The director of pharmacy at a regional health system told the story this way. An AI prior-authorization (PA) tool had quietly spread across three of her sites, adopted at each one by a different enthusiastic technician who had found it useful, configured it slightly differently, and told no one above them. It was, by every site-level account, working well: turnaround times were down, technicians were happier, patients were getting on therapy faster. Then a specialty pharmacist at the fourth site flagged that one configuration was auto-populating a clinical criterion from a cached payer rule that was four months out of date, which meant a stream of submissions had been quietly asserting a criterion the payer no longer used. Nobody had decided to deploy that tool. Nobody owned its configuration. Nobody was monitoring whether it drifted. And when the director asked the obvious question, who is responsible for how AI is used across this pharmacy, the honest answer was nobody, which is to say everybody, which is to say no one. That gap, the absence of a body whose job is to govern AI deliberately rather than letting it accrete by accident, is exactly what a pharmacy AI governance committee exists to close, and standing one up is the first concrete act of AI leadership at this level.

Why a Committee, and Not Just a Policy

The instinctive first move when a pharmacy realizes AI has outrun its oversight is to write a policy: a document that says AI output must be verified, patient information must be protected, the pharmacist owns the clinical call. Policies matter, and a governance committee will produce them, but a policy alone fails for a reason worth understanding clearly. A policy is static; AI use is not. Tools change, vendors push updates, new use cases appear, configurations drift, staff turn over, and a payer changes a rule that a cached model never learns about. A document written in March cannot govern a tool that behaves differently in September, because a document does not watch, decide, or correct. What governs is not the policy but the body that owns the policy, monitors against it, and updates it as reality moves. The committee is the living thing; the policy is one of its outputs.

This is the distinction between governance as an artifact and governance as a function. An artifact sits in a binder and is produced when an auditor asks for it. A function is a standing capability: a named group, meeting on a cadence, with the authority to decide which AI tools the pharmacy uses, the duty to monitor how they perform, and the obligation to respond when something goes wrong. The director in the opening story did not lack a policy; she could have pointed to a sentence in her general technology policy that said tools should be vetted. What she lacked was a function: anyone whose actual job was to vet AI tools, watch them, and own the consequences. The committee supplies the function, and the function is what an accreditor, a board, and a patient-safety review will actually look for, because a function is what catches the out-of-date payer rule before it becomes a stream of misrepresented submissions.

A policy is an artifact that sits in a binder. Governance is a function: a named body that decides, monitors, and corrects. The committee is the living thing; the policy is one of its outputs.

The Mandate: What the Committee Actually Owns

A committee without a clear mandate becomes a meeting where people discuss AI and nothing happens, which is worse than no committee because it creates the appearance of governance without the substance. The mandate must be written, specific, and backed by real authority, and it should cover four things the committee owns end to end. The first is selection: the committee decides which AI tools the pharmacy adopts, which means no tool reaches clinical workflow without passing through it. This single rule would have prevented the opening story, because the three sites could not have each quietly adopted a tool that had not been through the committee. The second is deployment: the committee owns how a selected tool is configured, where it is used, and under what verification requirements, so that a tool is not just approved in the abstract but deployed under defined conditions.

The third thing the committee owns is monitoring: the ongoing watch over how deployed tools are performing, whether they are drifting, what errors are surfacing, and whether the verification discipline is holding in practice rather than just on paper. This is the part most easily neglected, because selection and deployment feel like discrete projects with endpoints while monitoring is a forever job, but it is the part that catches the four-month-old cached rule. The fourth is correction and response: when a tool produces a clinical error, when a near miss occurs, when a vendor update changes behavior, the committee owns the response, which is the subject of the next lesson. Put together, the mandate is the full lifecycle of an AI tool in the pharmacy: select it, deploy it under conditions, watch it, and fix or retire it when needed. A committee that owns all four governs; a committee that owns only the first two approves tools and then loses sight of them, which is how the opening story happens even with a committee in place.

The mandate also needs teeth, which means the committee's decisions are binding, not advisory. If a site can adopt an AI tool the committee did not approve, the committee does not govern; it merely opines. The authority to say no to a tool, to halt a deployment that is producing errors, and to require verification conditions before a tool goes live is what separates a governance committee from a discussion group. That authority should be granted explicitly by whoever leads the pharmacy organization, in writing, because authority that is assumed rather than granted evaporates the first time a powerful site director wants to do something the committee opposes.

