2026 Is the Year of Oversight

This year and last year in healthcare were about getting AI in the door. Now we have pilots, ambient documentation, predictive models and even triage tools going live in patient care and vendors are promising clinicians will get time back. Many tools have delivered on their promise to clinicians, helping to justify the momentum and the ongoing disruption. The technology is here. The oversight is not, and 2026 is the year that the lack of oversight becomes an unbearable cost.

We can already see the cost of the oversight in the courts. Sharp HealthCare is defending against a class action that alleges their use of ambient recording technology captured private patient conversations and inappropriately documented that the patient provided consent to the recording. The technology did what it was designed to do, but there was no one to ask whether it should have been designed to operate that way. This is not a failure of technology. The oversight has emerged in the most unfortunate of circumstances, in a court of law as opposed to a committee.

For most of the last decade in healthcare AI the work of providing oversight could be deferred. The number of tools was limited and the stakes felt manageable. Now the time has come to provide oversight on the work that is the responsibility of each organization to ensure that the tools we use are safe.

The pressure is coming from every direction at once

Unlike previous years, 2026 will see simultaneous challenges, rather than the incremental build-up of challenges. For example, new state legislative measures require health systems to disclose the use of AI in patient care, and some laws prohibit the use of AI in certain autonomous clinical decision-making. Meanwhile, in the European Union, new rules aim to make responsible AI in healthcare a business reality. International health bodies are beginning to make Responsible AI an expectation in the delivery of health care. While each of these challenges is surmountable, the simultaneous arrival of all brings an end to the era of health care without oversight.

Patients are also a source of new challenges. For example, patients are now attending health care appointments with AI generated health care plans and detailed instructions on the self-directed management of their care. New challenges require a response, and waiting for new policies to catch up is no longer an option.

Looking back on the aftermath during the year of implementation

Before looking ahead, an organization must consider what it has to inherit from the past two years. The majority of health systems do not possess a full accounting of the AI they have within their systems. These tools probably came through departmental budgets, vendor pilots which became permanent, various product features, and grant funding which lasted beyond its original scope. There was no one person in charge of the oversight for any of this, and there is no one singular record which accounts for this.

That backlog marks the true starting line for 2026. An organization cannot oversee what it has not discovered, and the process of discovery is, in fact, an act of humility. The first genuine inventory an organization runs often reveals tools which no one authorized, and data which is traversing to undesigned locations. None of this should warrant blame. This is the norm given a year which was characterized by a driven and questioning approach. The intent is to indicate that the starting point is the actual situation as opposed to that which is documented on the org chart.

Oversight that has substance, not another thicker binder

With the situation being as it is, the urge is to create a policy, draft a committee charter, and complete checklists. This is the primary reason why real oversight manifests in the several places with substance, as opposed to it merely being documented.

It begins with a review board that actually understands the work. These board members should include clinicians, people from privacy and records, and the tech sides, along with people who are able to say no and actually mean it. A committee that cannot prevent a deployment is simply advisory rather than oversight. Additionally, an organization should know all the AI systems that interface with patient data prior to deployment, and while this should be common practice, it almost never is. The ability of the patient to understand and decline should be prioritized and not treated as a protective measure for the organization. The capability to render an account of the action of a tool and the rationale should also be part of the system from the outset and not an afterthought.

None of this is novel. It is common operational discipline for a unique class of tools. Organizations that run like this will recognize this. For the others, this will be a significant operational overhaul.

It must be taken seriously by senior leadership

Oversight that exists solely in committees tends to be advisory. While advisory oversight can be useful, it tends to be ignored under the pressure of a deadline. For oversight to be taken seriously, someone in senior leadership must take responsibility. This must be someone with the authority to stop the rollout and the reputation to withstand questioning by the board and, ultimately, the public, regarding which tools the organization deployed and what measures the organization took to ensure the safety of the tools. Boards are now asking these questions because they recognize that an AI failure is no longer a footnote to a technical issue, but rather a failure of the organization resulting in reputational and legal concerns. A leadership team that is prepared to answer the questions of the board is at a considerable advantage over the team that is compelled to answer the questions after a reporter or plaintiff has prepared the questions.

Trust is the real issue at stake

There is a more important issue that makes 2026 a deadline. Public trust in large organizations is at one of the lowest points ever recorded and the distrust is not limited to the tech industry. An already distrustful patient is now being asked to trust the AI the hospital is using. The tool does not come with its own trust. It is the responsibility of the hospital to ensure the tool is trustworthy.

That is why oversight is not a secondary activity. It is how an organization earns the right to utilize these tools at all. When issues arise with an AI system and the public inquires about the oversight, the answer is there is no oversight. An organization that demonstrates real oversight earns and maintains the confidence of its stakeholders. Conversely, an organization that fails to provide oversight will suffer far greater losses from a single public failure than the cost of providing oversight.

Oversight is no longer a cost. It is becoming the competitive advantage

For many years, oversight was perceived as a cost, particularly as a department that slowed everything down. That perception is changing. Organizations that are leading the competition are the ones that perceive oversight as the department that enables them to work quickly. They have the confidence required to deploy new tools. They understand the oversight. They can effectively communicate to stakeholders, boards, or even the legal system how a particular system is employed and for what purpose. Without oversight, most competitors are in an untenable position.

The reframe is significant because it determines who is responsible for the work. When oversight is viewed as a cost, it is mitigated. Conversely, treating oversight as a competitive advantage brings a greater commitment from the leadership and collaboration from the employees. Depending on whether an organization views oversight as a cost or as part of the foundation of its activities, the same set of tasks will produce a drastically different outcome.

The health systems that decide to employ oversight in 2026 will do so because they have to. Oversight will be forced upon health systems through various avenues including litigation, laws, and the tools patients bring with them. Systems have the option of implementing oversight intentionally while allowing them time to design the oversight, or they can be forced to implement oversight with little opportunity to design the oversight according to their needs. If health systems do not decide to implement oversight in 2025, they will have to spend 2026 explaining themselves to stakeholders.

Christopher Hutchins Founder and CEO, Hutchins Data Strategy Consultants