How Much Should a Health System Spend on AI Governance?

A health system approves an AI scribe pilot. The vendor contract has a budget line, so that part is easy. Then the evaluation starts pulling time from people whose calendars were already full. Clinicians review the notes. Privacy and legal work through the data flows. Security assesses the vendor. Analytics builds the monitoring plan. IT handles the integration. Training and post-deployment monitoring compete for whatever capacity is left.

None of that work appears in a budget anywhere. All of it is AI governance.

That is the situation in most health systems today. The governance budget already exists. It is scattered across a dozen cost centers where nobody can see it, manage it, or defend it. Bringing those costs into one visible budget gives leadership a clearer view of what AI adoption actually requires.

The current numbers suggest most organizations have not done that yet. A 2025 Black Book survey of 182 hospitals found the median organization allocated 4.2% of its 2026 IT plus quality and safety budget to AI governance and safety. Only 22% were highly confident they could produce a complete, auditable AI explanation within 30 days if a regulator or payer asked for one.

One note on that survey before we go further. Black Book measures governance against IT plus quality and safety spending, which makes it a useful snapshot of where hospitals sit today. The benchmarks in the next section use a different denominator, the AI budget itself. Keep the two separate.

The short answer: start at 10%, then price the work

If you need a number to open the planning conversation, use this one: reserve roughly 10% of your total AI investment for governance and responsible AI.

Two studies point at that anchor from different directions.

PwC modeled companies that invested an additional 10% of their AI budgets in comprehensive responsible AI programs. In the model, those organizations experienced up to 50% fewer adverse AI incidents, valuations up to 4% higher, revenues up to 3.5% higher, and faster recovery when an incident did occur.

IBM’s 2025 study of executives provides a second spending signal. Organizations spending more than 10% of their AI budgets on ethics reported 30% higher operating profit attributable to AI than organizations spending 5% or less, along with 20% better incident prevention, 19% higher AI adoption, and a 22% improvement in customer satisfaction and retention.

Read that evidence for what it is. PwC’s findings come from a financial model. IBM reports an association between ethics investment, maturity, and performance in survey data. Neither study hands you a guaranteed return. What they give you is a credible planning anchor. Ten percent is a defensible place to start, and the final budget comes from pricing the work your portfolio requires.

Healthcare is already carrying the workload

If 10% sounds high, look at what hospitals are already doing. A September 2025 ONC data brief, analyzing 2023 and 2024 hospital survey data, reported that 71% of hospitals used predictive AI integrated with the EHR. Among hospitals using these tools, 82% evaluated them for accuracy, 74% evaluated them for bias, 79% conducted post-implementation evaluation or monitoring, and 74% assigned accountability to multiple organizational entities.

Every one of those percentages is labor. Accuracy evaluation, bias review, monitoring, clinical input, documentation, and committee coordination all consume people and technology. Hospitals are doing this work right now, mostly without a budget that names it. A governance budget makes the work visible so leadership can staff it deliberately instead of absorbing it.

Build the budget in three layers

A 2026 paper in npj Digital Medicine lays out a People, Process, Technology, and Operations framework for health AI governance, and it maps cleanly to how budgets get built.

Layer one: the enterprise foundation. These are the shared capabilities every AI initiative draws on: executive sponsorship, governance program leadership, the AI inventory and intake process, risk classification, policies and documentation standards, shared evaluation environments, enterprise AI literacy, and incident and escalation procedures.

Layer two: project-specific governance. These costs travel with each AI business case: vendor due diligence, privacy and security review, clinical validation, bias and equity assessment, workflow testing, integration, tool-specific education, local change management, and model-specific monitoring.

Layer three: sustained operations. This is the recurring work that keeps deployed AI safe: performance and drift monitoring, policy updates, refresher education, committee operations, incident response, reporting, independent assurance, and patient and workforce engagement. The paper states that the costs of sustaining and operationalizing governance should account for 10% to 15% of the governance-system budget described in its framework.

Layer three is the one organizations forget. AI governance has no finish line. A model approved in January still needs someone watching it in December.

What a balanced governance budget could fund

Here is an example allocation we use at Henecorp as a planning starting point. It is a practical model, and it is ours. No published standard sets these percentages.

Adjust the mix to your maturity and risk. A health system running many clinical models should spend more on validation and monitoring. An organization early in its AI journey should spend more on inventory, policy, and education.

To make it concrete: a health system planning $10 million in annual AI investment could begin with a $1 million governance envelope. Under this allocation, about $150,000 would fund literacy, role-based education, and change support. Treat those figures as an example for planning, and change them when your bottom-up assessment says otherwise.

Give literacy and education their own budget line

Governance runs on people. Every policy you write assumes someone can recognize when an AI output is wrong, knows what the escalation path is, and understands why the approved tool beats the one in their personal browser. Skip the education and the policies stay PDFs.

The AMA’s 2026 physician survey shows how far there is to go. 81% of physicians reported awareness or use of AI in practice, and 92% wanted more AI education and training. One quarter had received no AI training from any source. Among physicians who had received training, only 11% reported receiving extensive training.

The cross-industry picture matches. In BCG’s AI at Work 2025 survey, only 36% of employees felt properly trained. Regular AI use reached 79% among employees who received more than five hours of training, compared with 67% among those who received less. And 54% said they would find alternative AI tools if their organization failed to provide what they needed.

