A Director's Heat Map

Do not try to boil the ocean. A heat map turns broad concern about artificial intelligence into precise oversight, and the right map depends on whether the board governs a health system, a device maker, a drug developer, or a health plan.

In Brief

The Problem. Artificial intelligence (AI) touches every responsibility of the board, and many boards respond by treating every AI question with equal urgency. A minor compliance question then receives the same attention as a threat to patient safety.

Why It Persists. Boards lack a shared method for deciding where AI matters most, and general advice on AI oversight rarely distinguishes a hospital from a device maker, a drug developer, or a health plan. Without a method, the agenda follows whatever is newest or easiest to discuss, and the highest-impact duties can go without a standing report.

What Boards Should Do. Rate each of twelve board duties by how much AI changes it in your sector, add one point to disclosure and to board composition if the organization is publicly traded, assign each duty to its natural committee, give the highest-rated duties a standing report and a named accountable executive, and refresh the ratings each year.

A board's most valuable asset is not its capital. It is its attention. In the age of AI, that asset is under strain. Faced with a long list of technical, ethical, and strategic questions, many boards are unsure where to focus. The result is often reactive governance, in which a minor compliance risk receives the same urgency as an existential threat.

The need is not hypothetical. In the PwC 2026 survey of about 600 public company directors, 60 percent said AI is not yet part of board oversight (Gaskin, 2026). An effective board will be distinguished not by its ability to understand everything about AI, but by its discipline in prioritizing what matters.

My argument is that this discipline has to be specific to the business the board governs. The same duty can call for a standing report at every meeting in one sector and an annual review in another. A board that borrows a generic map will spend its attention in the wrong places.

An AI Impact Assessment for the Board

What is needed is an AI impact assessment of the board's own responsibilities. A heat map allows a board to allocate its finite time and expertise with precision. It shows that while AI touches every part of the enterprise, its impact is far from uniform across the duties of the board, and far from uniform across sectors. The map below rates twelve board duties on a scale of one to five for four profiles: health systems and providers, medical device and diagnostics companies, pharmaceutical and biotechnology companies, and health plans and payers. Each duty is assigned to the committee that would naturally own it. We rate device makers and drug developers separately because AI reaches them through different regulatory paths. For a device maker, the AI is often the regulated product. For a drug developer, AI shapes the evidence and processes behind the product.

How We Built This Map

The ratings are Avancer's assessment, made by its principals and drawn from our board and executive experience and from the legal and regulatory record as of October 2026. We rated each duty, in each profile, on three tests: how directly AI affects patients, products, and the organization's mission in that area; the legal and regulatory exposure the duty carries; and how fast that exposure is changing. Each test is scored from one to five, the three tests carry equal weight, and the rating shown is their average, rounded to the nearest whole number. We did not move any rating away from that average.

No published research yet gives statistically significant, predictive weights for these duties by sector, ownership, or size. No study we found has modeled which board duties predict AI-related harm, loss, or enforcement, and none has tested whether one of our three tests matters more than another. The evidence that does exist is of three kinds: base rates, such as counts of breaches, recalls, and lawsuits; a small number of studies that report associations; and regulatory designations. Where that evidence supports the direction of a rating, we cite it beside the rating as an evidence note. It is consistent with those ratings; it does not predict which organization will suffer harm. The ratings therefore remain our practitioner assessment on equal weights.

Most ratings also rest on legal and regulatory sources we opened and checked in October 2026. Three rest on our judgment alone and are marked in the table. Each board should calibrate the map to its own organization, and the readiness assessment in the Avancer AI Governance Navigator is one place to begin.

The Map

Duty	Natural Committee	Health Systems and Providers	Medical Device and Diagnostics Companies	Pharmaceutical and Biotechnology Companies	Health Plans and Payers
Strategy and the AI Portfolio	Full board	4	4	4	4
Patient and Product Safety	Quality and safety committee	5	5	4	4
Ethics, Fairness, and Equity	Quality committee or full board	4	3	3	5
Data Protection and Privacy	Audit or risk committee	4	4	4	4
Cybersecurity and Third-Party Risk	Audit or risk committee	5	5	4	4
Regulatory Compliance and Risk Supervision	Compliance or risk committee	5	5	4	5
Regulatory Strategy and Engagement	Full board	3	4	4	4
Quality Systems and Model Monitoring	Quality committee	4	5	4	3
Financial Reporting, Disclosure, and Controls	Audit committee	3 (public 4)	4 (public 5)	4 (public 5)	4 (public 5)
Transactions, Partnerships, and Licensing	Full board or finance committee	3	4 (Avancer judgment)	4 (Avancer judgment)	3 (Avancer judgment)
Talent, Workforce, and Executive Incentives	Compensation committee	4	3	3	4
Board Composition, Education, and Succession	Nominating and governance committee	3 (public 4)	3 (public 4)	3 (public 4)	3 (public 4)

Ratings for Financial Reporting, Disclosure, and Controls and for Board Composition, Education, and Succession describe an organization without publicly traded securities. The figure marked "public" applies to a publicly traded organization, as explained in the section on public companies below.

