When Regulators Step Back, Hospitals Own the AI Control Spec

Most hospital AI governance committees still review systems against a short list of adjectives. Is it transparent. Is it human supervised. Is it fair. These questions feel rigorous because they echo the language of every AI ethics framework published in the last five years. They are also unanswerable in any way that holds up under audit, because none of them specifies where in the system the property lives, who can see it, or what happens when it fails.

A recent analysis of clinical AI review practice makes this concrete. The problem is not that hospitals lack principles. It is that principles like “transparent” or “human supervised” are not checkable unless someone defines where transparency is implemented, which limitations are visible to which user, and at what point in a workflow a human is actually expected to intervene rather than rubber-stamp bioengineer.org. A vendor attestation that a model is “explainable” tells a compliance committee nothing about whether the explanation reaches the ordering physician, the coder, or nobody at all.

The stakes are not abstract. Denial rates remain elevated industry-wide, and “services not covered” has overtaken other reasons as the single most common denial code in 2026 medicaleconomics.com, a shift that Experian Health’s annual claims survey ties to mounting reimbursement pressure aol.com. Denial-management and prior authorization models now sit directly in that pipeline. A control failure there does not stay theoretical. It shows up as a specific denied claim with no clear owner for why the model flagged it.

What makes this urgent rather than evergreen is that the federal layer is doing less of this work, not more. ONC’s newly finalized HTI-5 rule narrows health IT certification criteria and is projected to cut roughly $1.5 billion in compliance costs, but it also defers the information blocking changes many in the field expected under the Cures Act framework fiercehealthcare.com. Legal analyses of the rule describe it as deregulating less than anticipated while punting on the harder information blocking questions reedsmith.com, and others note the same narrowing of certification scope paired with deferral on substantive changes mcguirewoods.com. For health IT vendors building toward certification, the practical read is that fewer requirements will be imposed from above than many assumed devprojournal.com.

That combination matters for AI governance specifically. When certification scope narrows and the information blocking question is deferred, the specification work does not disappear. It simply does not arrive pre-built into federal requirements the way some hospitals assumed it eventually would. Whoever is waiting for a certification checkbox to define what “transparent” or “human supervised” means in a given system will wait through another rulemaking cycle.

The practical shift for compliance and technology leaders is to stop accepting principle-language in vendor documentation and procurement review, regardless of what gets certified. Ask for the specific implementation: which log captures the model’s confidence score, which role sees it, which escalation path triggers below a threshold, and which named function at the vendor or the health system owns the response if that path fails. This is the same discipline CLIA and CAP already apply to laboratory quality systems, where a control is a documented, testable step with an owner, not an attitude.

Hospitals that keep governance at the level of adjectives will keep discovering, after an incident or a denial pattern no one can explain, that no one defined what “as described” meant in the first place. Certification was never going to do that work for them. The fix is specification, matched to a name, built in house.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The argument is coherent and well-structured—regulatory retreat creates a governance vacuum that hospitals must fill with specification rather than adjectives—but the causal link between HTI-5’s narro
Source & Claim Verification	glm-5.3-flash-fp4 · local	cleared. Every claim checkable against an opened source holds up — Medical Economics and the Experian/AOL release support the elevated-denials and ‘services not covered’ findings, ReedSmith directly supports t
Regulatory & Framework Fidelity	Mistral · fallback (mistral-medium-3.1)	cleared. The briefing lacks explicit mapping of AI governance controls to specific clauses in ISO 42001, EU AI Act, NIST AI RMF, and HTI-5/HTI-1 requirements.
Technical Accuracy	Llama	cleared. The article is technically accurate in its discussion of AI governance and the implications of the HTI-5 rule on health IT certification.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively anticipates and counters potential arguments by directly addressing common misconceptions about AI governance and regulatory oversight, while also providing strong evidence to
Novelty & Non-Duplication	Grok	held. Restates the exact HTI-5 deregulation + hospitals-must-own-AI-controls thesis already covered in multiple 2026-11-01 briefings (esp. ‘ONC Just Narrowed the Safety Net’ and ‘Federal AI Health IT Floor
Validation	DeepSeek	cleared. The claim is supportable because HTI-5 narrows certification and defers information-blocking changes, but it slightly overextends by implying a health-IT certification rule directly settles AI governa

Sources cited: 44. Validation challenges: 0. Learn how these briefings are written and verified.