That last number is your shadow AI problem, whether you fund it or not.

This is why we recommend protecting 10% to 15% of the governance budget for AI literacy, role-based education, and change support. That is a Henecorp planning recommendation, and it covers real deliverables: board and executive literacy, governance committee education, training for reviewers and approvers, role-specific clinical and operational learning, tool-specific workflow education, protected learning time, sandboxes for hands-on practice, competency assessments, train-the-trainer programs, and continuing refreshers.

Executives already sense this is where the risk sits. In IBM’s 2026 CEO study, 83% of CEOs said AI success depends more on people’s adoption than on the technology, and respondents expect 53% of employees to need upskilling in their current roles.

Literacy turns governance policy into daily behavior, and AI purchasing into sustained adoption. We have written more on why education belongs inside AI governance and why AI literacy is the bottleneck on AI ROI.

Decide which costs live centrally and which travel with projects

The enterprise budget funds what every initiative shares: governance leadership, enterprise policies, the AI inventory and intake process, a common risk methodology, baseline monitoring infrastructure, organization-wide literacy, reporting and incident processes, and committee operations.

Project and department budgets fund what belongs to a single use case: validation, clinical and workflow expertise, integration, vendor-specific review, tool-specific training, local change management, specialty monitoring requirements, and any additional evidence generation.

Then hold one rule: every AI business case includes its own governance costs. This gives leaders an honest view of total cost before approval, and it protects the central governance function from absorbing unlimited demand from every department’s pilot.

What the investment returns

Governance spend earns its keep in four places, and each one is measurable.

Risk reduction. AI incidents and near misses, time to detect and respond, audit findings, the share of high-risk systems with completed validation, and the share of deployed systems under active monitoring.

Adoption and literacy. Knowledge improvement, role-based competency, approved-tool utilization, adoption after training, shadow AI reports, and whether users escalate confidently when something looks wrong.

Governance efficiency. Median time from intake to decision, percentage of AI systems inventoried, review backlog, rework caused by incomplete submissions, and the time required to produce an audit trail.

Portfolio value. Benefits realized against the approved business case, low-value purchases avoided, pilots reaching production, time from approval to sustained adoption, and financial and operational return by use case.

There is also a return that shows up in the exam room. CHAI and NORC reported in 2026 that 51% of patients surveyed said AI made them trust healthcare less, while more than 80% said clear accountability measures would increase their trust.

Governance is the accountability patients are asking for.

A 90-day budgeting exercise

You can build the first version of this budget in a quarter:

1. Inventory every AI system, pilot, vendor feature, and approved use case.
2. Assign each use case a preliminary risk tier.
3. Price the shared enterprise capabilities the whole portfolio requires.
4. Add project-specific validation, training, integration, and monitoring costs to each business case.
5. Establish quarterly reporting on governance workload, literacy, incidents, adoption, and realized value.

The right AI governance budget gives healthcare leaders the capacity to make better decisions, prepare their workforce, monitor what they deploy, and generate more value from every AI investment.

Take one honest look at your current AI budget and ask whether it funds the full governance operating model or just the contracts. If the answer is uncomfortable, schedule a conversation and we can work through the 90-day exercise together.

Frequently asked questions about AI governance budgets

How much should a health system budget for AI governance?

Reserve roughly 10% of total AI investment as a planning anchor, then validate the number with a bottom-up assessment of your AI inventory, risk tiers, existing capabilities, and lifecycle work. For comparison, a 2025 Black Book survey found the median hospital allocated 4.2% of its IT plus quality and safety budget to AI governance and safety, a figure that reads as catch-up spending across the sector.

Where does the 10% figure come from?

PwC modeled companies investing an additional 10% of their AI budgets in comprehensive responsible AI programs and found fewer incidents and stronger financial outcomes. IBM’s survey research found organizations spending more than 10% of AI budgets on ethics outperformed those spending 5% or less. One is a financial model and the other is a survey association, so treat 10% as a starting anchor, and price the real work from there.

Should AI literacy come out of the governance budget?

A protected share of it, yes. Henecorp recommends reserving 10% to 15% of the governance budget for AI literacy, role-based education, and change support, because governance depends on people who understand the tools, apply the policies, identify problems, and use approved AI effectively. Broader workflow training can live in learning and development. The education that makes oversight work belongs in governance, where it cannot be quietly cut.

What does an AI governance budget pay for?

Three layers. An enterprise foundation covering leadership, inventory, risk classification, policy, and shared evaluation capability. Project-specific governance covering validation, privacy and security review, integration, training, and monitoring for each use case. And sustained operations covering drift monitoring, policy maintenance, refresher education, incident response, and reporting. The recurring third layer is the one most organizations forget to fund.

How do you measure the return on AI governance?

Track four categories: risk reduction (incidents, detection time, validation coverage), adoption and literacy (competency, approved-tool use, shadow AI reports), governance efficiency (intake-to-decision time, inventory coverage, audit-trail speed), and portfolio value (benefits realized, pilots reaching production, low-value purchases avoided). Quarterly reporting on these measures is what turns a governance budget from a cost center into a management tool.