Evidence Notes Beside the Ratings

• Cybersecurity and Third-Party Risk, providers, rated five. Base rate: healthcare providers filed 529 of the 725 breach reports of 500 or more records made to the Office for Civil Rights at the Department of Health and Human Services (HHS) in 2024, or 73 percent, and 30 percent of those breaches occurred at business associates (Alder, 2025). The counts reflect how many providers there are, so they are not a rate per organization. The consequences reach patients: in a study of 3,025 hospitals from 2012 to 2016, time to electrocardiogram rose by as much as 2.7 minutes, and 30-day mortality after a heart attack by as much as 0.36 percentage points, in the three years after a breach, which the authors associate with remediation efforts (Choi et al., 2019).
• Quality Systems and Model Monitoring, device makers, rated five. Base rate: of 182 recall events among AI-enabled devices cleared by the Food and Drug Administration (FDA), 79 (43.4 percent) occurred within 12 months of clearance, approximately double the rate reported for all devices cleared through the 510(k) pathway (Lee et al., 2025).
• Patient and Product Safety, device makers, rated five. Association: in the same study of 950 devices, lack of reported clinical validation (odds ratio 2.8) and public company status (odds ratio 5.9) were each independently associated with recall (Lee et al., 2025). This is one cross-sectional study, and we cite it as an association, not a prediction.
• Quality Systems and Model Monitoring, providers, rated four. Base rate and association: in a survey of 2,425 hospitals, 65 percent used predictive models; 61 percent of those hospitals evaluated the models locally for accuracy, and 44 percent for bias. Health system members and hospitals with high operating margins were more likely to evaluate (Nong et al., 2025).
• Ethics, Fairness, and Equity, health plans, rated five. Regulatory designation: the European Union AI Act lists AI systems intended for risk assessment and pricing of individuals in life and health insurance as high risk, in Annex III (Regulation (EU) 2024/1689, 2024).
• Regulatory Compliance and Risk Supervision, health plans, rated five. Litigation record: in the UnitedHealth coverage denial case, claims for breach of contract and of the implied covenant of good faith and fair dealing are proceeding over the alleged use of the nH Predict tool, and in March 2026 the court ordered broad discovery (Greenberg et al., 2026).
• Financial Reporting, Disclosure, and Controls, publicly traded companies. Base rate: Cornerstone Research and the Stanford Securities Class Action Clearinghouse counted seven AI-related securities class actions in 2023 and 15 in 2024 (Edwards, 2025). Cornerstone counted 16 in 2025, when AI cases were eight percent of filings but 57 percent of the Maximum Dollar Loss Index (Brien et al., 2026).

Three features of the map stand out. First, no duty rates below three in any profile. As of October 2026, AI has reached far enough into health care that every one of these duties warrants at least an annual review. Second, no duty rates five in all four profiles. Regulatory Compliance and Risk Supervision comes closest, at five for providers, device makers, and health plans and four for drug developers. Third, the profiles diverge most on ethics and on quality systems, where the same duty moves two full points from one sector to another.

Where the Profiles Agree

Strategy and the AI Portfolio. Strategy rates four in every profile. AI changes where the organization creates value and which investments it funds. For device makers, AI is increasingly the product itself: the FDA list of AI-enabled devices held 1,247 devices as of July 10, 2025, 77 percent of them authorized by the radiology panel (Lenz, 2025). In drug development, the first candidates discovered and designed with AI are reaching late-stage trials. In July 2026, Insilico Medicine announced the launch of a 52-week, 320-patient Phase III trial of rentosertib for idiopathic pulmonary fibrosis, with approval projected for 2030 (Proffitt, 2026). Among health plans, CVS Health and Aetna plan to spend USD 20 billion on AI over ten years, according to Aetna's chief digital and technology officer (Morse, 2026). Among providers, 88 percent of health systems use AI internally, but only 18 percent report a mature governance structure and a fully formed AI strategy (Healthcare Financial Management Association, 2025). The rating stops at four rather than five because the legal exposure attached to strategy itself is moderate. Choices about which programs to fund still carry the longest consequences, and they belong with the full board.

Data Protection and Privacy. This duty also rates four in every profile. Providers and plans hold sensitive health data under heavy existing law, but the pace of change is moderate, because the Office for Civil Rights has delayed the final Health Insurance Portability and Accountability Act (HIPAA) Security Rule to a July 2027 target (Everett et al., 2026). Much of the exposure sits outside approved channels. In a September 2026 survey sponsored by Imprivata, 72 percent of healthcare respondents said AI tools are deployed without approval from information technology at least occasionally (Hughes, 2026). For device makers in Europe, guidance from the Medical Device Coordination Group (MDCG 2025-6) requires AI medical devices to document data sources, labeling, and traceability across the AI lifecycle in a single technical file (Sobande, 2025). For drug developers, the guiding principles that the FDA and the European Medicines Agency issued jointly in January 2026 emphasize good data governance and documentation when AI is used (Al-Faruque, 2026).