It helps to make the mandate concrete by naming what it does not cover, because an overreaching committee fails as surely as a toothless one. The committee does not make the individual clinical call on any given order; that remains the verifying pharmacist's, always, under the cardinal rule that AI supports the pharmacist's judgment and never replaces it. The committee does not micromanage every prompt a technician types. What it governs is the systemic layer: which tools exist, how they are configured, under what conditions they run, how they are watched, and what happens when they fail. The line is worth drawing explicitly in the charter, because a committee that tries to govern individual clinical decisions will both fail at it and lose the credibility it needs to govern the systemic layer where it genuinely belongs. Governance sets the conditions inside which clinical judgment operates; it does not substitute for that judgment.

Who Is at the Table: The Seats That Matter

The composition of the committee is not a formality; it is the design decision that determines whether the committee can actually see the risks it is meant to govern. A committee of the wrong people will miss the things it most needs to catch. The seats are defined by the perspectives that must be in the room, and there are four that a pharmacy AI governance committee cannot do without.

Patient safety. Someone whose explicit job and orientation is patient safety must sit on the committee, because the entire reason AI governance matters in a pharmacy is the patient at the end of every workflow. This is often a medication-safety officer, a quality lead, or a clinical pharmacist with a safety mandate. Their question in every discussion is the load-bearing one: if this tool is wrong, what happens to a patient, and what catches it before then. Without this seat, the committee will optimize for efficiency and convenience and will systematically underweight the asymmetry that defines the whole program, that a wrong renal dose or a hallucinated criterion is not an efficiency miss but a safety event.

Clinical. A practicing clinical pharmacist, ideally one who actually uses the tools in question, must be at the table, because governance designed without the people who do the work produces rules that are either unworkable or quietly ignored. The clinical seat keeps the committee honest about how AI actually shows up in the workflow, where verification is realistic and where a rule will simply be bypassed under queue pressure. The clinical voice is also the one that can tell whether a proposed verification requirement is meaningful or theater.

Operations. Someone who owns the operational reality, the workflow, the staffing, the throughput, must be present, because an AI tool lives inside an operation and a governance decision that ignores operational reality will not survive contact with a busy pharmacy. The operations seat ensures the committee understands the pressures that make people skip verification, the staffing that determines whether a control is feasible, and the throughput consequences of a governance choice. Governance that is operationally naive gets overridden in practice, which is the same as not governing.

Compliance and privacy. A compliance or privacy representative must hold a seat, because AI in a pharmacy touches protected health information (PHI), which is patient data covered under HIPAA (the Health Insurance Portability and Accountability Act), and it operates under board of pharmacy expectations and the URAC (Utilization Review Accreditation Commission) Health Care AI Accreditation. The compliance seat keeps the committee oriented to what regulators and accreditors will ask, ensures PHI is handled correctly in every AI tool, and connects governance decisions to the documentation that accreditation readiness will require. Without this seat, the committee may govern for safety and operations while quietly accumulating compliance exposure it cannot see.

Two further perspectives belong in the room as needed, even if not as permanent voting seats. Information technology or informatics matters because AI tools touch the dispensing system, the electronic health record (EHR) medication module, and the data flows between them, and a governance decision made without understanding the technical integration can be unworkable or unsafe. A pharmacy that approves a tool the IT seat knows pipes PHI to an unvetted external service has governed in name only. And a technician voice is often undervalued and frequently essential, because technicians are the ones actually operating many AI-assisted PA and submission workflows, and the opening story began precisely with technicians adopting a tool no committee had seen. A committee that hears only from pharmacists and directors will miss the texture of how AI is really used at the bench. The principle behind the whole composition is simple: the committee must contain every perspective from which a real AI risk becomes visible, because a risk no one at the table can see is a risk the committee cannot govern, and the failures that hurt patients tend to live exactly in the blind spots a narrow committee leaves open.

Leadership, Cadence, and the Records It Keeps

Four seats define the perspectives; the committee still needs a chair with the authority to convene it, hold it to its mandate, and make its decisions stick. The chair is frequently the director of pharmacy or a designated AI lead, and the choice matters because the chair's organizational weight is what gives the committee's binding decisions their force. A committee chaired by someone with no authority produces recommendations that powerful people ignore. The chair also owns the committee's relationship to the broader organization, escalating to executive leadership when an AI risk exceeds the pharmacy's authority to manage, and connecting the pharmacy's AI governance to any enterprise-level AI oversight that exists above it.

