AI is no longer a side project.
It is now inside clinical notes, triage flows, authorizations and patient messages.
When AI shapes care or operations, it becomes auditable. Leaders must be able to explain what happened, who owned it, and what controls were in place.
This post gives hospital CEOs, COOs, CIOs and CTOs a clear control model for 2026, across Switzerland and the EU. It is built for real hospital life, not for a slide deck.
A lot of hospitals think they are “piloting AI.”
But AI is already there. It is often embedded in tools you already pay for. It appears as “smart” features, auto-summaries, decision support prompts and automated next steps.
That creates a gap.
Teams use AI every day. Leaders cannot always say where it runs, what data it uses, or what happens when it is wrong. That gap is where risk grows.
When this post says “AI,” it includes three buckets many hospitals already run.
[Existing image, keep in place: the three AI buckets inside hospitals]
If your team did not “buy an AI system,” but your vendor rolled out AI features, you still need governance.
BHM Healthcare Solutions is a US healthcare consulting firm that supports provider and payer organizations on strategy, operations and performance improvement. Their “2025 in Review” series shares what they are seeing across real-world AI deployments in healthcare.
BHM’s warning is simple: leaders approved AI as a narrow productivity helper.
In practice, it became part of the system. It moved into documentation, utilization analysis, coverage logic and admin workflows. That creates new dependencies and new failure modes.
BHM points to patterns leaders are now seeing:
Leadership test for 2026: stop measuring “how much AI you deployed.” Start measuring “how clearly you can explain and prove control.”
Most hospitals file AI governance under IT or legal. That is understandable, and it is the wrong place to start.
Digital transformation in healthcare has never been about installing tools. It is about changing who decides, who checks, and what happens when something goes wrong. AI simply makes that visible faster, because its errors look confident and its updates arrive without warning.
The World Health Organization made the same point in its 2021 guidance, Ethics and Governance of Artificial Intelligence for Health. Of its six guiding principles, several are about people and organizations rather than technology: protecting human autonomy, ensuring transparency, and fostering responsibility and accountability.
In practice, digital healthcare transformation succeeds when governance is designed into daily routines: the huddle where a nurse flags a strange discharge summary, the quality meeting where override rates are reviewed, the vendor call where an update is approved or refused.
That is why the control model below names people before it names tools.
The EU AI Act lays down rules for AI systems, including obligations for certain higher-risk uses. It includes requirements tied to governance, documentation and human oversight.
You do not need to be a lawyer to get the point.
If an AI system can affect health, safety, rights or access, you need to show control: clear roles, documented limits, monitoring, and the ability to investigate.
The European Commission states that the EHDS Regulation entered into force on 26 March 2025, starting a transition phase toward staged application.
EHDS matters because AI scale depends on data.
If you cannot show where data came from, what permissions apply, and how it moves across systems, you will struggle to scale AI safely. You will also struggle to defend it when questioned.
On 12 February 2025, the Swiss Federal Council said Switzerland intends to ratify the Council of Europe AI Convention and adapt Swiss law as needed. It also stated that work will continue on AI regulation in specific sectors, including healthcare.
Switzerland may not launch one single “Swiss AI Act” right away. Still, the direction is clear: international alignment, plus sector-led rules.
Switzerland’s revised data protection framework has applied since 1 September 2023. That affects real deployments today:
Leader translation: if AI touches patient data, you need purpose limits, access controls and privacy by design. You also need a transparency stance you can defend.
The Swiss Federal Office of Public Health notes that Switzerland revised its medical device rules in line with EU MDR and IVDR, raising safety and quality expectations.
In plain terms: if an AI tool functions as medical device software in your establishment, treat it like regulated tech. That means risk management, validation, change control, and documentation you can show under review.
DigiSanté aims to introduce standards, specifications and infrastructure to support seamless data exchange. It also points toward a secure Swiss health data space and responsible secondary use.
Even outside the EU, EU rules can still matter in practice when you:
The Swiss Federal Council also signals an intent to align internationally. That increases the chance that “EU-grade” governance becomes the default expectation in partnerships and procurement.
Many Swiss providers adopt EU-style governance because vendors, partners and patient flows pull them there.
Boards do not want buzzwords. They want proof of control. Here are the questions that matter.
The EU AI Act includes obligations for AI uses that fall into higher-risk categories. In healthcare, that can include tools that influence triage, decisions or patient-facing outputs.
What the board expects: a clear list of these use cases, named owners, and the controls in place.
EHDS entered into force on 26 March 2025 and moves through a transition phase toward staged application. The practical point is immediate: interoperability, permissions and traceable provenance are needed for safe scale and for defensible use.
What the board expects: data sources mapped per use case, clear permissions, and traceable provenance.
Swiss data protection has applied since 1 September 2023. That shapes what you can do right now with patient data and AI-enabled workflows.
What the board expects: purpose limits, access controls, and a transparency stance that can be explained simply.
If an AI tool functions as medical device software in your setting, it needs stronger controls. Validation, risk management and change control are central.
What the board expects: clear classification thinking, and proof that higher assurance applies where needed.
