In July, IBM tagged healthcare the single industry most disrupted by cyber breaches in 2026. IBM traced API compromises, cloud misconfigurations, and lethargic CISO response structures as the culprits: in its words, “governance failures, not model risk.” A month later, UPMC & ECRI concurred. UPMC and ECRI data indicated that, while 90% of health organizations have deployed some third-party AI solution, over 31% of hospitals had encountered a faulty AI output in 2026. Taken together, the two reports clearly suggest that AI adoption is outpacing AI governance in 2026.
Now, new research published by Grid Health explicates that adoption-governance asymmetry. Grid surveyed IT and security leaders at 29 (n=29) U.S. Epic Health systems and spoke with 36 health-system leaders responsible for buying AI (n=36). It calls what it found the pilot-to-production gap: the distance between the AI a health system tests and the AI it scales under a funded contrast or formally stops.
Pilots are narrow, widespread, and stalled
While 72% of surveyed systems were running or planning AI pilots, only 43% of piloters were also actively purchasing AI. The remaining pilots sit in a gap, running, typically without oversight, with no defined ownership structure or graduation pipeline. As such, only 19% of pilots are touching anything that informs a clinical decision, and over 57% are piloting ambient tools problematized by CHARGE, of which only 8% are described as “finished.”
Taken on their face, Grid’s results indicate that health organizations are struggling to even pilot the types of point-of-care solutions needed to improve patient outcomes. Notably, organizations of every size are facing piloting crises (Spearman’s ρ = 0.11, below the critical value of 0.37 required for significance). We must strive to deliver solutions which help patients, not just the “administrative and revenue cycle use cases” described by most survey respondents.
The pilot is where opacity starts
The potency of Grid’s research is amplified in context. While only 19% of organizations are piloting anything that informs a clinical decision, of the 31% of hospitals that had encountered a faulty AI output, over 9% had impacted patients. That’s an absurdly high incidence rate for AI error at the point-of-care.
Grid names five root causes: no one owns the decision, review can't keep up, no one budgets for scale, no one can see performance, and every graduation is a custom integration. CHARGE reads the fourth, visibility, as the hinge of the governance crisis sketched by IBM, UPMC, and ECRI: opacity.
53% of buyers told Grid they had no way to to monitor how their AI tools perform, so the case for their scaling rests on anecdotes. 33% confirmed unsanctioned AI use. 50% of buyers told Grid that their main pain is what happens after a tool is approved and deployed, not choosing it.
33% of vendors placed the onus directly on vendors, unprompted. Consider one anecdote which caught CHARGE’s eye. One AI governance lead at a multi-site provider asked a vendor how accurate their ambient listening tool was. The vendor’s response:
"Yeah, no, go pound sand." -- ambient AI vendor, asked for accuracy data by multi-site provider.
That revelation quantifies a claim, repeated time and time again by CHARGE: error modes are exposed by failure when AI vendors deliberately obscure their intellectual property. Grid’s research reveals that the risk of AI opacity lies nascent long before production – and identifies pilots as the staging ground for oversight error.
An idle engine still runs hot
These results help explain how governance oversight proliferates: while the front half (intake) of AI piloting is mature at most (72% of organizations), most struggle with reviewing pipelines, data confirmation, and purchasing.
Grid puts it plainly: “A perpetual pilot is an idle engine.” An idling engine goes nowhere, but it still burns fuel and it still runs hot. A stalled pilot still touches real patients and real workflows. Models drift. Vendors ship quiet updates. Clinicians find workarounds nobody approved. None of that pauses because a pilot has no end date.
Graduation is the moment someone puts the engine in gear or switches it off: an owner decides, against criteria set in advance, with the data to check them. Until then, a health system carries a tool's risk without the oversight production would demand.
72% of organizations have started their engines. Only 48% have done the sustained, unglamorous work of placing the engine in gear or switching it off. The other 52% run the risk of redlining.
Grid's report closes with ten practices drawn from the leaders it spoke with. They are leaders' practices, not Grid's recommendations. Health leaders can benchmark their own organizations against the full report.
References
[1] https://www.gridhealth.io/research/pilot-to-production-gap
