The Oversight Debt Curve

In 2025, the focus was on adoption in the healthcare sector. That bill comes due in 2026. When adoption efforts outpace the ability to supervise, the gap can be called debt, a term we can borrow from software. Oversight debt builds in the same way that technical debt does. It builds silently while everything appears to be functional, and systems operate until the day that they fail to do so.

Calling it debt is accurate, because the burden is not felt at the time that it is incurred. A pilot launches with no clear owner, and a consent process is either performed in a very informal manner or is completely bypassed. Each of these appears to be a small, reasonable, and justifiable delay, and each contributes to a debt that no one is monitoring. The debt remains completely invisible until it is no longer the case.

Where debt forms

Oversight debt builds in the gray areas. A pilot escapes formal review because it is just a pilot, and a consent process is either carried out in a very informal manner or completely bypassed due to the absence of a designated owner. The decision, which should have been made in one instance, is made in part, in several committees, in a manner that establishes no clear ownership. Individually, these decisions are not overly concerning. In the aggregate, they are how an organization ends up exposed without a conscious decision to do so.

The concept is fairly straightforward. An AI scribe is installed by a department as part of the informal consent. Eighteen months down the line, the tool is used in the vast majority of patient interactions, and the informal consent is now part of each of the thousands of clinical encounters. Nothing along the way broke. The risk was simply allowed to expand, quietly, over time, until it became something much larger than what was originally agreed to.

What causes the bend in the curve to rise

While AI is used in a handful of cases, the completion and oversight gap is relatively easy to close. But as the AI is used by increasing numbers of patients or systems built on top of the AI, the completion and oversight gap becomes increasingly difficult to manage and correct.

The interest rate is also rising, but is more out of the control of the building. There are now more jurisdictions that have enacted laws outlining the use of AI in clinical practice that carry real fines. Public trust in institutions is at an all-time low, and there is a more severe punishment for a noticeable failure than in the past. None of the above was true to the same extent a few years ago, which means the debt taken on today is much more burdensome than it would have been a short while ago. The longer it is allowed to sit, the more it costs to repay.

Why 2026 is the inflection point

The systems that organizations implement this year will define their competitive position in future markets. This year, the rapid decisions made regarding ownership, the recordable activities, and the decisions associated with them set the terms for what will be the most urgent operational demands of the future.

Though it seems prudent to wait for the legal rules to solidify before taking action, it is typically the more costly approach. By the time the operational constraints become legally binding, the competitive position has already been determined by systems that have been operating for more than a year. The work then becomes the more costly and time-consuming retrofitting of systems designed to operate without oversight. The avoidance of the more costly unintentional AI incident has more to do with the borders of policy that were established early and much less to do with controls that were put in place after the fact.

The first payment is a name

The debt of AI policy is most clearly evident through the diffuse responsibility associated with its integration into the organization. The most clear answer is a singular and senior AI policy owner. This is not a committee. Without an answerable AI policy owner, the debt will continue to grow.

At this stage, the goal is to discover the debt before it discovers you. This involves a true accounting of every AI tool currently in use, even the shadow tools that were deployed without any approval. You cannot manage what you cannot identify. This also requires you to not issue exemptions for pilots. Just because you think a project will be temporary, that does not exempt the project from creating liability. It also requires you to audit a system before it is scaled, because a tool deployed this year without supervision is creating liability exposure for next year. Adding controls after exposure and liability come to light are remediation efforts; adding the same controls before exposure occurs is prevention, and will be much less costly.

The choice you have this year

2026 will not be the first year AI will be in healthcare. This will be the first year organizations will have to either build the capability to own the systems internally at a reasonable cost, or will find out what it costs to retroactively own the systems.

The most valuable question a leader can ask is simple. What is the oldest AI system that has not been audited, and how much has the debt on that system grown? The answer is often found to be very uncomfortable, and it is far more valuable that the answer is known now, rather than finding out the answer after it has been discovered by someone whose job it is to uncover it.

Christopher Hutchins Founder and CEO, Hutchins Data Strategy Consultants