Board Composition, Education, and Succession. This duty rates three in every profile, and four for a publicly traded organization. The board can oversee AI only as well as its members, and the executives it selects, understand it. Only 32 percent of hospital boards require continuing education (Condon, 2026), and disclosed AI expertise among S&P 500 directors rose only from 1.5 percent in 2021 to 2.7 percent in 2025 (The Conference Board, 2026). Since January 2023, officers of Delaware corporations also carry their own oversight duty within their areas of responsibility (Raymond et al., 2023). A successor's ability to oversee AI is now part of the job description, even though the judgment and relationships at the center of succession remain human. The base rating is three because the direct effect on patients and the legal exposure are moderate. The work is steady, and the nominating and governance committee can carry it on an annual cycle.

Where the Profiles Differ Most, and Why

Two duties move by two full points between sectors. In each case, the difference follows from who makes the decision that AI informs and which regulator watches it.

Ethics, Fairness, and Equity: four for providers, three for device makers and drug developers, five for health plans. Bias in a model that allocates care, screens trial candidates, or prices coverage is now a legal matter as well as an ethical one. For health plans, fairness in coverage decisions is the most active area of AI litigation and state legislation. In Barrows v. Humana, the court allowed a fraud claim to proceed based on the alleged omission that Humana uses AI for coverage decisions, and a class certification motion is due on November 5, 2026 (O'Neill Institute for National and Global Health Law, n.d.). The state laws on insurer use of AI enacted in 2026 add to that exposure (Brennen, 2026). In Europe, AI used to assess risk and set prices in health insurance is designated high risk (Regulation (EU) 2024/1689, 2024).

Providers carry explicit duties of their own. California's Senate Bill 503, effective January 1, 2027, requires developers and deployers of clinical decision support to identify tools that could produce biased results, and requires deployers to monitor them (Montano & Tran, 2026). The federal Section 1557 rule required covered entities to review patient care decision support tools for potential bias by May 1, 2025, although its long-term enforcement is uncertain (Pressly & Leeds, 2025).

Device makers meet the duty as developers. Senate Bill 503 places documentation duties on developers of clinical decision support, not only on deployers (Montano & Tran, 2026). For AI medical devices under the European Union AI Act, data sets must be representative, relevant, and appropriately pre-processed to reduce bias (Sobande, 2025). Drug developers meet it in trial design and in models built on patient data, and the joint FDA and European Medicines Agency principles state that AI should be designed on ethical and human-centric values (Al-Faruque, 2026). For both, the exposure is real, but it is narrower and moving more slowly than for the organizations that decide who receives care or coverage.

Quality Systems and Model Monitoring: four for providers and drug developers, five for device makers, three for health plans. AI models drift after deployment, so quality systems must measure performance, incidents, and changes over time. For device makers, monitoring and change control are already regulatory requirements, and the quality system is where AI compliance is proven. The FDA finalized its guidance on predetermined change control plans for AI-enabled device software on December 4, 2024. A plan lets a manufacturer make pre-authorized changes, provided it states how each change will be validated and monitored (Organ et al., 2025). In Europe, continuous performance monitoring and secure update mechanisms are expected after an AI device reaches the market (Sobande, 2025). The recall record described in the evidence notes shows why the rating is five.

Drug developers face the same expectation in draft form. The FDA's January 2025 draft guidance on AI used to support regulatory decisions for drugs and biological products states that model performance should be monitored on an ongoing basis so that the model remains fit for use (U.S. Food and Drug Administration, 2025). Because that expectation sits in draft guidance rather than in a device quality regime, we rate the duty one point lower for drug developers; that one-point difference is our judgment.

Providers face accreditation expectations rather than product rules. Guidance from the Joint Commission and the Coalition for Health AI (CHAI) treats AI tools as systems that need continuous oversight, including validation before deployment and tracking of performance (Polsinelli, 2025). Few providers have mature systems to meet that expectation; only 18 percent of health systems report a mature AI governance structure and strategy (Healthcare Financial Management Association, 2025), and fewer than half of hospitals that use predictive models evaluate them locally for bias (Nong et al., 2025). Health plans have no plan-specific quality regime for AI, which holds the rating at three. Their monitoring records still matter, because others can now read them. In the UnitedHealth coverage denial case, the court ordered production of internal AI review board materials, including the identities of board members (Greenberg et al., 2026).

Where the Profiles Differ by One Point

Seven more duties differ by a single point. A single point still matters, because it can move a duty from a quarterly committee review to a standing report at every meeting.

