By Avishek Mukherjee, Chief Product and Technology Officer, Verato
Gartner® predicts that by 2029, over 70% of enterprise agentic AI initiatives will fail due to companies overstating what their AI agents can do and not paying enough attention to practical use cases, risk, compliance, and auditing. They also caution that by 2028, 40% of agentic AI projects will be cancelled due to escalating costs, unclear business value or inadequate risk controls. Unfortunately, we’re seeing more than just overhyped chatbot capabilities and cost controls as challenges to successful agentic AI adoption.
The recent news of AI agents going rogue — most notably Open AI’s Hugging Face hack, followed by Anthropic’s attack on GitHub and Meta’s model hacking a third-party service — has raised alarms for companies to halt or delay the rollout of new models before they become unmanageable. Government officials have warned that these unprecedented attacks could lead to “potentially cataclysmic results” and should “serve as a wake-up call.” Hugging Face, in its security incident disclosure shortly following the “intrusion,” underscored that AI platforms are “uniquely exposed” in the data-processing pipeline.
As the tech industry cautiously awaits the results of Open AI and Hugging Face’s “thorough review, along with external advisors and with oversight from the Safety and Security Committee,” it behooves any company engaging in generative or agentic AI to develop its own stance on governance and oversight. This is especially true when it comes to healthcare companies.
Defeating the 10-headed monster (vendors)
Governance and oversight can be especially tricky for healthcare companies because of the reliance on external vendors to fill various software needs. Malicious acts can run in both directions, from the enterprise to the third-party provider, and the other way around, as Meta has recently discovered with its “misconfiguration.”
One department is testing a generative AI tool to create a call center chatbot, another is deploying an agentic workflow for marketing, while a third is working with a different vendor on a completely separate use case. Each initiative is warranted, but collectively they can create a fragmented AI environment with different technologies, different data, different risk assumptions, and different definitions of success. More AI projects don’t necessarily mean more AI progress. Without a connective tissue running throughout to prevent one rogue actor from infecting an entire system, you’ve created what I call the “10-headed monster.”
AI readiness can only be accelerated safely if there first exists a trusted foundational layer. This is why identity-first MDM (master data management) is essential to deliver intelligence that unifies, enriches, and manages identities across systems. Accurate identity infrastructure enables organizations to scale AI adoption, interoperability, and personalized patient care across the healthcare ecosystem.
Defeating the 10-headed monster of siloed software solutions requires a centralized data infrastructure that ensures all AI workflows and software is operating within strict protocols for AI governance.
Healthcare needs an identity layer for agents
In healthcare, where keeping track of patient records has historically been difficult due to the number and complexity of systems involved, data governance must go hand-in-hand with identity security. Healthcare providers, payers, health information exchanges (HIEs), and digital health platforms must synchronize populations, discover shared individuals, and support secure interoperability at scale. At the same time, security software companies, MDM companies, and identity management companies must all work together to ensure interactions with patients, as well as AI agents, are fully considered.
In its abstract, Hype Cycle™ for AI Governance Technologies, Gartner® explicitly identifies operationalizing agentic governance, i.e., treating AI agents as governed entities with explicit permissions and monitoring, as one of six thematic domains organizing the 2026 AI governance technology landscape. These protocols operationalize an organization’s AI policies by providing oversight, risk management, compliance, observability, and security across the AI life cycle.
We need to think of these agents as yet another user of our data. AI agents are being designed for a range of healthcare workflows and each depends on knowing who the agent is interacting with and which records, relationships, and identity signals apply. In other words, AI systems need to know that the information they’re using belongs to the right patient, member, provider, or organization. Without identity context, agents risk acting on incomplete, duplicated, or incorrect data. As AI agents increasingly interact across systems, trusted identity needs to become part of the governance framework itself.
Cross-functional teams will steer the AI ship
If AI is to reduce the workload of humans so they can be freed up for other tasks, we need to have humans from all across the organization play a role in its development and safeguarding. Every company needs to implement a cross-functional steering committee that aligns business leaders, clinical leadership, IT, and data governance that work from a shared set of data standards with clear ownership of protocols. Physicians and other clinical leaders play a particularly important role in establishing trust, helping determine whether AI-enabled technologies are clinically appropriate, sufficiently tested and capable of supporting the quality of care and patient outcomes expected before they are broadly adopted..
The SAP LeanIX Agentic AI Survey 2026 notes that 63% of companies say enterprise architects should lead AI agent governance — yet only 34% are actually involved today. We must get the right people into the room talking as a first step in any workable governance structure.
A cross-functional steering committee can establish shared principles around questions such as:
- What problems are we trying to solve with AI?
