Article | November 9, 2026

Better care at scale starts with governed, auditable AI

Only a year ago, healthcare executives were asking what AI could do. Today, the sharper question is whether the organization can prove what its AI is doing, control what it touches and show that it works as intended.

That shift matters because AI is no longer simply answering questions. It's doing the work, pulling information from electronic health records, claims and core admin platforms, then routing tasks and drafting decisions at machine speed.

The stakes are now measured in outcomes and exposure, not novelty. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027, citing escalating costs, unclear business value and weak risk controls. In healthcare, weak controls aren't an abstract risk. They turn into clinical, financial and reputational consequences that reach real patients.

The value is real, but so is the accountability gap

The momentum is genuine. McKinsey reports that half of surveyed US healthcare organizations are now implementing generative AI, with attention turning to integration, ROI and agentic systems. Yet the payoff is still unproven for many. Deloitte's 2026 outlook notes that 51% of health leaders have either not measured AI returns or say it's too soon to tell.

This is the gap executives have to close. Promising use cases stall when leaders can't connect them to governance, workflow redesign and measurable effects. Filling that gap depends on two disciplines that reinforce each other: auditability and governed data access.

Auditability: proving the AI still deserves trust 

Auditable AI lets leaders answer four questions in plain English:

• What data was used?
• Who approved the model or workflow?
• How did the system reach its conclusion?
• What evidence shows it keeps performing safely across several patient groups, locations and conditions?

Those questions map to guidance healthcare leaders already recognize. The World Health Organization's health AI principles highlight transparency, explainability and accountability. The FDA has flagged the challenge of systems that learn from real-world use, where performance can quietly degrade as populations and practice patterns change. For a CEO or CMO, assurance can't be a one-off approval. It has to become part of routine management, with a documented chain of reasoning that any patient, regulator, clinician or journalist would find reasonable.

Governed data access: keeping “minimum necessary” real

The second discipline is about restraint. Claims data is rich and indiscriminate. A single claim can carry diagnoses, medications, dates of service and patient identifiers, so even a project built for prescriber analytics often sits on top of protected health information (PHI).

The US Department of Health and Human Services (HHS) describes the minimum necessary standard as limiting the use of PHI to what a specific purpose requires.

An autonomous agent can breach that standard simply by pulling full histories to be helpful, then copying sensitive data into prompts, tickets or downstream tools that may sit outside the organization’s traditional HIPAA boundary. Autonomy also pulls cloud services and outside platforms into the control plane, which HHS addresses in proposed Security Rule updates that raise expectations for business associates. In other words, restraint has to be designed rather than assumed.

What good looks like in practice

The clearest proof is clinical. At Singapore General Hospital, DXC and Synapxe helped build an infectious-disease tool, AI2D, to guide antibiotic decisions and curb the overuse that drives resistance. The program followed the Xponential approach, starting with focused pilots and building in observability and governance so recommendations stay traceable and auditable as use expands. In validation, the pneumonia model reached 90% accuracy in determining whether antibiotics were necessary, freeing stewardship teams to concentrate on complex cases.

Connected operations tell a similar story. At the Royal Adelaide Hospital, a DXC integration engine links 13 ICT and building systems from 13 vendors, coordinating people, equipment and services. One practical result is the ability to pre-book an operating room and reserve an elevator before a trauma patient arrives.

Restraint shows up too. In DXC's work with The Black Car Fund, a non-profit group that administers safety and health programs that benefit for-hire drivers in New York, role-based views stop staff from seeing medical details or personal identifiers they don't need — a working version of minimum necessary that translates cleanly to autonomous agents. And at healthcare insurer Delta Dental of California , DXC re-platformed a core administrative system connected to dozens of applications in 12 months, lifting release frequency and cutting maintenance costs, with reported savings above $350 million.

Make governance the engine of scale

The pattern across these examples is consistent. Treat every autonomous system like a governed member of the workforce from the outset. Pick one high-value workflow that touches sensitive data, define the minimum information needed to deliver the outcome, then put governed access, human review points and audit-ready logging in place before you scale.

That sequence is what turns AI from an encouraging experiment into trusted infrastructure for more reliable care.

Leaders who build the proof first will scale faster than those who bolt it on later, because in healthcare, the ability to explain and control an AI decision is what makes the decision worth automating in the first place.