Patient and Product Safety: five for providers and device makers, four for drug developers and health plans. AI is already at the bedside. The American Medical Association reported in March 2026 that 81 percent of physicians use AI in their practices, up from 38 percent in 2023 (American Medical Association, 2026). California's Assembly Bill 1979, effective January 1, 2027, requires a licensed provider to exercise independent judgment when AI informs care (Montano & Tran, 2026). For device makers, the AI is part of a regulated product, and a model error is a product failure. The FDA revised its clinical decision support and general wellness guidances in January 2026, changing which software functions it regulates as devices (Habtemariam et al., 2026). For drug developers, AI is not the product. It affects safety through the data behind decisions: the FDA's draft guidance covers AI used to produce information on safety, effectiveness, or quality across the nonclinical, clinical, postmarketing, and manufacturing phases, and proposes a risk-based framework for judging whether a model is credible for its intended use (U.S. Food and Drug Administration, 2025). We rate that exposure one point below the device profile, as a matter of judgment. Coverage algorithms affect access to care rather than delivering it, which places health plans at four as well. States now treat AI-driven denials as a question of patient harm. Washington's 2026 law allows AI to approve prior authorizations but not to deny them without a health professional's review (Casolo, 2026).

Cybersecurity and Third-Party Risk: five for providers and device makers, four for drug developers and health plans. AI widens the attack surface through vendors and agents, and it accelerates the attacks themselves. The Health Information Sharing and Analysis Center (Health-ISAC) described autonomous AI tools that can find and exploit vulnerabilities as a systemic shift in risk for the health sector, expected to proliferate by mid to late 2026 (Annaloro, 2026). Healthcare leaders rank cyber threats as the top short-term risk, with third-party vulnerabilities third (Protiviti, n.d.). The threat is shared across all four profiles. For providers, the breach record and its effect on patients, described in the evidence notes, carry the rating to five. Device makers face their own statutory obligation: Section 524B of the Federal Food, Drug, and Cosmetic Act imposes cybersecurity requirements on cyber devices throughout their lifecycle, and noncompliance may lead to False Claims Act enforcement (Seeley et al., 2025). That obligation carries device makers to five. Drug developers and health plans face the same threats without a device statute, which holds them at four.

Regulatory Compliance and Risk Supervision: five for providers, device makers, and health plans, four for drug developers. Compliance is common ground because the rules are arriving on different calendars for everyone. Colorado's rewritten AI law takes effect on January 1, 2027, and requires covered health entities to give patients a general notice of their use of advanced technology (Darch et al., 2026). The European Union has set December 2, 2027, and August 2, 2028, for its high-risk obligations (Hunton Andrews Kurth, 2026), and AI medical devices that are high risk under the AI Act follow a single conformity assessment under the medical device rules, with added AI requirements (Sobande, 2025). Health plans are the most direct target: states enacted at least six new laws in 2026 restricting the use of AI by health insurers (Brennen, 2026), and coverage denial litigation is proceeding to discovery, as the evidence notes describe. Delaware courts also expect a board-level system for mission-critical compliance. In September 2025, the Court of Chancery let oversight claims proceed against directors of the drug maker Teligent. The complaint alleged that no board committee was responsible for compliance with FDA requirements (Bonadurer, 2026). FDA compliance is mission-critical for drug developers, but the AI-specific rules for drug development remain draft guidance and principles with no binding force (U.S. Food and Drug Administration, 2025), which in our judgment places the AI dimension of this duty one point lower. A board that has not yet assigned AI compliance to a named committee should start here.

Regulatory Strategy and Engagement: three for providers, four for device makers, drug developers, and health plans. This duty concerns the organization's long-term position on emerging rules and how it engages with regulators. For device makers and drug developers, the rules are still being written. The FDA's January 2025 guidance on AI used to support regulatory decisions for drugs and biological products remains a draft (U.S. Food and Drug Administration, 2025). On January 14, 2026, the agency and the European Medicines Agency jointly issued ten guiding principles for AI in drug development (Al-Faruque, 2026). The January 2026 revision of the clinical decision support guidance changed which software the FDA regulates as a device (Habtemariam et al., 2026). For health plans, federal policy that relies on AI is itself contested. The WISeR model of the Centers for Medicare and Medicaid Services, which adds AI-assisted prior authorization to traditional Medicare in six states, began on January 15, 2026. The Government Accountability Office found on May 12, 2026, that the model is a rule, and resolutions to repeal it were introduced on May 20, 2026 (Patil, 2026). Providers need a position as well, as federal health technology policy moves toward deregulation. The proposed HTI-5 rule from the Office of the National Coordinator for Health Information Technology would remove the requirement for developers to supply source attributes for decision support and to apply certain risk management practices for predictive tools (Covington and Burling, 2026). A December 2025 executive order created a Department of Justice AI Litigation Task Force to challenge state AI laws and named Colorado's AI Act (Ghavi et al., 2025). The direct exposure for providers is moderate, which holds their rating at three.

Financial Reporting, Disclosure, and Controls: three for providers, four for device makers, drug developers, and health plans, with one point more for a public company. Statements about AI capability, and AI used inside financial processes, must be accurate and covered by internal controls. The share of S&P 500 companies disclosing AI as a risk rose from 12 percent in 2023 to 83 percent in 2025 (The Conference Board, 2026), and AI-related securities class actions have risen each year since 2023, as the evidence notes show. For health plans, an undisclosed use of AI in coverage decisions has already supported a fraud theory in Barrows v. Humana (O'Neill Institute for National and Global Health Law, n.d.). For providers, the exposure centers on accurate claims about AI rather than on securities disclosure. Statements about the organization's own AI capabilities are not routine communications, and they belong under this duty. In September 2024, the Texas Attorney General reached a settlement with Pieces Technologies over allegedly inaccurate claims to hospitals about the error rate of its clinical documentation software (Johnson et al., 2024).

