This article presents only general professional opinions and does not constitute legal, regulatory, financial, or compliance advice relating to your particular case. Reading it creates no consulting relationship with GRAYS™ Strategy. Figures come from the sources cited, as of the publication date, so please check them before you rely on them.
Here’s an uncomfortable test for your next board meeting: if your CEO or CTO left tomorrow, could anyone else produce a complete AI audit trail using only what’s written down, or does the policy actually live in one person’s head? Hospital CEO turnover was up 32% year over year in the first quarter of 2026 (Becker’s Hospital Review, 2026b), and some of the people now leaving may be the same people who wrote the AI governance policy in the first place. Many hospitals may fail this test (Black Book Research, as cited in Advisory Board, 2025), and not because of bad luck: the policy was never actually running anything to begin with.
What caused it to appear perfectly normal up until someone left?
Not all formal policies have the same aim. Some are mainly drawn up to guide decisions, to ensure accountability, to restrict the range of options, and to influence the way people work, just because the policy is in place. Other policies are created mainly to demonstrate to regulators, boards of directors, and accreditors that the organization is managing risk, with the actual coordination within the organization taking place entirely outside the formal structure. Organizational researchers have actually studied this second pattern for a long time now, they’ve found that organizations often set up formal systems to look legitimate to outside stakeholders, even while their real operations stay informal and take place off the page (Meyer & Rowan, 1977).
Nothing about that requires bad faith. It just means the policy and the practice were never actually the same thing. The written version and the version that actually ran the organization only matched for as long as one particular person stuck around to keep them lined up.
Once nobody’s around to keep the illusion alive, what occurs?
This comes up in virtually every governance conversation, and it’s the one that really matters. One example comes from another industry, so read it for how the mechanism works. A case study of a large financial services company found that its decoupled compliance program didn’t just fail to stop inappropriate conduct, it helped the misconduct take hold. As the researchers describe it, the compliance program created what they call a legitimacy facade. To leadership and those looking in from outside, the risk appeared well-managed. Behind that facade, the misconduct became institutionalized, with no real checks in place (MacLean & Behnam, 2010).
This isn’t unique to financial services. Researchers found a similar pattern in a different setting, Italian hospitals, where a mandated organizational model got adopted on paper while the actual clinical governance tools underneath it largely didn’t (Mascia et al., 2014). Nobody outside the building could tell the difference until something broke.
Is this happening in AI governance right now?
Take a look at the survey data already sitting in front of you. Only 29% of hospital leaders said they had an active and enforceable AI policy which included provisions for model inventory, lineage, and approval, whereas 48% were still in the process of drawing one up (Black Book Research, as cited in Advisory Board, 2025). Just 22% claimed that they could put together a complete AI audit trail within thirty days. That figure is merely the facade expressed in numerical form: although most of these organizations have a policy or are drafting one (Black Book Research, as cited in Advisory Board, 2025), proving that the policy in fact has any effect is a completely different matter.
Figure 1. AI governance capability among hospital leaders, and hospital CEO departures in the first half of the year. Sources: Black Book Research, as cited in Advisory Board (2025); Becker’s Hospital Review (2026a).
About 70% of those leaders reported an AI pilot failing from causes such as weak endpoints or misalignment of the workflow (Black Book Research, as cited in Advisory Board, 2025), which is precisely the type of failure to be anticipated when there had never actually been a connection between the documented process and actual practice.
Meanwhile, the people most likely to have quietly been closing that gap are leaving at a faster rate than a year ago. In the first six months of 2026 alone hospitals recorded 74 departures of CEOs, an increase from 68 during the corresponding period the previous year (Becker’s Hospital Review, 2026a). The overall turnover rate among hospitals was 18.5% in 2025, and retirement now ranks as the third reason given by registered nurses for leaving voluntarily (NSI Nursing Solutions, 2026).
Once they’re gone, the gap that was always there simply stops staying hidden.
What actually fixes this, since a better-written policy doesn’t?
Writing a sharper policy solves nothing if the words on the page were never the operative thing to begin with. The fix has to produce evidence of its own execution, independent of any one person’s memory or credibility.
Writing another policy alone won’t solve the problem, since the one currently in place can already be checked in a few simple ways. Begin with the issue of ownership: does the policy clearly name who is currently responsible for it, and does that responsibility automatically pass on when a change in leadership is announced, rather than being picked up by the person who is simply present at the time? The review process is the simpler check: is it on a fixed calendar? In reality “as needed” just means whenever someone decides to remember. The real test comes last. Could your organization produce a full audit trail this week without having to go and find the one person who actually understands how the system works? A genuine policy can withstand that question and a facade cannot.
If the honest answer to that last question is no, the policy was never running the show. Someone was quietly running it for the policy, and you just found out how much weight they were carrying.
Questions about how this applies to your organization? Reach out at info@graysstrategy.com.
Share this article on LinkedIn
References
Advisory Board. (2025, December 16). More hospitals are adopting AI. But do they have a governance strategy? https://www.advisory.com/daily-briefing/2025/12/16/ai-governance
Becker’s Hospital Review. (2026a, October 22). 4 recent hospital, health system CEO exits. https://www.beckershospitalreview.com/hospital-executive-moves/5-recent-hospital-health-system-ceo-exits-3/
Becker’s Hospital Review. (2026b, May 28). Hospital CEO turnover rises 32% year over year: 6 things to know. https://www.beckershospitalreview.com/hospital-executive-moves/hospital-ceo-turnover-rises-32-year-over-year-6-things-to-know/
MacLean, T. L., & Behnam, M. (2010). The dangers of decoupling: The relationship between compliance programs, legitimacy perceptions, and institutionalized misconduct. Academy of Management Journal, 53(6), 1499–1520. https://doi.org/10.5465/amj.2010.57319198
Mascia, D., Morandi, F., & Cicchetti, A. (2014). Looking good or doing better? Patterns of decoupling in the implementation of clinical directorates. Health Care Management Review, 39(2), 111–123. https://doi.org/10.1097/HMR.0b013e318286095c
Meyer, J. W., & Rowan, B. (1977). Institutionalized organizations: Formal structure as myth and ceremony. American Journal of Sociology, 83(2), 340–363.
NSI Nursing Solutions, Inc. (2026). 2026 NSI National Health Care Retention & RN Staffing Report. https://www.nsinursingsolutions.com/documents/library/nsi_national_health_care_retention_report.pdf
Cited research reflects the best available evidence at time of writing, including findings drawn from adjacent industries and organization types.
GRAYS™, GRAYS Method™, and Clarity in Complexity™ are trademarks of GRAYS™ Strategy LLC. © 2026 GRAYS™ Strategy LLC. All rights reserved. This content reflects general commentary and professional analysis current as of its publication date. It does not constitute legal, regulatory, financial, or compliance advice, and should not be relied upon as a substitute for professional counsel specific to your organization’s circumstances. Regulatory developments referenced herein may change after publication; readers should verify current status independently before acting.
More from Clarity Defined
