expected? Are staff finding workarounds because the agreed process is too cumbersome?
Governance tends to struggle when there’s an easier route available. People generally want to do their jobs well and efficiently. If getting from A to B through the approved process feels unnecessarily difficult, some will find another way.
That means organisations need enough trust for people to be open about how they’re working. You want staff to tell you when a policy doesn’t work in practice, or when they’ve found a use for AI that nobody anticipated. Otherwise, senior leaders can end up governing the organisation they think they have rather than the one that actually exists.
Start with how AI will really be used
For teams under pressure to roll AI out quickly, the answer isn’t spending months trying to write a perfect policy before anyone is allowed near the technology. You’ll never predict every use case in advance.
A better starting point is to take a defined use case and understand it properly. What are people trying to achieve? What would a good outcome look like? Where could something go wrong? At what point would you stop the pilot or change the approach?
That gives information security and governance teams something concrete to work with.
You can build appropriate guardrails around a real use case, learn how people interact with the technology and understand where your original assumptions were wrong.
It also changes the relationship between security and the rest of the organisation. You’re working with teams to find a safe way to use something valuable, rather than appearing at the end of the process with a list of reasons they can’t.
That matters because AI use is going to keep evolving.
Approval isn’t the end of governance
One of the bigger challenges with AI is that approving a tool today doesn’t guarantee it will behave in exactly the same way six months from now.
The underlying models change. Outputs can change with them.
That matters if an organisation has built a process around an AI system producing a particular type of response. You need to know whether it’s still performing in the way you expected when the tool was originally assessed.
For higher-risk uses, particularly anything involving clinical care or sensitive health information, that means some form of ongoing review.
There’s no universal timetable for that. The frequency should reflect the risk of the use case. But organisations do need to move away from seeing AI governance as a one-off procurement or compliance exercise.
You approve a system for a particular purpose, then you keep asking whether it remains appropriate for that purpose.
Healthcare needs governance that can keep up
AI has arrived in healthcare because there are genuine problems it can help solve. That pressure isn’t going away.
Clinicians want more time with patients. Operational teams want to reduce unnecessary admin. Providers want to increase capacity without asking already stretched teams to absorb even more work.
The answer can’t be to slow every AI project down until governance has considered every possible eventuality. But we also can’t allow useful technology to spread through healthcare without anyone having a clear picture of how it’s being used.
The organisations that handle this well will make governance part of adoption from the beginning. They’ll understand the tools in use, set boundaries people can actually follow and keep checking that reality still matches the policy.
Because once AI becomes part of everyday healthcare, governance has to become part of everyday healthcare too.
Fay Sears is Head of Information Security at Semble. In her role, Fay leads Semble's AI security and AI governance strategy: architecture, risk assessment, red teaming and secure AI adoption for regulated health technology. She works across security leadership, AI security, AI governance and technology operations, helping engineering teams and executives adopt new technologies safely without losing momentum.
