What the board should know, and ask, about AI this quarter

The 2027 Agenda

Eight developments will reach most health and life sciences boards in 2027. Each raises a question the board should be ready to answer.

1. AI use is running ahead of governance. Eighty-eight percent of health systems use AI internally, but only 18 percent have mature governance and a fully formed AI strategy (HFMA, 2025). For the board: Are AI approvals arriving with conditions, or only with savings estimates?

2. State AI laws take effect on January 1, 2027. Colorado replaced its AI Act with a narrower law, S.B. 26-189, effective January 1, 2027, which largely exempts HIPAA-covered entities but keeps a patient notice duty (Ropes and Gray, 2026). States enacted at least six laws in 2026 restricting AI use by health insurers (Tech Policy Press, 2026). For the board: Which state rules apply to each deployment, and on what date?

3. Federal preemption remains unresolved. The Department of Justice joined a challenge to Colorado's 2024 law (Jenner and Block, 2026); no court has settled the question. For the board: Is the organization complying with state law as written, rather than waiting?

4. Medicare now uses AI in prior authorization. The CMS WISeR model began on January 15, 2026 in six states, and the Government Accountability Office found in May 2026 that it is a rule subject to congressional review (Georgetown CHIR, 2026). For the board: How does our own use of AI in coverage and claims decisions compare with what regulators now expect?

5. The Joint Commission now certifies responsible AI use. Its voluntary Responsible Use of AI in Healthcare certification opened on June 1, 2026 (Health System CIO, 2026). For the board: Will the organization pursue certification, and who owns the decision?

6. AI oversight is a board duty under Caremark. Commentators now treat AI governance as part of the directors' duty of oversight, and the standard is procedural (The D&O Diary, 2026). For the board: What will the minutes show?

7. The HIPAA Security Rule overhaul is targeted for July 2027. The final rule missed its May 2026 target and is not yet final (Alston and Bird, 2026). For the board: Has each AI vendor been mapped against the coming requirements?

8. The EU delayed its high-risk AI obligations. They now apply from December 2, 2027 for standalone systems and August 2, 2028 for AI in regulated products, including medical devices (Hunton, 2026). For the board: If we operate in Europe, are our plans built to the new dates?

Each development has a fuller entry in the AI Governance Navigator.