The Governance Frameworks Already Exist. Health Systems Aren't Using Them for Agentic AI

Regulators have said so themselves

Recent coverage across several outlets converges on one admission: oversight is not keeping pace with deployment. A landmark review of hospital AI adoption found the rate of rollout outrunning regulatory capacity to monitor it bioengineer. Health Services Daily’s read is blunter, describing health AI as having overwhelmed governments while cautioning that panic is premature Health Services Daily. Faegre Drinker’s review of global and domestic policymaking reaches the same conclusion from the legal advisory side, noting that both international and US regulators are struggling to keep pace with AI’s rate of advancement Faegre Drinker.

That consensus should change what a governance committee does next. The question is not whether regulation will eventually catch up to agentic tools crossing organizational lines in prior authorization, referral routing, and patient messaging. It is what a health system does in the interval, and the interval is where most agentic deployment is already happening, as Confido Health’s expansion beyond voice AI into administrative task execution across private-equity-backed medical groups illustrates Fierce Healthcare.

Two frameworks already answer the structural question

Waiting is not the only option. ISO 42001, the AI management system standard, and NIST’s AI Risk Management Framework both already specify the structural work a committee needs to complete before an agentic system touches a payer system, an EHR, and a patient inside one workflow. ISO 42001 requires documented roles, responsibilities, and risk treatment across an AI system’s full lifecycle, including systems operated by vendors and partners, not just systems built in house. NIST’s framework structures the same requirement under its Govern function, which calls for defined accountability and third-party risk management set before deployment, not negotiated after an incident. Faegre Drinker’s review treats both as the de facto scaffolding industry is leaning on while statutory frameworks catch up Faegre Drinker.

That scaffolding is what the RAPS-covered academic proposal, built around Mark Sendak’s framework pairing centralized oversight with local hospital governance, is trying to formalize at the regulatory level RAPS. The instinct is sound. The gap is that most health systems deploying agentic tools today are not applying ISO 42001 or NIST AI RMF discipline to vendor contracts at all, mandatory or not.

What Penn Medicine actually demonstrates

Penn Medicine’s epilepsy brain-monitor pilot is worth reading not as a one-off local decision but as a working example of the Govern function applied in practice. Every patient message passed through an AI moderation check, a study team member reviewed every exchange daily, and patients were told explicitly that the AI layer was not a substitute for human monitoring Medical Economics. That is accountability defined and tested before go-live, the exact discipline both frameworks ask for, implemented without waiting for a mandate to require it.

What the committee should take from this

The fix is not a new framework. It is applying the ones already on the shelf to vendor contracts for agentic tools before they go live, naming specifically who holds Govern-function accountability when an agent’s action crosses from the EHR into a payer system or a third-party platform. That mapping exercise, done now, costs less than doing it after a denial, a complaint, or a cross-system failure forces the question anyway.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The argument is coherent and the central claim—that existing frameworks (ISO 42001, NIST AI RMF) already address governance gaps health systems cite—is well-supported, though the Penn Medicine example
Source & Claim Verification	Qwen · hosted fallback (qwen-2.5-72b-instruct)	cleared. Several claims rest on sources that could not be opened, including the Confido Health expansion and multiple other articles, which impacts the verification of key points.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately references ISO 42001 and NIST AI RMF but omits critical health-specific requirements (e.g., HIPAA, CLIA, ONC certification) and fails to map agentic AI risks to sectoral framew
Technical Accuracy	Llama	cleared. The article accurately references existing AI governance frameworks like ISO 42001 and NIST AI RMF, and applies them correctly to the context of agentic AI in healthcare.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and counters potential vendor hype by emphasizing existing frameworks and practical application over novel solutions, though it could strengthen its counterargument
Novelty & Non-Duplication	Grok	held. Restates the same accountability-gap thesis already covered in Who Authorizes the Agent, Who Controls the Agent, and The Governance Gap Hospitals Can No Longer Delegate to IT, without a genuinely new
Validation	DeepSeek	cleared. The briefing’s central claim that ISO 42001 and NIST AI RMF are applicable governance frameworks is factually correct and validated by cited sources.

Sources cited: 40. Validation challenges: 0. Production cost: $0.26 (measured across drafting, revisions and every board review, plus an estimated image). Learn how these briefings are written and verified.