The article, authored by Chung-Feng Liu, Chia-Jung Chen, and Yen-Ling Ko of Chi Mei Medical Center in Taiwan, does not introduce new ethical principles. Instead, it takes the extensive existing landscape of international guidance, including the World Health Organization’s framework for AI in health and the NIST AI Risk Management Framework with its generative AI profile, and translates it into application-level specifications: concrete, observable, reviewable, and auditable controls embedded in individual AI services and clinical workflows. The authors organize these controls around three functional domains that map onto the life of any AI output: Capability, Explainability, and Communication.

The choice of these three domains is deliberate. Capability concerns what an AI service is designed to do, for whom, under what conditions, and with what performance and change-control requirements. Explainability addresses what information a user needs to understand, contextualize, verify, and appropriately limit reliance on an output. Communication governs how that output enters clinical work: how it is presented, timed, reviewed, acted upon, and recorded. The authors are careful to note that this is not a novel technical pipeline. Prior explainable clinical decision support systems have long combined model inference, explanation, and user-facing presentation. The unresolved opportunity, they argue, is to treat these familiar functional points as governance control points, locations where responsible AI requirements become concrete specifications, disclosures, monitoring indicators, and human-use constraints.

A key insight of the paper is that predictive AI and generative AI can coexist within the same hospital and even the same workflow, but they must not be governed as if their outputs and failure modes were equivalent. Predictive AI typically produces probabilities, classifications, or risk strata. Its governance hinges on target definition, prediction horizon, calibration, threshold selection, subgroup performance, external validity, drift, and the clinical burden created by alerts. A model with an impressive area under the receiver operating characteristic curve can still be unsafe if its threshold is poorly matched to disease prevalence, if calibration deteriorates after deployment, or if so many alerts fire that clinicians simply ignore them.

Generative AI, by contrast, produces task-oriented content: summaries, draft notes, reminders, retrieved knowledge, or conversational responses. Its distinctive risks include hallucination, prompt sensitivity, provenance, and the reliability of generated text. For generative systems, the framework emphasizes task boundaries, source traceability, hallucination control, version management, human verification, and strict constraints on write-back or autonomous action. A draft note is fundamentally different from a signed medical record entry, and a retrieved standard operating procedure excerpt is different from a medical order. Those boundaries, the authors insist, should be explicit in both system documentation and user-facing design. Despite these differences, both modalities share common governance needs: clearly bounded intended use, version control, transparency, risk-appropriate human review, post-deployment monitoring, incident handling, auditability, and mechanisms for change or withdrawal.

The framework’s practicality is illustrated through two dialysis-related AI services at Chi Mei Medical Center, which show how the same governance vocabulary can be instantiated differently across AI types. The first is a predictive AI service for intradialytic hypotension, whose performance findings were described in previously published work. In that service, the target event was defined as intradialytic systolic blood pressure below 90 mmHg within the next 60 minutes in adults receiving maintenance hemodialysis, with records lacking required clinical or laboratory information excluded. The model’s operating threshold was 0.35511, selected to balance sensitivity and specificity, and outputs were rescaled so that this threshold corresponded to 0.50 on the clinician-facing dashboard, providing a consistent boundary for displaying higher-risk results. Risk estimates updated every 15 minutes. In the test dataset, the model achieved a sensitivity of 0.858 and a specificity of 0.858, with an overall AUC of 0.936.

For that predictive service, the three domains take on concrete form. In the Capability domain, the specification covers the target event, prediction horizon, eligible population, threshold strategy, and ongoing monitoring. In the Explainability domain, clinicians receive clinically relevant context including blood-pressure trends, ultrafiltration information, prior-session data, and SHAP-based feature attribution, together with explicit disclosure that feature contributions describe model behavior rather than causal relationships and that uncertainty exists. In the Communication domain, risk is presented through stratified displays and alert messages linked to relevant standard operating procedures, with acknowledgement and override mechanisms that let clinicians retain decision authority while action records support traceability and audit.

The second example is a generative AI-assisted dialysis rounding support service, implemented in clinical practice since April 2024. The authors are careful about its status: the service supports physicians during dialysis rounds without replacing clinical judgment and has not undergone prospective clinical validation. For this system, the Capability domain would define permitted support tasks, output constraints, model and prompt versions, and conditions under which generation should be withheld or escalated when source information is insufficient. The Explainability domain becomes a matter of traceability rather than feature attribution: generated statements should be linked, where feasible, to identifiable clinical sources, timestamps, retrieved documents, or evidence markers, with retrieved content distinguishable from model-generated synthesis. The Communication domain requires that any incorporation of generated content into the clinical record be reviewed and confirmed by an authorized clinician, with explicit write-back restrictions and retention of source information and user modifications. The authors stress that these are application-level governance specifications illustrated through the service, not a claim that every listed control has been fully implemented or evaluated.

Beyond the case studies, the article carries broader implications for how hospitals review AI. A governance committee using this vocabulary can ask not merely whether a system is transparent or human supervised, but where transparency is implemented, which limitations are visible, which user is expected to review the output, what action is permitted, and which monitoring indicator will reveal deterioration or misuse. The same vocabulary can be used by clinical teams, information departments, AI centers, cybersecurity teams, and governance reviewers, with controls proportional to clinical risk. The authors also emphasize that governance should not be applied only after a service is built: application-level specifications can function prospectively as design requirements and retrospectively as review criteria, in an iterative reconciliation of work-as-imagined in policy documents with work-as-done at the bedside.

The authors are candid about limitations. The proposed specifications are derived from established governance guidance, clinical AI literature, and practical implementation experience, but they are not exhaustive and have not been validated as a universal instrument. Different specialties, risk levels, user roles, and organizational maturities may require additional controls, and the two dialysis applications are illustrative rather than comparative evaluations, providing no evidence that the three-domain approach improves safety, usability, or clinical outcomes. Future work, they suggest, should test whether domain-based specifications improve the consistency and completeness of governance review, using expert assessment, structured clinical walkthroughs, cross-institutional comparison, and prospective measurement of operational indicators such as alert burden, override patterns, review time, adoption, revision of generated drafts, and safety events. As predictive and generative AI increasingly coexist in healthcare, the authors argue for a middle path: neither collapsing them into a single risk category nor building entirely separate governance systems, but maintaining a shared functional vocabulary with differentiated specifications, so that responsible AI becomes an ongoing process of oversight rather than a one-time approval decision.

Subject of Research: Operationalizing responsible AI governance in clinical practice across predictive and generative AI

Article Title: From principles to practice: operationalizing responsible AI governance across predictive and generative clinical AI

Article References: Liu, C.-F., Chen, C.-J., & Ko, Y.-L. (2026). From principles to practice: operationalizing responsible AI governance across predictive and generative clinical AI. Frontiers in Digital Health, 8, 1965076. https://doi.org/10.3389/fdgth.2026.1965076

Image Credits: AI Generated

DOI: 10.3389/fdgth.2026.1965076

Keywords: responsible AI governance, clinical AI, predictive AI, generative AI, explainability, clinical workflow, dialysis, healthcare policy, human-AI interaction, electronic health records, risk management, digital health