Behind the Committee: Why Governance, Build-vs-Buy, and Epic Are Now One Problem

Why this issue exists

One buyer. One claim. Tested against what's actually happening in the market — that's the standard this newsletter is holding itself to now, starting last issue. No panels. No roundups. A claim on trial.

This issue's claim still comes from UC Health's VP of Operations, because it turned out to have more to say than one issue could cover. Last time, we tested it against a regulatory event and a funding round. This time, we're testing it against three specific forces you told me you're hearing about in the market right now: AI governance committees, hospitals building instead of buying, and the gravitational pull of Epic. All three turn out to be the same story wearing different clothes.

Curb moment: A chorus of quotes builds a newsletter. One claim, tested three ways, builds authority.

The Claim: The Committee Isn't the Wall. It's the Filter.

UC Health's VP of Operations oversees a 15-hospital system that scaled from a loose network of independently run facilities into one of the most standardized health systems in the country. The rule there: any new technology has to work across all 15 hospitals, not just one. That standardization runs through more than 500 governance groups, and a new vendor rarely touches just one of them.

Supply chain. IT. The innovations team. Finance. Each one owns a piece of the yes. Rip-and-replace, by that account, is a fundamentally harder sale than filling a gap — you have to beat the combined switching cost across every department absorbing the change, not just the incumbent's invoice.

That was the claim last issue. Here's the update: the 500 committees described at UC Health were built for a world with one kind of filter — procurement governance. In 2026, that world got three new residents.

Curb moment: 500 committees don't exist to say no. They exist to make sure nobody has to say yes alone — and now they've got company.

Stress-Test #1: AI Governance Committees Aren't That Same Committee. They're a New One, Stacked on Top.

If the filter theory is right, we'd expect any new category of organizational risk to spawn its own governance layer rather than get absorbed into the old one. That's exactly what happened with AI.

Twenty-one states now have healthcare AI statutes, and 47 states introduced more than 250 healthcare AI bills in 2025 alone. Colorado's SB 24-205, the first broad U.S. "high-risk AI" statute, took effect June 30, 2026, requiring formal impact assessments and consumer notifications for consequential clinical or financial AI decisions. Indiana's HB 1271 and Alabama's SB 63 followed within weeks, each adding its own disclosure and certification requirements. This is not one national rulebook. It's fifty potential rulebooks, and a health system operating across state lines has to satisfy all of them at once.

Mayo Clinic's own numbers show what that looks like in practice: its executive-led governance process reviewed and approved more than 100 clinical AI applications in 2026 alone, evaluating each one for complexity, clinical setting, performance, patient safety, training, workflow integration, privacy, security, and life-cycle management — with tools flagged as complex or time-urgent barred from use without proactive clinician review. That's not the supply-chain-and-finance committee described above. That's an entirely separate legal, compliance, and clinical governance stack, reviewing the same product a second time from a different angle.

And most health systems aren't ready for the version of this that's coming. Only 22% of hospital leaders say they could produce a 30-day AI audit trail on demand. Only 23% have Business Associate Agreements in place for their third-party AI tools, even though 66% of physicians are already using AI tools day to day. AI-related enforcement actions rose 340% between 2020 and 2025. Kaiser Permanente affiliates recently paid $556 million to resolve allegations tied to unsupported AI-assisted coding. Pennsylvania sued Character.AI in June 2026 after its chatbots allegedly posed as licensed physicians. This is the layer founders keep discovering exists only after they've already cleared procurement.

Curb moment: You don't get one committee anymore. You get the original committee, and then a second one that didn't exist two years ago, asking harder questions.

Stress-Test #2: Hospitals Aren't Uniformly Building or Buying. They're Splitting the Decision By Function.

Here's where the market gets more interesting than the headlines suggest. "Hospitals are building everything in-house now" is half true — and the half that's wrong is the half most founders are reacting to.

Innovaccer's 2026 payer AI report found nearly 80% of health plans, across 63 major insurers surveyed, now prefer vendor-built AI over in-house development — a swing away from the do-it-yourself instinct payers had a few years ago.

Hospital systems are moving the opposite direction on specific functions: several are standing up internal AI engineering teams of 8 to 15 engineers paired with clinical informatics staff, and moving AI-assisted medical coding in-house rather than paying vendor SaaS fees for it.

But the same health systems making that call are, in other departments, doing the exact opposite. Trinity Health, a large Catholic system, just outsourced its IT service desk and applications support entirely to an outside technology partner. Build-vs-buy in 2026 isn't a hospital-wide philosophy. It's a function-by-function bet, decided differently in coding, in IT operations, and in clinical AI — often inside the same organization in the same quarter.