Talent, Workforce, and Executive Incentives: four for providers and health plans, three for device makers and drug developers. An organization cannot lead in AI without the right people, and it cannot govern what it cannot build, buy, or evaluate. The workforce is already changing. Half of the healthcare organizations in a September 2026 study had cut headcount as a direct result of AI or planned to within six months (Guerra & Kraus, 2026). CoxHealth eliminated 53 revenue cycle roles, citing strategic advances in technology, mainly in manual coding data entry (Cass, 2026). California's Senate Bill 947, effective July 1, 2027, bars employers from disciplining or firing workers based solely on automated decision systems (Montano & Tran, 2026). For health plans, incentives now enter AI oversight directly. The court in the UnitedHealth case ordered production of performance reviews and compensation data for care coordinators and medical directors working on post-acute claims (Greenberg et al., 2026). Drug and biotechnology companies have begun to tie executive pay to AI goals; Recursion Pharmaceuticals weighted an AI goal at about 16.7 percent of its annual incentive program (Batish, 2026). The legal exposure for device makers and drug developers remains limited, which holds their rating at three.

Transactions, Partnerships, and Licensing: three for providers and health plans, four for device makers and drug developers. AI changes what an acquisition, partnership, or vendor contract is worth and who carries the liability when a model fails. Most provider AI is bought rather than built, so vendor terms and deal diligence matter. The CHAI governance playbooks include third-party management, covering vendor compliance audits and clear liability boundaries for commercial software (Pennic, 2026). Disclosed healthcare buyout value fell to USD 51 billion in the first half of 2026 from about USD 60 billion a year earlier, with AI disruption cited as a contributing pressure (Mendoza, 2026). The device, drug developer, and health plan ratings for this duty are the three that rest on our judgment alone. For device makers and drug developers, software and data partnerships, discovery collaborations, and platform acquisitions increasingly determine product and pipeline value, although no single legal development drives the rating. For health plans, which license AI for claims and utilization review, we identified no exposure specific to plan transactions.

Public Companies: One Point Higher on Two Duties

Ownership changes the exposure on two duties, and only on those two do we adjust the rating. For an organization with publicly traded securities, add one point, up to a maximum of five, to Financial Reporting, Disclosure, and Controls and to Board Composition, Education, and Succession.

The first adjustment follows from who can sue. Securities class actions over statements about AI are available only against issuers, and their number has grown from seven in 2023 to 15 in 2024 and 16 in 2025 (Edwards, 2025; Brien et al., 2026). The second follows from who can vote. Under its 2025 benchmark policy for United States public companies, the proxy advisor Glass Lewis expects companies to disclose the board's role in overseeing AI, and where insufficient oversight of AI has caused material harm to shareholders, it may recommend voting against the responsible directors (Gunderson Dettmer, 2024). That consequence for board composition does not reach a board without public shareholders. The evidence supports the direction of both adjustments; the size of one point is our judgment. No other duty changes with ownership in this edition.

The Strongest Objection: A Ranked Map Invites Neglect

The most serious objection to a heat map is that it tells directors where not to look. AI failures do not respect a ranking. A tool approved for a low-risk use can drift into a high-risk one, and an unapproved tool can appear in an area the board rated low. The Imprivata finding on unapproved deployments is a reminder that much AI enters an organization without anyone rating it at all (Hughes, 2026).

The objection is fair, and the answer is in how the map is used. The map allocates the board's time. It does not remove any duty. Every rating carries an owner and a schedule, and in this edition the lowest rating is three, which still earns an annual review. A map that is written down, refreshed, and recorded in the minutes is easier to challenge and correct than a set of unstated priorities.

Using the Map

The heat map changes how a board builds its agenda. A duty rated five receives a standing report at every meeting. A duty rated four receives a review by its natural committee each quarter. A duty rated three receives an annual review. A duty rated one or two is revisited when the map itself is refreshed. The same duty can land in different places for different boards. A health plan board would hear a standing report on ethics, fairness, and equity at every meeting, while the board of a device maker would review the same duty once a year and give quality systems and model monitoring the standing time instead.

The map should be refreshed each year, because the impact of AI moves. A tool that drafts letters today may make coverage recommendations next year, and its rating should move with it. In my experience, the time a board spends on a topic tends to follow how easy the topic is to discuss. The map corrects for that. An interactive version of this map, by profile and by committee, is coming to the Avancer AI Governance Navigator.

Exposure and Maturity Together

The map rates exposure: how much AI changes a duty for your kind of organization. It does not tell a board how well its own organization governs that duty today. That is a second question, and I keep it separate on purpose. A board with strong controls over patient safety still needs patient safety in front of it at every meeting. Averaging exposure and maturity would quietly lower the priority of the duties that matter most.

