There is no doubt that AI is a powerful tool for occupational healthcare practitioners, but without a robust governance program in place, the benefits it could bring can potentially turn into legal and reputational issues. This was the key takeaway from Stephanie Eckerle’s presentation on AI governance at AOHC 2026.
But far from leaving session attendees with looming fear, uncertainty, and doubt, Eckerle, the Healthcare Practice Chair at Kreig DeVault LLP, laid out a clear pathway and plan for occupational health teams to approach AI integration with confidence. Eckerle laid out a four-step plan that organizations can use to get started on their AI journey.
1. Conduct a Survey
For Eckerle, the first step to building a viable AI governance program is to conduct a survey to understand who is using AI already, how are they using it, for what job functions, and why. “AI is a powerful tool,’ she shared. “Your employees, medical providers, and customers are already using it.” By understanding the lay of the land on current AI usage, it helps clarify existing risk exposures from shadow IT, but it also helps identify potential quick-win use cases, like ambient scribing, because team members are already familiar with tools, processes, and how to use them.
2. Gather a Multi-Stakeholder Committee
Once that knowledge and use base has been established, Eckerle recommends bringing together a coalition of stakeholders including representatives from occupational health and environmental health and safety, legal, compliance, IT, HR, communications, operation, security and privacy, IP, and third-party vendor partners. “Most companies don’t cast the net wide enough,” Eckerle shared. “By building a broad coalition not only does everyone have a stake in the decision, but a stronger framework can be built covering usage, reporting, communications, training, discipline, budgeting, and annual reviews and assessments.”
3. Building a Legal Framework
To protect an organization, its employees, and their data, building a legal framework is imperative. However, because of the speed at which AI development and adoption is moving, Eckerle noted that it’s creating unique challenges for legal teams. “When the final statement for HIPAA was released in 2000, AI was not even a consideration,” she explained. Instead of being able to refer to an established body of law, the team needs to be able to pull together information from multiple relevant sources, including state laws and city ordinances, federal agency AI governance standards, The European Union Artificial Intelligence Act, and nascent guidance from HIPAA’s Proposed Security Rule covering topics closely related to AI in cybersecurity and ePHI. Using these sources of knowledge, the team can then evaluate how existing law applies to AI.
4. Use Third Party Certification to Validate Vendors
In the field of occupational health, most AI will be integrated into company networks and infrastructure in the form of third-party provided apps and products. For example, state-of-the-art OEHRs now come with AI scribes and automations to reduce administrative workloads and improve workplace compliance. While this doesn’t remove the need for a robust internal governance program, Eckerle noted that the vendor community is moving more quickly to establish standards and AI certifications. Her guidance here is to look to Drummond’s pDSI-Risk certification, which enables vendors to gain certification by demonstrating compliance with strict standards.
The role that AI plays in the workplace, including occupational health, is going to continue to move swiftly and push the boundaries of certainty for legal, security, compliance, and healthcare teams. However, by working with experts, trusted industry partners, and experienced certification authorities, occupational health teams will be able to confidently adopt AI and AI-enabled solutions.