Nothing to Inspect

The compliance function was built to verify that a process was followed. Artificial intelligence produces decisions where no process was followed, only an output. That is not a tooling gap. It is a category error at the foundation of the function.

By RaeAnn, Founder and Chief Executive Officer, HLTHWORKS

The question that has no answer

A surveyor sits across from a compliance officer and asks a question that would have been routine three years ago. Show me how this determination was made.

For a determination made by a person, the answer exists. There is a reviewer, a credential, a date, a set of criteria applied, a note explaining the reasoning, and a supervisor who signed. The file is the answer. It has always been the answer.

For a determination in which a model participated, the compliance officer can produce a policy stating that a human reviews every output. What cannot be produced is evidence that the review happened in this instance, what the reviewer actually saw, how long they had, what the model had already written before they arrived, or whether the reviewer would have reached a different conclusion had the screen been blank.

The policy exists. The determination exists. The connective tissue between them does not.

This is the problem, and it is not solved by better software.

What the function was built to do

Healthcare compliance is a verification discipline. Nearly every control in a modern program rests on the same assumption, which is that a person made a decision and left a trail while doing it.

Delegation oversight audits whether the delegate followed the agreed process. Utilization management review examines whether the right credential applied the right criteria within the right timeframe. Credentialing verifies primary sources. Risk adjustment validation traces a code back to documentation created by a clinician during an encounter. Appeals review reconstructs what the original reviewer knew.

Every one of these is an examination of a trail. The trail is the product of a human doing work, and the work generates the evidence as a byproduct. Nobody had to design that. It came free.

Artificial intelligence does not generate it. A model produces an output. The output is the artifact. There is no reasoning captured unless someone built the capture, no criteria applied in a form anyone can inspect, no contemporaneous note, and no natural record of what the human who accepted the output actually did before accepting it.

So the compliance function is now accountable for a class of determinations that produce nothing it was designed to examine. That is the category error, and it explains a pattern that has confused a great many capable executives: they have funded governance, hired for it, bought platforms for it, and still cannot answer the surveyor.

The trail was never a compliance requirement. It was a byproduct of humans doing the work, and it came free until it stopped.

Accreditation will find this before a regulator does

Most executives are watching statutes. That is the wrong watchpost, because a statute arrives with a comment period, an effective date, and eighteen months of trade coverage. An accreditation survey arrives on a schedule the organization already agreed to.

URAC launched a Health Care Artificial Intelligence Accreditation in 2025, the first of its kind, structured with separate modules for developers and users of healthcare artificial intelligence. On August 3, 2026, URAC announced the first organizations to earn it. The program is not a set of principles. Its review examines whether an organization’s stated artificial intelligence principles are reflected in documented policies, practices, and oversight, across regulatory compliance, clinical and technical leadership, ethical oversight, risk management, data protection, workforce training, testing, transparency, and continuous quality improvement.

Read that standard closely. It is not asking whether the organization has an artificial intelligence policy. It is asking whether the policy is visible in what the organization actually does. That is precisely the evidence that automated determinations do not leave behind.

NCQA is moving on the same axis and on a firmer timeline for health plans. It opened public comment on the use of artificial intelligence in healthcare in early 2025, has stated that it is establishing expectations for artificial intelligence governance, transparency, and ongoing monitoring, and is folding proposed artificial intelligence standards into Health Plan Accreditation for 2027, with final standards and guidelines issued during 2026. The comment record showed strong support for a risk-based approach weighted to potential impact on patient safety.

NCQA accredits more than twelve hundred health plans covering over one hundred eighty million lives. Accreditation is nominally voluntary. In practice, states and purchasers require it, which means the standard functions as a condition of doing business rather than as a credential.

The 2026 standards already in effect give a preview of the direction. Non-urgent preservice utilization management decisions must be completed within seven calendar days, a must-pass element, and the utilization management program structure standard now requires more rigorous committee oversight. Those are workflow and governance requirements, not policy requirements, and they cannot be satisfied by a document.

So the sequence for a health plan is not the one most boards assume. It is not legislation, then enforcement, then audit. It is accreditation survey first, on a cycle already on the calendar, against standards being written this year for next year, evaluating evidence the organization is not currently generating.

Why buying more governance has not worked

A great deal of money has gone into artificial intelligence governance in the last thirty-six months, and very little of it has improved the answer to the surveyor’s question. The reason is structural rather than commercial.

Most governance tooling is built to hold artifacts. It stores policies, model cards, approvals, risk ratings, and review attestations. All of that is useful, and none of it is evidence of what happened in a specific determination. A repository of governance documents describes intent. A survey examines conduct.

There is also a sequencing problem that no product resolves. In most organizations, technology arrives through procurement and governance is applied afterward. Compliance is therefore asked to govern systems it did not select, cannot fully enumerate, and never approved, including capability embedded inside vendor products that were never purchased as artificial intelligence at all. The inventory gap that every assessment finds is not carelessness. It is the predictable output of an operating model in which the governance decision happens after the contract is signed.

And the function is being asked to absorb this while its existing obligations continue undiminished. Nobody removed a delegation audit to make room.

Four capabilities, and the connections between them

What the moment requires is not a bigger compliance department. It is a different architecture, built from four capabilities that most organizations currently hold in separate places, staffed by separate people, on separate cycles, with no connection between them.

