Institutional Approval Is Not Public Authorization: Legitimacy as a Governance Requirement for Clinical AI
Journal of Medical Internet Research ·
Clinical AI governance has advanced rapidly in technical validation, regulatory compliance, risk management, human oversight, and postdeployment monitoring. Yet a more fundamental question often remains implicit: under what conditions are health institutions justified in exercising consequential authority through AI over patients, clinicians, and communities? In this Viewpoint, we argue that legitimacy should be recognized as an independent governance requirement, distinct from technical assurance, legal and ethical compliance, trust, acceptance, and institutional approval. Our aim is to distinguish institutional approval from public authorization and to propose a normative framework for authorizing consequential clinical AI deployments. We address health system leaders, clinical AI governance and procurement teams, frontline clinicians, and patient and community representatives. Drawing on theories of legitimacy and public value and published clinical AI governance research, we make the following contributions: (1) the concept of the unclaimed decision, defined as a consequential choice about purpose, threshold, population, or priority for which no actor clearly assumes responsibility for public justification; (2) a tripartite framework comprising procedural authorization, substantive justification, and relational renewal; and (3) practical governance tools to support public justification, contestation, and renewal. These tools include 3 minimum auditable conditions: visibility of deployment; affected-party input before governing conditions are fixed; and conditional reviewability, which requires a predefined trigger that can be invoked by a named actor outside the deploying team. A 5-question public authorization test examines purpose, distribution, exclusion, meaningful choice and contestability, and renewal. Governance intensity should increase with clinical consequence; distributive reach; difficulty of reversal; and the absence of genuine, informed choice. For smaller health care organizations, we propose ways to perform the same core governance functions through existing advisory bodies, targeted interviews, shared regional resources, and standardized documentation. We also outline a heuristic for identifying affected publics, procedures for specifying participation authority and resolving disagreement, and procurement provisions that preserve reviewability across vendor boundaries. These are normative proposals requiring evaluation. Public authorization requires continuing substantive justification; it cannot be inferred from compliance, popularity, or completion of an audit checklist.