For maturity, I use the five levels of the Board-Level AI Maturity Assessment in my forthcoming book, The Steward’s AI Mandate, the same levels the AI Governance Navigator readiness assessment uses. Each level describes something a director can see:

• Initial. AI use in the area is not inventoried, no one owns it, and no document describes how it is governed.
• Developing. Uses are inventoried and an owner is named, but practice is informal and inconsistent.
• Defined. A board-approved policy or framework, risk tiering, and committee minutes show the area is governed by design.
• Managed. Objectives are measured and reported to the responsible committee on a schedule, the controls are audited or independently reviewed, and at least one finding has been raised and closed.
• Optimized. Governance in the area improves itself from experience and is a recognized source of advantage.

Read the two ratings together. Exposure sets how often the board looks at a duty. The gap between exposure and maturity sets what the board asks management to fix first:

• Act now. Exposure of four or five with maturity at Initial or Developing. Ask management for a remediation plan with an owner and a date.
• Strengthen. Exposure of four or five with maturity at Defined. The design exists; ask for measurement, committee reporting, and independent review.
• Sustain. Exposure of four or five with maturity at Managed or Optimized. Keep the standing oversight and ask for evidence the controls keep working.
• Plan or monitor. Exposure of three or lower. Address low maturity through the annual review, and revisit the rest when the map is refreshed.

Maturity is the board’s own assessment, and self-assessments tend to run high. I ask boards to rate a duty at Managed only when they have seen the committee report and the review finding, not when management says they exist.

How Avancer Will Build the Evidence

Because the research does not yet support statistical weights, we intend to build the evidence ourselves, in three ways.

• An annual panel of directors. Each year, a structured panel of directors drawn from all four profiles will rate every duty independently. We will compare their ratings, share the results with the panel, refine the ratings where views converge, and report both the agreement and the dissent.
• Annual recalibration against public data. Each year, we will compare the ratings with public records of data breaches reported to HHS, FDA device recalls, and enforcement actions and securities filings, and we will record whether each change in that record moved a rating.
• Calibrations from boards that use the map. With users' consent, we will aggregate the calibrations that boards make when they use the map in the AI Governance Navigator, so that our ratings can be compared with the ratings boards give themselves in each sector.

By using such a heat map, a board can transform its AI governance. The conversation shifts from "What should we do about AI?" to a focused one. Are we dedicating our prime attention to the duties rated five for our sector, and do we have credible plans for the rest? That discipline allows directors to concentrate their oversight where it can make the difference between success and failure.

For the Board

• Have we rated our own duties by AI impact for our sector, or are we treating every AI question with equal urgency?
• If we are publicly traded, have we added the point for disclosure and for board composition?
• Which duties rated five in our profile lack a standing report and a named accountable executive?
• Which committee owns each duty rated four, and does it review that duty each quarter?
• Which board committee is responsible for AI compliance, and how does it report to the full board?
• Who reviews our public statements about AI capabilities before they are made?
• When did we last refresh the map, and what moved?
• For each duty rated four or five, what is our maturity level today, and what evidence did we see to support it?

Calibrate the map to your organization with the readiness assessment and the question sets for each board seat in the Avancer AI Governance Navigator.

References

Al-Faruque, F. (2026, January 14). EMA, FDA issue joint AI guiding principles for drug developers. Regulatory Affairs Professionals Society. https://www.raps.org/resource/ema-fda-issue-joint-ai-guiding-principles-for-drug.html

Alder, S. (2025, January 30). 2024 healthcare data breach report. The HIPAA Journal. https://www.hipaajournal.com/2024-healthcare-data-breach-report/

American Medical Association. (2026, March 12). AMA: AI usage among doctors doubles as confidence in technology grows [Press release]. https://ama-assn.org/press-center/ama-press-releases/ama-ai-usage-among-doctors-doubles-confidence-technology-grows

Annaloro, J. (2026, May 12). Claude Mythos and its health sector implications. Health-ISAC. https://health-isac.org/claude-mythos-and-its-health-sector-implications/

Batish, A. (2026, March 2). AI as a performance metric: What companies are disclosing now. Harvard Law School Forum on Corporate Governance. https://corpgov.law.harvard.edu/2026/03/02/ai-as-a-performance-metric-what-companies-are-disclosing-now/

Bonadurer, J. (2026, February). Delaware court denies dismissal of Caremark oversight claims in Teligent case, highlighting board and officer compliance obligations. Jenner and Block. https://www.jenner.com/en/news-insights/publications/delaware-court-denies-dismissal-of-caremark-oversight-claims-in-teligent-case-highlighting-board-and-officer-compliance-obligations

Brennen, S. B. (2026, July 6). Where state AI legislation stands half way into 2026. Tech Policy Press. https://techpolicy.press/where-state-ai-legislation-stands-half-way-into-2026

Brien, T., De Jarnette, B., French, B., & Wu, B. (2026, February 26). Securities class action trends in 2025: Fewer cases filed, but more dollars at stake. Cooley. https://sle.cooley.com/2026/02/26/securities-class-action-trends-in-2025-fewer-cases-filed-but-more-dollars-at-stake/

