Who's Telling You Your AI Governance Is Broken? The Ecosystem Map, Applied to Healthcare.

A number that won't sit still

Start with what sounds like a simple question: how many healthcare organisations actually have AI governance in place? The answer depends almost entirely on who you ask. One governance vendor puts the share with a formal framework at just 12%.^[2] HIMSS market research says only 19% have yet to put a framework in place, which suggests that about four in five already have one.^[3] And outside healthcare, EY found that 98% of large US companies have formal AI policies.^[4]

None of these figures is necessarily wrong. They're measuring different things, and they're being counted by people with very different stakes in the answer. Once you see that, the map starts to earn its keep.

Placing the sources on the map

The Vendors. Vendors sit where both incentive and expertise run high, and EY is a good example. Its survey is sound, but it was also commissioned by a part of EY that sells AI governance and assurance services, something one trade outlet was careful to point out.^[5] A healthcare risk-management vendor gives a sharper example. It cited Kaiser Permanente's $556 million settlement as proof of how quickly AI risk can snowball.^[6] But the Justice Department's allegations in that case concerned unsupported diagnosis codes submitted to Medicare between 2009 and 2018,^[7] and none of the case reports we found mention AI at all. A case about medical coding had quietly become evidence for an AI-risk product.

The commercial researchers. Research firms can drift in similar ways. One of Black Book's headline figures is that 80% of hospital leaders find vendors' AI claims hard to verify without formal governance. Black Book itself attributes that figure to its Pulse survey of roughly 650 hospital leaders.^[8] Advisory Board, however, presented it as a finding from a different Black Book survey of 182 leaders.^[9] The number stayed the same, but the study it supposedly came from changed.

The Translators. Translators, the journalists and analysts who cover the field, rarely invent distortions, but they can pass them along in small steps. You can watch this happen with a single EY finding. EY's press release said that 47% of organisations had “not applied” their governance process for urgent deployments.^[4] EY's own insights page described the same finding as “bypassed.” ^[10] Bloomberg Law called it “sidestepped,”^[11] Techstrong called it “skipped,”^[12] and Corporate Compliance Insights called it “circumvented.”^[13] Each retelling made the behaviour sound more deliberate than the last, even though the survey never measured intent at all.

The Amplifiers. Amplifiers are where a claim can flip into its opposite. A healthcare-security vendor reported the figures from the CCM and KLAS study accurately: 93% of respondents were using third-party AI, and 63% described their approach as “developing” or “ad hoc.” But it then concluded that slightly more than two-thirds of providers know how to govern AI.^[14] The data says close to the opposite. Somewhere along the way, what the report had called AI strategy also became governance,^[15] and a finding based on just 27 interviews was being treated as a picture of the whole industry.^[16]

The Validators. Validators sit at low incentive and high expertise, and the closest thing to one in this debate is the US federal government's hospital data. It's built on a weighted national survey and published by a government office with nothing to sell.^[17] Yet in our research, it was the source we saw quoted least. That's the central pattern the Ecosystem Map predicts: the more independent a source is, the quieter it tends to be.

Where Straven sits on the map

It would be unfair to map everyone else and leave ourselves out, so we hold Straven to the same two questions. What sets us apart is that we have no stake in any particular answer. We don't sell governance software, certification or assurance, which means we earn nothing more if your governance turns out to be broken, and nothing less if it turns out to be sound. Keeping that position is a choice we have to make every day.

What this means for a hospital

The lesson for any hospital leader is a practical one. The loudest governance statistics usually arrive with a solution already attached. The quietest and most independent data points to a much more specific gap: smaller and independent hospitals check the AI they use far less, and depend on their vendors far more.^[17]

That leaves one question hanging. How does a hospital build an independent check into its own buying decisions, when most of the evidence it's given comes from the people trying to sell to it? That's a separate conversation.

References