You do not need a complex framework to begin.
Start with four tiers. Use them to decide what to govern first.
[Existing image, keep in place: the four risk tiers]
Rule of thumb: Tier 1 and Tier 2 must have named owners, written rules of use, monitoring, and an evidence pack ready.
Plan for common failures, not rare edge cases. These are the ones leaders should expect early:
If AI touches patient communication, documentation or triage, these failures become clinical and reputational risk, not just tech bugs.
This plan is built to fit hospital reality. It focuses on Tier 1 and Tier 2 first.
Output you want by day 30: one list that is complete enough to defend.
For Tier 1 and Tier 2, assign named owners for:
Also document who holds final decision accountability when humans and AI interact.
Output you want by day 45: a one-page ownership map.
For each tool, write one page covering:
Output you want by day 60: rules of use for your highest-risk tools.
Output you want by day 75: one simple dashboard and a review cadence.
Output you want by day 90: a runbook, plus one tabletop drill.
For Tier 1 and Tier 2 tools, ask vendors for their purpose and limits, update cadence, monitoring approach, and support for audit logs and investigations. Add contract language for change management, security duties and data processing roles.
Also confirm whether the use case could be medical device software in your context, and apply higher assurance where needed.
This aligns with the EHDS direction on data governance and reuse, and with Swiss work aimed at better exchange.
If someone asks you to “prove control,” you should be able to show:
Want this under control in 90 days? Let’s run an AI Governance Sprint built for hospitals, not theory.
In two to three working sessions, we will deliver:
Share the five AI use cases you worry about most. I’ll translate them into a practical sprint scope, with owners, checkpoints and a clear first set of controls: https://www.beez-consulting.com/contact
Anything that generates, predicts, recommends or triggers automated next steps inside hospital workflows. That includes generative AI drafting discharge instructions or patient messages, machine learning models producing risk scores or prioritization, and AI features embedded by vendors in the EHR, coding, scheduling or call centre tools. Rule of thumb: if a feature can influence care, access, documentation or patient-facing content, put it in the AI register.
Yes. Many hospitals already run AI because vendors ship it inside tools they pay for, as auto-summaries, prompts, coding helpers or workflow automation. Governance is not about what you purchased. It is about what influences decisions and outputs in your environment. If leaders cannot say where AI runs, what data it uses and what happens when it is wrong, risk grows quickly.
AI governance is part of digital transformation, not a separate compliance task. Digital healthcare transformation changes who decides, who checks and what happens when something goes wrong, and AI makes those questions urgent because its errors look confident. Hospitals that treat governance as an IT or legal file tend to miss the organizational side: named owners, review routines and escalation paths built into daily work.
Use a simple tier model and start with the top two tiers: tools that face patients or influence clinical decisions, and tools that direct workflows or carry financial weight. For those, do four things first: name owners, write one-page rules of use, set up monitoring, and prepare the evidence pack. Lower tiers can follow once these are under control.
A proof-of-control pack you can pull up in one meeting: an AI register with tiers, named owners, rules of use for the highest-risk tools, validation records, a monitoring dashboard with review notes, audit logs, an incident response runbook with one drill record, vendor change approvals, a medical device classification stance where relevant, and data mapping for the main use cases.
By building AI control into routines that already exist rather than creating a new bureaucracy. Use a standard one-page rules-of-use template, review three to five indicators on a fixed cadence, route AI incidents through the existing quality and safety process, and require vendors to support logging, investigation and change control. Innovation keeps moving, and risk stays visible.
EU rules can matter in practice when a Swiss hospital uses AI systems placed on the EU market by its vendors, serves EU patients or partners, takes part in EU research or data reuse networks, or operates sites and contracts inside EU countries. Even where they are not strictly required, many Swiss providers adopt EU-grade governance because vendors, partners and patient flows pull them there.
The European Health Data Space is an EU regulation that entered into force on 26 March 2025, with staged application over the following years. It sets rules for sharing and reusing health data. It matters for AI because AI depends on data: hospitals that cannot show where their data comes from, what permissions apply and how it moves will struggle to scale AI safely or defend it.
The early failures are usually ordinary rather than spectacular: wrong discharge or follow-up instructions, medication advice errors, documentation that smooths over uncertainty, staff trusting confident outputs too quickly, and silent drift in accuracy after updates. When AI touches patient communication, notes or triage, these become clinical and reputational risks, so they need monitoring and a clear escalation route.
Ownership is shared, but accountability must be named for each high-risk tool. A workable split is a clinical owner for safety and appropriateness, an operational owner for performance and continuity, a privacy and security owner for data protection and vendor risk, and an assurance owner for validation, monitoring and audit readiness. If you cannot name the owner in ten seconds, governance is not yet in place.
.png)
Change management in healthcare: the 2025-2026 reports list every lever. None says who translates the strategy in the units, or how to prepare them.
Agile in healthcare works when teams, not tools, change. What agile really means for hospitals, why implementation stalls, and 6 practical steps.
Development isn't decided once a year. What a development conversation contains, why it so rarely happens, and what actually builds capability at work.