Casolo, E. (2026, April 10). 5 states reforming prior authorization in 2026. Becker's Payer Issues. https://www.beckerspayer.com/policy-updates/5-states-reforming-prior-authorization-in-2026/

Cass, A. (2026, July 23). 3 health systems cutting revenue cycle roles. Becker's Hospital Review. https://www.beckershospitalreview.com/finance/revenue-cycle-management/3-health-systems-cutting-revenue-cycle-roles/

Choi, S. J., Johnson, M. E., & Lehmann, C. U. (2019). Data breach remediation efforts and their implications for hospital quality. Health Services Research, 54(5), 971-980. https://doi.org/10.1111/1475-6773.13203

Condon, A. (2026, April 27). Health system governance is falling behind: 8 things to know. Becker's Hospital Review. https://www.beckershospitalreview.com/hospital-management-administration/health-system-governance-is-falling-behind-8-things-to-know/

Covington and Burling. (2026, January 15). HHS proposes changes to the Health IT Certification Program and information blocking regulations in HTI-5 proposed rule. https://www.covingtonblogs.com/2026/01/15/hhs-proposes-changes-to-the-health-it-certification-program-and-information-blocking-regulations-in-hti-5-proposed-rule/

Darch, J. E., Brooks, P., Daudi, S., Hinckley, D., & Kaye, A. (2026, May 19). Colorado scales back AI law, with targeted implications for health care. Ropes and Gray. https://www.ropesgray.com/en/insights/alerts/2026/05/colorado-scales-back-ai-law-with-targeted-implications-for-health-care

Edwards, B. (2025, January 30). AI-related filings drive increase in US securities class action lawsuits in 2024. Global Legal Post. https://www.globallegalpost.com/news/ai-related-filings-drive-increase-in-us-securities-class-action-lawsuits-in-2024-1979048413

Everett, J. C., Burnette, A. T., & Pike, J. (2026, July 10). HHS Office for Civil Rights delays final HIPAA Security Rule until 2027 as Privacy Rule changes near. Alston and Bird. https://www.alston.com/en/insights/publications/2026/07/hhs-delays-hipaa-security-rule-2027

Gaskin, J. L. (2026, September 23). Boards say they need more from management on AI. Corporate Compliance Insights. https://www.corporatecomplianceinsights.com/boards-say-they-need-more-from-management-ai/

Ghavi, A. R., Glucksman, H., & Katsuki, K. (2025, December 16). President Trump signs executive order challenging state AI laws. Paul Hastings. https://www.paulhastings.com/insights/client-alerts/president-trump-signs-executive-order-challenging-state-ai-laws

Greenberg, D. S., Heilman, K., & Shlaferman, H. Z. (2026, April 23). Federal court orders broad discovery against UHC in AI coverage denial lawsuit. ArentFox Schiff. https://www.afslaw.com/perspectives/alerts/federal-court-orders-broad-discovery-against-uhc-ai-coverage-denial-lawsuit

Guerra, S., & Kraus, S. (2026, September 30). The 2026 healthcare AI ROI scorecard. Bessemer Venture Partners. https://www.bvp.com/atlas/the-2026-healthcare-ai-roi-scorecard

Gunderson Dettmer. (2024, November 21). Glass Lewis releases 2025 benchmark policy updates. Public Ventures Blog. https://www.gunder.com/en/news-insights/blogs/public-ventures/glass-lewis-releases-2025-benchmark-policy-updates

Habtemariam, A., Desjardins, P. R., Temkin, E., Davar, M. V., Kracov, D. A., Dennis, C. W., & Trinh, J. (2026, January 21). FDA "cuts red tape" on clinical decision support software and wearable products for general wellness. Arnold and Porter. https://www.arnoldporter.com/en/perspectives/advisories/2026/01/fda-cuts-red-tape-on-clinical-decision-support-software

Healthcare Financial Management Association. (2025, August 14). Health system adoption of AI outpaces internal governance and strategy. https://www.hfma.org/health-system-adoption-of-ai-outpaces-internal-governance-and-strategy/

Hughes, J. (2026, September 17). Healthcare's agentic AI boom is outpacing governance: Report. Healthcare Dive. https://www.healthcaredive.com/news/healthcares-agentic-ai-boom-is-outpacing-security-governance-report/830697/

Hunton Andrews Kurth. (2026, July 28). EU Digital Omnibus on AI enters into force. Privacy and Cybersecurity Law Blog. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force

Johnson, T., Joseph, A., Sherer, J., Wolfington, A., Brodkin, E., & Jankowski, M. (2024, September 24). Texas Attorney General reaches novel generative AI settlement: What health tech companies need to know. Orrick. https://www.orrick.com/en/Insights/2024/09/Texas-Attorney-General-Reaches-Novel-Generative-AI-Settlement

