Most organizations review AI tools with one policy. One intake form, one committee, one bar to clear.
The problem is that the bar gets set by the scariest thing anyone can imagine. So a tool that drafts meeting notes goes through the same review as a tool that influences who gets prioritized for service.
Two things happen. The low-risk tools stall for months, so staff quietly use consumer versions instead. And the genuinely high-risk tools sometimes sail through, because they arrived from a large vendor with a procurement process attached and a policy document that says the right words.
Recent implementation guidance keeps making the same point: different AI applications shouldn't be held to identical standards. A documentation assistant doesn't carry the same risk as a tool supporting a care decision.
A simpler question to sort by: if this tool is wrong, who finds out, and when?
If the answer is "the staff member, immediately," that's a light review. If it's "the client, eventually, and no one traces it back," that's your deep review — regardless of how polished the vendor's deck was.
One policy for everything usually means no real policy for anything.
What this means for health organizations
A tiered review lets you approve low-risk tools quickly and spend real effort where errors could affect clients. Two or three tiers, each with clear examples of what belongs in it, are usually enough to start.
