The University of Texas MD Anderson Cancer Center

Shawn Stapleton

Human Oversight Champion

Most health systems today are not deciding whether to adopt AI. They are already running it, often at a scale leadership does not fully see: imaging tools, documentation assistants, scheduling optimizers, risk scores embedded in the EHR and a fast-growing wave of generative AI. The vast majority of these solutions are procured from vendors rather than built in-house. And nearly all of them share a property that healthcare IT is not built around: they change after you deploy them.

A conventional application behaves tomorrow the way it behaves today. An AI model does not. Patient populations shift, clinical practices evolve, upstream data feeds get reconfigured and a model that performed well at go-live can degrade months later without any error message or downtime. Traditional IT service management, built on tickets, patches and uptime, was never designed to catch a model that is running perfectly and quietly getting worse.

That is why the discipline that will separate successful AI programs from stalled ones is lifecycle management: treating every AI solution, purchased or built, as something to be validated before deployment, monitored continuously in production, maintained as conditions change and retired when it no longer earns its place.

In practice, that means a few concrete capabilities. First, an inventory: you cannot manage what you cannot see and most organizations underestimate how much AI is already running inside their walls, including tools embedded invisibly in vendor platforms. Second, validation that reflects your own patients and workflows, not just the vendor's published performance. Third, ongoing monitoring for both technical performance and clinical or operational impact, because a model can remain statistically accurate while the workflow around it fails. Fourth, clear accountability: every solution needs a named owner who understands the risks the organization accepted when it adopted the tool. And finally, a deliberate path to retirement. Turning off an underperforming model is not a failure of the AI program. It is the strongest evidence the program is working.

Governance holds this together, but only if it is designed as an enabler rather than a gate. A review board that says yes or no and then disappears will always be outrun by demand. Governance that works translates its decisions into operational requirements, including contract terms, validation expectations, monitoring obligations and workforce training, so that "approved" also means "supported for the long run." Risk-tiering matters here: routine, low-risk requests should move quickly through standardized paths, reserving human deliberation for the cases that need it.

The generative AI wave has raised the stakes. Employees are eager to use tools like ChatGPT, Claude, Copilot and if the organization does not provide a secure, compliant pathway, they will find their own. The answer is not prohibition; it is a governed alternative that is genuinely easier to use than the workaround, paired with education that builds appropriately calibrated trust. Alongside that come two newer disciplines: managing the cost of rapidly multiplying AI subscriptions and infrastructure and preparing security teams for risks that are unique to AI systems and agents.

None of this succeeds without people. Clinicians and staff need to understand what an AI tool can and cannot do and organizations need to preserve the human judgment required to question an output that looks wrong. Technology can be procured; trust and skill have to be built.

Healthcare is right to be excited about AI and the potential in cancer care and beyond is real. But the organizations that realize that potential will not be the ones that deploy the most tools the fastest. They will be the ones that can answer, at any moment, four questions about every AI system they run: What is it doing? How well is it performing? Who is accountable for it? And how would we know when to turn it off?