Lee, B., Kramer, P., Sandri, S., Chanda, R., Favorito, C., Nasef, O., Ross, J. S., Sharfstein, J., & Dai, T. (2025). Early recalls and clinical validation gaps in artificial intelligence-enabled medical devices. JAMA Health Forum, 6(8), Article e253172. https://doi.org/10.1001/jamahealthforum.2025.3172

Lenz, A. R. (2025, July 29). FDA's latest lists for digital health technologies. FDA Law Blog. https://www.thefdalawblog.com/2025/07/fdas-latest-lists-for-digital-health-technologies/

Mendoza, C. (2026, August 27). Healthcare private equity weathers the SaaSpocalypse: Bain report. Private Equity International. https://www.privateequityinternational.com/healthcare-private-equity-weathers-the-saaspocalypse-bain-report/

Montano, M., & Tran, S. (2026, October 8). Newsom approves 3 health care AI bills, vetoes 2. California Health Care Foundation. https://chcf.org/blog/2026/10/08/newsom-approves-3-health-care-ai-bills-vetoes-2

Morse, S. (2026, May 28). The AI arms race in the revenue cycle. Healthcare Finance News. https://www.healthcarefinancenews.com/news/ai-arms-race-revenue-cycle

Nong, P., Adler-Milstein, J., Apathy, N. C., Holmgren, A. J., & Everson, J. (2025). Current use and evaluation of artificial intelligence and predictive models in US hospitals. Health Affairs, 44(1), 90-98. https://doi.org/10.1377/hlthaff.2024.00842

O'Neill Institute for National and Global Health Law. (n.d.). Artificial intelligence. Health Care Litigation Tracker, Georgetown University Law Center. Retrieved October 21, 2026, from https://litigationtracker.law.georgetown.edu/issues/artificial-intelligence-medicare-advantage

Organ, S. A., Beaver, N. A., & Rosen, D. L. (2025, January 6). AI-enabled device software functions: FDA's final guidance for predetermined change control plans. Foley and Lardner. https://www.foley.com/insights/publications/2025/01/fda-final-guidance-ai-device-software-predetermined-change-control-plan/

Patil, N. (2026, June 10). CMS's WISeR model faces potential repeal following GAO determination. Georgetown University Center on Health Insurance Reforms. https://medicare.chir.georgetown.edu/?p=985

Pennic, F. (2026, May 27). Coalition for Health AI (CHAI) launches in-depth governance playbooks for 100+ health systems. HIT Consultant. https://hitconsultant.net/2026/05/27/chai-launches-healthcare-ai-governance-playbooks/

Polsinelli. (2025, October 29). Joint Commission and Coalition for Health AI release first-of-its-kind guidance on responsible AI use in healthcare. https://www.polsinelli.com/publications/tjc-chai-release-guidance-responsible-ai-use-healthcare

Pressly, D. F., & Leeds, E. I. (2025, April 17). Section 1557: Deadlines approach, but long-term prognosis unclear under executive orders. Ballard Spahr. https://www.ballardspahr.com/insights/alerts-and-articles/2025/04/section-1557-deadlines-approach-but-long-term-prognosis-unclear-under-executive-orders

Proffitt, A. (2026, July 8). Insilico Medicine launches Phase III trial for AI-developed drug. Clinical Research News. https://www.clinicalresearchnewsonline.com/news/2026/07/08/insilico-medicine-launches-phase-iii-trial-for-ai-developed-drug

Protiviti. (n.d.). Healthcare under pressure: Mastering risk to unlock new growth. Retrieved October 21, 2026, from https://www.protiviti.com/de-de/survey/top-risks-healthcare-industry-2026

Raymond, F. D., Lidondici, C. M., & Schiltz, T. C. (2023, February 23). Delaware Court of Chancery expands duty of oversight to corporate officers. Faegre Drinker. https://www.faegredrinker.com/en/insights/publications/2023/2/delaware-court-of-chancery-expands-duty-of-oversight-to-corporate-officers

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (2024). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

Seeley, A. Z., York, J. P., Egan, H., & Levin, H. (2025, November 5). From vulnerability to violation: FDA cybersecurity requirements for medical devices and FCA enforcement. As Prescribed. Morgan Lewis. https://www.morganlewis.com/blogs/asprescribed/2025/11/from-vulnerability-to-violation-fda-cybersecurity-requirements-for-medical-devices-and-fca-enforcement

Sobande, S. (2025, June 24). Decoding MDCG 2025-6: Interplay between the MDR/IVDR and AIA. Emergo by UL. https://www.emergobyul.com/news/decoding-mdcg-2025-6-interplay-between-mdrivdr-and-aia

The Conference Board. (2026, April 22). Report: In the S&P 500, disclosure of AI risks surges from 12% to 83% [Press release]. PR Newswire. https://digital-release.wowktv.com/business/press-releases/cision/20260422NY41234/report-in-the-sp-500-disclosure-of-ai-risks-surges-from-12-to-83

U.S. Food and Drug Administration. (2025). Considerations for the use of artificial intelligence to support regulatory decision-making for drug and biological products (Draft guidance; Docket No. FDA-2024-D-4689). Retrieved October 21, 2026, from https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological