What clinical governance already knows about deploying AI
Medicine spent a century building the institutional machinery for deploying interventions that can harm people. Much of it transfers directly, and is being rebuilt from scratch instead.
There is a recurring assumption in technology policy that governing AI requires new institutions, new concepts and new law. Sometimes it does. More often the problem has a close analogue in a field that solved it earlier, at considerable cost, and wrote the solution down.
Clinical medicine is the clearest case. It deals routinely with interventions that are beneficial in aggregate and harmful to particular individuals, that work in one population and fail in another, whose mechanism is imperfectly understood, and which are administered by people under time pressure. That is a fair description of most consequential automated systems.
Five transferable mechanisms
Validation in the treated population
A drug trialled in one population is not approved for another without evidence. This principle is entirely absent from most software procurement, where a system validated on one institution’s historical data is deployed in a different institution with a different population and a different workflow, and the original validation is cited as though it transferred.
Staged deployment with stopping rules
Clinical trials define in advance the result that would stop them. Almost no software deployment does. Defining the stopping condition before launch is the single cheapest governance improvement available, and it is almost never done, because doing it requires admitting in advance what failure would look like.
Adverse event reporting
Medicine has mandatory reporting of harms, with legal protection for the reporter. Technology has incident reporting where it is commercially convenient. The asymmetry is not technical.
Professional obligation that outranks the employer
A clinician has duties that survive an instruction from management, enforced by a body that can end their career. Engineers have no equivalent. This is the largest single structural difference, and the hardest to remedy.
Informed consent as a real process
Consent in medicine is a conversation with a documented outcome, not a checkbox. Consent in digital systems has become the opposite, and is now doing work it cannot bear.
Where the analogy fails
Two differences matter. Clinical interventions are administered one patient at a time by a person who can see them; automated decisions are administered to populations by systems that cannot. And clinical evidence is generated slowly by design, while software changes weekly. Governance borrowed from medicine has to be adapted for both. But adaptation is a much smaller task than invention, and it starts from mechanisms that have already survived contact with institutional reality.
