In the pursuit of AI ROI, are we headed toward “governance theater”?

Key takeaways

Clearwater Security & Compliance survey data shows nearly half of healthcare organizations have AI policies with no technical enforcement behind them, more than 90 percent can’t reliably verify what AI is running in their environments and 80 percent spend under 5 percent of their security budget on AI security or don’t know their spend. Meanwhile, Bessemer Venture Partners’ 2026 Healthcare AI ROI Scorecard finds ROI arriving faster than expected, with 54 percent of organizations seeing returns within the first year and half already cutting or planning to cut headcount as a result. The combination risks “governance theater,” where oversight committees and policy documents exist on paper while the technical controls and human reviewers needed to enforce them are underfunded or eliminated.

Ask any panelist on the conference circuit, any health system executive writing a bylined piece or any startup founder pitching their wares, and they’ll all tell you the same thing. Strong governance is at the core of any successful AI implementation.

As a result, governance panels and oversight committees have become a dime a dozen. But new industry data indicates that at least some organizations are not adequately equipping these teams with the technical tools they need to fulfill their missions.

A survey from Clearwater Security & Compliance found that nearly half of healthcare organizations have AI policies in place without technical enforcement behind them.

More than 90 percent of organizations cannot reliably verify what AI is actually running in their environments, and 86 percent can’t confirm that their vendors’ AI controls have been verified.

At the same time, separate data from Bessemer Venture Partners shows that half of organizations participating in its 2026 Healthcare AI ROI Scorecard have already cut headcount as a direct result of AI adoption or are planning to within the next six months.

With Bessemer projecting potential reductions between 8 percent and 13 percent of affected functions, organizations risk further weakening the human layer of verification and oversight that is an essential component of enforcing governance.

If AI systems are starting to supplant humans, and organizations are not routinely investing in technical enforcement of their governance policies, who is actually minding the store?

A complicated relationship between adoption, ROI and governance

With AI adoption at near-universal levels, attention has turned to tracking which organizations are achieving ROI from their purchases. The Bessemer poll says ROI is arriving much more quickly than expected, with more than half (54 percent) achieving some form of ROI within the first year of deployment, exceeding expectations in around four in 10 use cases.

Most of that value is being found in the back office, as AI automates workflows and improves efficiency across operational and financial use cases.

As the proof points pile up in pilots and limited deployments, organizations are looking to go big with full-scale projects. Over half of the next year’s incremental AI investment will go toward deployment, the survey says. And with many organizations hitting ROI status much faster than anticipated, those budgets are likely to be healthier than originally assumed.

The problem is that active governance, security and technical controls don’t appear to be keeping up. Only 72 percent of organizations have an AI governance committee, even though participants largely agreed that regulatory and compliance uncertainty has the highest potential to derail a project.

The Clearwater report reinforces this, with 66 percent of respondents identifying security and privacy as “leading hurdles” to AI adoption. Eighty percent of organizations either spend less than 5 percent of their security budget on AI security or don’t know what their spend looks like.

And with worryingly few organizations able to demonstrate that they have effective controls and processes in place around their AI data and systems, the potential hazards of pursuing ROI without comparable attention to safety and effectiveness may be piling up.

“What stands out to me isn’t a lack of effort. It’s a mismatch in pace,” said Harry Lu, vice president of consulting for AI solutions at Clearwater.

The existence of governance isn’t the exercise of governance

This “mismatch” extends into the way organizations are operationalizing their governance policies, where policies exist at all.

In the gated full report, for example, Clearwater notes that when it comes to data protection, 44.3 percent of organizations have governance policies in place with no technical enforcement, while an additional 17.1 percent have no visibility, policy or enforcement.

The risk is that organizations may unintentionally be creating an environment of “governance theater,” where guardrails appear to be in place but aren’t being applied.

Organizations in this situation may be operating under a false sense of security, and could be setting themselves up for an unpleasant surprise if an incident occurs and the extent of their governance gaps is revealed.

This is especially important as organizations accelerate from the pilot phase toward larger-scale deployment, Lu said.

“Governance built for a pilot doesn’t hold up under production-scale risk,” he said. “Closing that gap requires continuous discovery, enforceable technical controls and evidence, not another policy document.”

Prioritizing actionability and accountability in the next phase of AI adoption

The other issue to flag is Bessemer’s workforce reduction data. While the report wasn’t explicit about exactly who is being cut from the workforce, organizations should consider whether slimming down their staff may be weakening their ability to put governance-related controls into action.

With “keeping humans in the loop” still considered a core tenet of meaningful governance, being overly aggressive about cutting staff in the name of ROI could trade short-term gains for long-term consequences.

Reinvesting some of the immediately freed-up dollars into governance enforcement could be part of the solution, and may help to close the growing gap between adopting AI and fully protecting the organization while taking advantage of it.

Successfully moving from pilot to full rollout will require a lot more than just having governance documents available. Truly maximizing ROI will require organizations to develop actionable policies and procedures, backed by appropriate technical enforcement mechanisms and human oversight, that create an environment of accountability and trust.

Jennifer Bresnick is a journalist and freelance content creator with a decade of experience in the health IT industry. Her work has focused on leveraging innovative technology tools to create value, improve health equity, and achieve the promises of the learning health system. She can be reached at [email protected].