Founders who walk into a pitch assuming "they'll build this themselves" or "they always buy from vendors" are both making the same mistake: treating build-vs-buy as a personality trait of the hospital, instead of a line-item decision made department by department.

Curb moment: The hospital isn't a builder or a buyer. It's both, in different rooms, in the same week.

Stress-Test #3: Epic Doesn't Need to Win the Room. It's Already the Room's Default Assumption.

The third force is the one founders feel but rarely name correctly. It's not that Epic is out-competing digital health vendors feature for feature. It's that Epic has quietly become the default answer to "why would we need a separate vendor for this?" before the pitch even starts.

Epic entered 2026 with more than 150 new AI features in development under its "Healthcare Intelligence" strategy — expanding Art, Penny, and Emmie, launching EpicOps as a healthcare-specific ERP, and rolling out Agent Factory, a no-code builder that lets health systems design and deploy their own AI agents directly inside the Epic environment on their own timeline. Layered on top is Curiosity, a family of foundation models trained on Epic's Cosmos network of real-world patient records.

And the incumbency behind that expansion is close to absolute: reporting this year found only two large health systems — those with more than 10 hospitals — made an enterprise-wide EHR switch decision at all in 2026. Epic isn't fighting for share. It's holding a position nobody is contesting at scale.

There's a real complication worth naming, though, because it's the honest nuance and not just the scary headline: Adam Farren, CEO of Canvas Medical, said plainly after HIMSS 2026 that he doesn't think hospitals are organizationally ready to actually use Agent Factory.

The threat to founders isn't that Epic has already replaced them. It's that Epic has become the assumed starting point every governance committee, every AI review board, and every build-vs-buy debate now measures a vendor against — whether or not the hospital has actually turned that assumption into a working tool yet.

Curb moment: You're not being out-featured by Epic. You're being pre-judged against it.

The Provocation

Here's where I push back on my own source, because that's the job.

The original claim still holds — the committee is a filter, not a wall. But it needs a 2026 update, and it's a bigger one than "the committee got slower." It's that the single filter described at UC Health has quietly become four: the classic procurement committee, a brand-new AI governance stack with its own legal exposure and state-by-state variation, an internal engineering team competing for the same budget line on a function-by-function basis, and Epic sitting underneath all three as the assumed default that every other option gets measured against.

Most digital health go-to-market motions are still built to clear exactly one of those four gates — the original procurement committee — because that's the only one that existed when the playbook was written. Nobody updated the playbook when the other three showed up.

That's the real reason deals that used to take six months now take fourteen: not that healthcare "got harder to sell," but that the number of independent veto points quietly quadrupled while sales training stayed exactly the same.

You're not pitching one buyer anymore. You're pitching a procurement committee, a compliance function that didn't exist two years ago, an internal engineering team that thinks it can build your product in a sprint, and an EHR vendor that's already inside the building and already assumed to be the answer.

Curb moment: Founders keep training reps to clear one gate. The market quietly built three more.

Commercial Corner: What This Means for Your Sales Motion

Build your AI governance packet before anyone asks for it — model cards, bias-testing summary, audit logs, override and escalation documentation, and a state-by-state compliance answer. Treat the AI governance committee as a first buyer, not a rubber stamp after IT signs off.

Stop asking "does this hospital build or buy?" Ask which specific function you're selling into is currently being built, bought, or outsourced this quarter — Trinity Health and its own AI coding team prove that answer changes department to department inside the same system.

Have your "why not just use Epic" answer ready before the meeting starts, not as a rebuttal after someone raises it. If you don't integrate with or extend Agent Factory, Cosmos, or FHIR, you're implicitly asking the committee to justify a second platform they didn't plan for.

Track your target states' AI statutes the way you track competitors — 21 states and rising means a workflow that clears governance in Ohio may need a redesigned disclosure step in Colorado.

Curb moment: Founders chase the signature. The market is now grading four relationships at once.

SigCom Interpretation

This is what I think most people covering digital health commercialization are getting wrong right now: they're still describing a market with one gate, when the sophistication required to sell into a hospital just jumped again — not because buyers got smarter, but because the number of independent veto points quietly multiplied while nobody rewrote the playbook.

Winning in this environment means being fluent in four different languages at once: procurement, AI governance and compliance, internal engineering economics, and the Epic ecosystem roadmap. Most vendors are still fluent in exactly one. That gap — not funding, not features — is the actual commercialization story of 2026.

Curb moment: Four gates. One playbook is still being written for the first one. That's the whole ballgame.

The Lab Note

Next issue, one new voice, one new claim, tested the same way. If you're a hospital, health system, or payer executive with a claim about how your organization actually buys — one you think would survive this kind of stress test — I want to talk to you directly.

If you're a founder: of the four gates above, which one wasn't even on your radar a year ago?

No hype. No promotion. Just signals.