REGULATORY INTELLIGENCE

A maintained view of what the rules are, what changed, when it changed, and what it obligates this organization to do differently. Not a subscription to alerts. A position, dated, with an owner. This capability is passive by nature. It informs, and then it waits.

COMPLIANCE OPERATIONS

The controls themselves, executing inside the workflow rather than described in a binder. The test is simple and unforgiving. If the control exists only in a document that someone opens quarterly, the organization does not have a control. It has a description of one.

ACCREDITATION READINESS

A standing capacity to produce evidence on the accreditor’s terms rather than the organization’s. This is the layer most often treated as a project that begins ninety days before a survey, and it is the layer where artificial intelligence exposure will surface first.

ARTIFICIAL INTELLIGENCE GOVERNANCE

A live inventory tied to owners, purposes, data sources, and controls, with defined escalation thresholds, monitoring that runs between reviews, and a contemporaneous record of what each system did and who reviewed it. This capability is active. It watches, and it does not wait to be asked.

The failure mode is building one without the others, and most of the industry is doing exactly that. Regulatory intelligence without governance is a well-read program that cannot see its own models. Governance without regulatory intelligence is a watchtower pointed at last year’s horizon. Either one without accreditation readiness produces an organization that is genuinely well governed and still cannot prove it in the room where proof is required.

The architecture is not the four capabilities. It is the connections between them. A rule change should move automatically into a control change, a control change into an evidence requirement, and an evidence requirement into something a surveyor can be handed. In almost every organization, each of those handoffs is currently a person remembering.

The same problem, four different shapes

This lands differently depending on where the organization sits, and the differences are worth stating plainly because the generic version of this argument is not useful to anyone.

ORGANIZATION	WHERE THE EXPOSURE CONCENTRATES
Health plans	Coverage determinations. Automated involvement in a denial, delay, or modification is now directly regulated in a growing number of states and sits inside utilization management standards under accreditation. The specific number an organization should be able to produce is the share of adverse determinations where a tool was in the path. Very few can.
Health systems	Clinical tools and the signature. Where a model drafts and a clinician signs, the professional and legal responsibility stays with the clinician and the institution, and the risks are anchoring on a confident draft and omission the reviewer never sees. Validation against the organization’s own population, rather than the vendor’s published performance, is the control most often skipped.
Third party administrators	Delegated accountability with contractual exposure. A TPA is frequently the operator of automated processes on behalf of plan sponsors who carry fiduciary duties they cannot delegate away. The exposure sits in service agreements written before automation reached this scale, and this is the least discussed position in the market.
Medical groups and MSOs	Coding, documentation, and volume. Automation concentrated in revenue cycle work converts a single methodological error into a pattern across every claim since the last review, which is precisely the profile that draws False Claims Act attention.

What unites them is the evidentiary problem. What differs is which determination the organization will be asked to reconstruct first.

The uncomfortable finding

There is a version of this argument that flatters the compliance function and blames the technology. It is not the accurate version.

The accurate version is that healthcare built a verification discipline on an assumption nobody ever wrote down, which is that decisions come with trails attached. That assumption held for as long as decisions were made by people, and it held so completely that it was never identified as an assumption at all. It was simply how the work was. Then the industry began deploying systems that make determinations without producing the byproduct the entire oversight apparatus was designed to examine, and it did so at a pace no governance function was funded to follow.

That is not a scandal, and it is not a failure of any individual compliance officer. It is the ordinary shape of fast adoption meeting a control environment built for a different mechanism. It is also correctable, and it is meaningfully cheaper to correct now than after a survey finding, a denial-practices inquiry, or a plaintiff’s request for the reasoning behind a specific determination.

But it will not be corrected by buying more governance. It will be corrected when organizations stop treating evidence as something produced at the end of a process and start treating it as something the process has to be designed to generate. That is an architecture decision, made by executives, before the technology is procured rather than after.

The surveyor’s question is not going to get easier. It is going to get asked more often, by more parties, about more determinations, and the organizations that can answer it will be the ones that decided the answer had to exist before anyone thought to ask.

Sources

URAC. Health Care Artificial Intelligence Accreditation, Artificial Intelligence in Healthcare 1.0, developer and user modules, launched 2025; announcement of first accredited organizations, August 3, 2026; published description of review scope and standards.
NCQA. Public comment on the use of artificial intelligence in healthcare, February and March 2025; overview memorandum on proposed artificial intelligence standards for Health Plan Accreditation 2027; Health Plan Accreditation 2026 standards updates including utilization management timeframes and program structure; public statements on artificial intelligence governance, transparency, and monitoring expectations.
State law. Enacted requirements in multiple states governing artificial intelligence in utilization review and adverse determinations. Tracked and maintained in the HLTHWORKS AI Regulatory Update.

This article is analysis provided for general informational purposes. It is not legal advice and does not describe the obligations of any organization under the law or accreditation standards of any jurisdiction. Accreditation standards and state requirements change frequently and should be confirmed against primary sources.

Also in The Standard

Article 12. Centene and the Limits of Discipline. When Congress rewrites your revenue.
Article 13. No Surprises, No Ceiling. The design flaw in the law that worked.
Resources. The AI Regulatory Update. The Preliminary AI Maturity Assessment. Twelve Questions Every Healthcare Board Should Ask About AI.

HLTHWORKS transforms Medicare Advantage, Commercial, and Medicaid health plans, driving efficiency in the business of health, impact in the value and quality of care delivery, and simplicity in the patient journey.