Health-system AI governance is usually built on a small set of external frameworks: NIST AI RMF for structure, CHAI for health assurance, Joint Commission for responsible use, and domain guidance such as the ACR practice parameter.
Few health systems write an AI governance program from scratch. They assemble it from a handful of published frameworks and adapt the result to local structure, risk tolerance, and the tools they actually run. Knowing what each framework is for keeps a program from either duplicating effort or leaving gaps.
AI governance in healthcare is how an organization decides which AI tools enter care, on what evidence, under whose ownership, and with what monitoring. This is the practical structure most health systems build.
Clinical AI governance is usually discussed at the model, vendor, and workflow levels. But hospitals also need to govern the infrastructure below the application layer: data locality, uptime, access, logs, monitoring, recovery, and system change.
A clinical AI governance framework gives hospitals a way to review, deploy, monitor, and retire AI tools with clear accountability. The goal is not bureaucracy for its own sake, but safer decisions around risk, evidence, privacy, workflow, vendor management, and ongoing oversight.
A workable pattern: use NIST AI RMF for the governance structure and risk process, CHAI for health-specific assurance language and model documentation, Joint Commission expectations as the compliance backstop, and domain guidance such as the ACR parameter for the validation and monitoring detail in a given clinical area. FDA guidance governs the subset of tools that are regulated devices.