Many compliance leaders struggle with the question of what their role in AI governance is. Lisa Estrada, JD, believes an organization’s compliance officer shouldn’t agree to be the sole organizational owner of AI governance. Rather, they should be making sure the right people are governing it together.
In this blog, she explains what healthcare compliance leaders should know to effectively help their organizations build and operate robust AI governance frameworks.
QUICK TAKE
Compliance should help coordinate AI governance, not serve as its sole owner. Start by identifying where AI is being used, establishing clear accountability across departments, and applying risk assessment and ongoing monitoring.
Compliance Programs and AI Governance: What’s Similar?
Compliance programs have always been about paying attention to what can go off the rails before it does.
AI governance is the same. Organizations need to be thinking in a systematic way about:
- Where could this go wrong?
- Who would get hurt?
- How would we know?
- What do we do about it?
Assurance Is a Common Requirement
“An assurance framework gives boards and management teams confidence grounded in evidence that controls exist and work as intended,” Estrada explained. “It’s not a policy. It’s the ongoing cycle of identifying the risk, assigning an owner, testing the control, reporting the results to leadership, and fixing what you find.”
That model, which typically includes risk assessments and monitoring plans, is very familiar to compliance officers. It’s exactly how most compliance programs are structured. And, according to Estrada, the same model can be applied to AI governance.
Two Tools for AI Governance Assurance
Risk Assessment
A structured way to identify what could go wrong, who could be affected, and where safeguards or oversight are needed. It helps leaders prioritize the most significant risks and decide where to focus attention.
Monitoring Plan
Describes how the organization will continue to watch areas of greatest risk over time. It identifies what will be reviewed, who’s responsible, how often monitoring will occur, and how concerns will be reported and addressed.
“Compliance officers know how to build and maintain assurance frameworks; they know how to conduct risk assessments and develop monitoring plans,” Estrada said. “This makes them an obvious choice when boards and organizational leaders ask for assurances around how AI is being used.”
How Are Compliance Programs and AI Governance Different?
Estrada noted important distinctions between the risks managed by typical compliance programs and those presented by AI:
Speed and scale of change. AI can change things quickly, and its risks can scale across an organization just as rapidly. Something that used to take months to spread can now hit every claim overnight. As a result, an annual risk assessment, the common standard for compliance programs, is probably inadequate in the world of AI.
Probabilistic, not deterministic. Healthcare compliance programs are rule- or standards-based. The same facts get the same answer, so a point-in-time audit tells you something lasting. By contrast, AI is probabilistic. Passing a test once doesn’t mean it will pass the next time. For confident governance, AI monitoring must be continuous, not point-in-time.
Opacity: Compliance programs run on root cause analysis. When we find a problem, we don’t just fix it. We dig in to figure out why it happened. With AI, we often can’t get there alone. We can see the output was wrong, but was it the data, the model, a vendor update, or how someone used it? Compliance can’t answer that. Neither can data science on its own. It may take the data people, the clinicians, the vendor, and the people using the tool every day to find answers. That’s why AI governance must be multidisciplinary. It’s how you get to root cause.
Who Should Own AI Governance in Healthcare?
“In traditional compliance programs, there’s usually a single clearly designated owner: the compliance officer sets the framework, oversees the work and escalates problems.” said Estrada.
“AI governance in healthcare is different. Accountability can be named, but the expertise and control have to be distributed. The business leader deploying the AI-driven tool should be accountable for its use and outcomes, with a named executive who can pause or stop it.”
But…
- Clinicians must define what “safe and effective” looks like.
- Data and technology teams must evaluate performance.
- Privacy, security, legal and compliance must test risks and controls.
- AI tool users must report what’s happening in practice.
“Multidisciplinary governance doesn’t mean diffused governance. The model is shared expertise, clear accountability and explicit authority to make a decision and stop the AI if necessary.” – Lisa Estrada
Next Steps for Compliance Leaders
Estrada shared three important tactics to help compliance leaders get their arms around AI governance in healthcare.
1. Learn the language.
“Seek out AI educational opportunities,” Estrada says. “AI has its own vocabulary and concepts, and if you don’t know them, you can’t be effective in the conversation.”
Estrada recently earned the Artificial Intelligence Governance Professional (AIGP) certification available through the International Association of Privacy Professionals (IAPP). It’s a resource that compliance leaders can invest in to build necessary AI governance and strategy skills.
The training focuses on:
- Foundations of artificial intelligence governance
- How laws, standards, and frameworks apply to AI (such as EU AI Act)
- How to govern AI development
- How to govern AI deployment
About a third of the exam involves scenario-based questions tied to applied judgment in real-world case studies.
2. Take Action. Drive Action. Lead Action.
Compliance doesn’t have to own AI governance. But it does have to make sure the right people are governing it together. Depending on the organization, that might include
- Operations
- Clinical (in healthcare)
- Information Technology and Security
- Legal and Regulatory
- Operations
- Risk Management
- Internal Audit
“Act as a convener,” Estrada says. “Don’t wait to be asked and don’t try to own it alone.”
3. Start with an AI inventory
“You can’t assess or monitor risks you can’t see,” she explained.
Take inventory of:
- Where AI is already being used
- For what purpose
- By whom
- With what data
- Through which vendors
“Then get the right people in the room and bring the assurance framework, because that’s what compliance officers know better than anyone.”
Compliance Must Deal with AI Boom
AI governance is no longer an issue compliance leaders can watch from the sidelines. The question is how quickly and how effectively they will engage. These practical steps can help leaders prepare their teams, bring the right functions together, and give their organizations confidence in how AI is being used and governed.
About the Author
Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.
About the Author
Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.
Ready for More?
Here’s another resource to guide good AI governance strategies for your healthcare organization: “Compliance Leader’s Guide to Getting Started with AI.” Cut through the hype and confidently implement AI with proven strategies. This clear, tactical guide will help you save time, reduce risk, and future-proof your compliance processes.
Download to learn:
- Five Practical Ways to Use AI in Compliance Work
- Six Critical Considerations When Adopting AI for Healthcare Compliance
- Five Things to Know to Leverage AI for Process Improvement