Most life sciences companies are writing AI governance frameworks without knowing what AI use already looks like inside their own walls. That's backward. A framework built before you have visibility into real AI use is a document, not governance, and it fails the first time someone asks a specific question about a specific tool.

Right now, someone on your commercial or medical affairs team is using an AI tool to draft a slide, summarize a study, or answer a rep's question faster. Your legal and compliance team probably can't name which tool, or what data went into it. That's not a hypothetical. It's the normal state of AI adoption in life sciences today.

The instinct is to fix this with a framework: a policy document, a list of approved vendors, a training deck. That instinct is premature. A framework written without visibility into what's actually happening on your network answers questions nobody is asking while missing the ones that matter. Visibility has to come first. The framework comes second, built around what you actually find.

What does AI governance actually mean right now in life sciences?

AI governance in healthcare and life sciences means knowing which AI tools your teams use, what data flows through them, and who's accountable when something goes wrong. It is not the same thing as a policy document sitting in a compliance folder.

Most companies conflate the two. They write a governance framework, distribute it, and consider the job done. But a framework is a set of rules. Governance is whether those rules match what's actually happening. Our own look at governance in agentic AI found the same pattern: the companies with real control aren't the ones with the thickest binder. They're the ones who built visibility into the workflow first, then wrote rules that reflect what they found.

Why is the gap between adoption and oversight getting wider, not smaller?

The gap keeps growing because adoption moves at the speed of a browser tab, and governance moves at the speed of a committee. In health systems, 88% are already using AI internally, but only 18% have a mature governance structure in place, according to an August 2025 survey from the Healthcare Financial Management Association. That's a 70-point gap between what's happening and what's being managed.

Verizon's 2025 Data Breach Investigations Report found that 15% of employees routinely access generative AI tools on corporate devices, and 72% of those did so through personal, non-corporate accounts. That means most AI use inside a life sciences company right now is invisible to the people responsible for governing it. You can't write a rule for a tool you don't know exists.

This lines up with what we found when we looked at shadow AI across the enterprise more broadly. Employees aren't hiding their AI use out of malice. They're using it because it's faster, and nobody gave them an approved alternative.

What happens when governance gets built around a framework instead of reality?

It fails the first time it gets tested against something specific. IBM's 2025 Cost of a Data Breach Report found that 63% of breached organizations had no AI governance policy at all, and where shadow AI was involved, it added roughly $670,000 to the average cost of a breach. Healthcare stayed the most expensive industry for a data breach for the fourteenth year in a row, averaging $7.42 million.

A framework written in a vacuum can't answer basic questions when an incident happens: which tool touched this data, who approved it, what does the audit trail show. If the answer is "we don't know," the framework didn't fail because it was poorly written. It failed because nobody checked it against reality before they wrote it.

Register for the September 24 webinar

Where should a life sciences company actually start?

Start by finding out what's already happening, not by writing a new policy. AstraZeneca's R&D Data Office made this call directly. Rather than standing up AI governance as a separate function, the team folded it into their existing data governance structure, because the risk questions are the same ones they already knew how to answer. That's the model. Visibility and governance live in the same place, not in two different documents.

That's also why CI partnered with Classie AI. A governance framework only works if someone can actually see what AI tools and agents are doing across the organization in real time. Without that layer, you're governing on guesswork.

The rest of this series walks through what that looks like in practice: why banning tools doesn't work, which life sciences companies are getting this right, why compliance teams are nervous, what to check first, and who's accountable when an AI tool touches patient data.

Frequently asked questions

What is AI governance in healthcare?

AI governance in healthcare means knowing which AI tools are in use, what data they touch, and who's accountable for that use, backed by policies that reflect what's actually happening rather than a hypothetical version of events.

Does banning AI tools solve the governance problem?

No. Employees who lose access to an approved AI tool typically keep using AI through personal accounts, which removes the visibility a company had before the ban. A sanctioned alternative works better than prohibition.

How do you get visibility into AI use before writing a governance policy?

Start with what's already crossing your network: which AI domains employees reach, through which accounts, and with what data. That inventory becomes the foundation the policy gets built on, instead of the other way around.

What's the difference between an AI governance framework and AI governance itself?

A framework is a written document. Governance is whether that document matches what's actually happening inside the company. A framework without visibility into real AI use is paperwork, not governance.

Save your seat for "AI Adoption Is Accelerating, But Where Is the Oversight?"