- What data can an AI system access?
- Who is accountable for its outputs and actions?
- Where is human review required?
- How will we evaluate safety, accuracy, and bias?
- What happens when an AI system makes a mistake?
- How do we monitor performance after deployment?
The organizations that scale AI successfully won’t have the most pilots, they’ll have the clearest governance models, defined accountability, and meaningful input from the stakeholders affected by how AI is used.
Don’t just implement, measure
Taking smaller steps and iterating through the design based on results will be the only way to succeed and make sure we don’t get “outsmarted” by the bots. That’s why you need a measurement engine to assess the efficacy of your AI projects. This entails having clearly-defined KPIs (key performance indicators) and OKRs (objectives and key results) before deployment, monitoring ROI, tracking adoption, and placing an equal reliance on patient and operational outcomes — not just implementation speed.
Princeton University’s Holistic Agent Leaderboard (HAL) advises to distinguish between reliability and capabilities when measuring AI success:
“Organizations should require reliability certification before deployment, not just capability assessment. Treat reliability as a deployment prerequisite, similar to aviation safety standards. Set minimum thresholds for consistency and safety before production deployment, implement incident reporting, and use multi-dimensional reliability metrics to guide change management decisions.”
We can take a lesson from the industry’s experience moving to the cloud. Many companies found efficiencies and created value as a result of shifting operations to the cloud. Those who initially failed in these efforts didn’t think through the right measurement, OKRs, and tracking in their rush to jump on the SaaS bandwagon. We can’t afford to make the same mistakes with AI, the stakes are far too great.
Governance as a help, not a hindrance
The recent spate of rouge AI infiltrations has shown that governance is no longer a barrier to innovation, but a prerequisite. There’s a difference between stopping a project and guiding the project. Even if this means we move slower, at least we are moving in the right direction with a designated committee or steering group to guide these projects and investments.
BigID notes that regulations such as the European Union Artificial Intelligence Act (EU AI Act) and the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework (NIST AI RMF) require auditability that many organizations cannot yet demonstrate. Governance programs must enforce policies across these frameworks, along with General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS).
We should not think of such enforcements as bureaucracy, meddling, interfering, or impeding growth. Rather, governance is what enables innovation to scale safely and produce measurable value — it’s how we will win at the AI game. As the latest attacks have shown, governance is more than just the right thing to do, it’s essential if we’re going to avoid potentially catastrophic consequences.
Every health system is different. You can learn from each other, but ultimately, you each have to design your own strategy. Info-Tech Research Group offers a blueprint to help you understand the components of an adaptive AI governance framework — from assessing your current capabilities to establishing your foundational AI principles and organizational structure, to developing an AI risk and compliance program, implementing policies, ensuring accountability, and more.
Good governance doesn’t slow healthcare AI down, it gives organizations the confidence and structure to move faster knowing their systems, and their data, are protected.
Walking the talk
As an established leader in data security, Verato’s position on this matter has been clear since our inception. Our achievement of HITRUST r2 Certification demonstrates that Verato’s platforms have met demanding regulatory compliance and industry-defined requirements for appropriately managing risk. It places Verato in an elite group of organizations worldwide that have earned this certification and represents the pinnacle achievement in data security.
At Verato, we walk the talk on AI governance for our own systems so that our clients can trust our SaaS solutions to keep their data secure. In addition to HITRUST, Soc 2 Type 2 certification and HIPAA compliance, we have been also been focused on building an AI steering committee to ensure the foundation for our own use of emerging technologies. This is something other organizations must implement, especially if they’re going to take on vendor-centric projects, otherwise the chances of future AI attacks grows exponentially with each new autonomous agent.
Anahita Tafvizi, Chief Data and Analytics Officer at Snowflake® reveals in their AI predictions for 2026, that despite AI’s extraordinary pace of innovation,
“Gaps in data readiness, governance frameworks, and organizational skills are holding many companies back. The next wave of AI adoption…will create clear divides between companies, and even entire industries, that are prepared to scale versus those still stuck laying the groundwork.”
Anahita Tafvizi, Chief Data and Analytics Officer, Snowflake®
It’s not too late to lay that groundwork, in fact, it should take precedence over every other AI pilot or program in the works or on the horizon.
Done correctly, governance will be the enabler of innovation, not disabler. With the right structure and the right team, and a foundational layer of identity as the connective tissue among systems, this will be the next indicator of success for companies playing in the AI sandbox.
Gartner® and Gartner® Hype Cycle™ are trademarks of Gartner, Inc. Snowflake® is a registered trademark of Snowflake Inc. Verato does not imply any affiliation or endorsement by use of these marks.