Cadence is the next design choice, and it should match the pace of the risk. A committee that meets once a year cannot govern a domain where vendors push updates monthly and configurations drift weekly. A practical cadence is a regular standing meeting, often monthly, with the explicit ability to convene on short notice when an incident demands it, because an AI clinical error cannot wait for the next scheduled meeting. The cadence is not bureaucratic ritual; it is the heartbeat that turns the committee from a one-time approval body into the standing function that monitoring requires. Between meetings, the committee's monitoring duties continue through whoever owns the day-to-day watch, with the meeting serving as the point where what was observed becomes a decision.

Finally, the committee must keep records, and this is not an afterthought but a core output, because the committee is the body that produces the governance evidence the pharmacy will need. Every decision the committee makes, to adopt a tool, to set a verification requirement, to respond to an incident, to retire a tool, should be documented: what was decided, why, by whom, and when. These minutes and decision logs are not bureaucracy; they are the demonstrable record that governance happened, which is exactly what an accreditor means when they ask to see your governance, and exactly what a board or a patient-safety review will request after an event. A committee that decides well but records nothing leaves the pharmacy unable to prove it governs, which, to an external reviewer, is indistinguishable from not governing at all. The record is the proof, and the committee is its author.

The First Ninety Days: From Charter to Function

A committee that exists on paper but has never done anything is not yet a governance function, so the move from charter to working body matters as much as the charter itself. The first concrete act is an inventory: the committee's opening job is to find out what AI is actually in use across the pharmacy, which, as the opening story shows, is rarely what leadership believes. Tools adopted quietly at the site level, features embedded in systems the pharmacy already runs, vendor capabilities switched on without a decision, all of it needs to be surfaced, because a committee cannot govern what it cannot see. This inventory frequently produces the uncomfortable discovery that AI is more widespread and less governed than anyone assumed, which is precisely the value of doing it.

With the inventory in hand, the committee can do its real first-cycle work: bring the existing, ungoverned tools under governance, deciding which to keep under defined conditions, which to reconfigure, and which to retire, and establishing the rule going forward that no new tool enters clinical workflow without passing through the committee. This is how the accidental sprawl of the opening story gets converted into a deliberate, monitored portfolio. The committee also establishes its monitoring approach in this period, deciding what it will watch, who watches it day to day, and what triggers an escalation, so that monitoring becomes a defined activity rather than a good intention. By the end of an initial cycle, a pharmacy that started with AI accreting by accident has a named body, a binding mandate, a known inventory, a set of governed tools under defined conditions, a monitoring posture, and a growing record of decisions, which is the difference between a pharmacy that uses AI and a pharmacy that governs its use. That difference is the entire point of this level, and the committee is where it begins.

Key Takeaways

• A pharmacy AI governance committee exists to close the gap the opening story exposes: AI accreting by accident, adopted and configured site by site with no one owning how it is used, monitored, or corrected across the pharmacy.
• A policy is an artifact that sits in a binder; governance is a function, a named body that decides, monitors, and corrects. The committee is the living thing, and the policy is one of its outputs.
• The mandate covers the full lifecycle of an AI tool: selection (no tool reaches clinical workflow without the committee), deployment under defined conditions, ongoing monitoring, and correction or retirement, with decisions that are binding rather than advisory.
• Four seats are non-negotiable: patient safety (what happens to a patient if the tool is wrong), clinical (how AI actually shows up in the workflow), operations (the pressures and staffing that determine whether a control survives), and compliance and privacy (PHI under HIPAA, board expectations, and URAC readiness).
• The chair needs real organizational authority so the committee's binding decisions stick, and the committee escalates to executive leadership when a risk exceeds the pharmacy's authority to manage.
• Cadence must match the pace of the risk: a regular standing meeting, often monthly, with the ability to convene on short notice for an incident, because an AI clinical error cannot wait for the next scheduled meeting.
• The committee keeps records of every decision (what, why, by whom, when), because those minutes and decision logs are the governance evidence an accreditor, a board, or a patient-safety review will ask to see; a committee that decides well but records nothing cannot prove it governs.
• The first ninety days move from charter to function: inventory the AI actually in use (rarely what leadership believes), bring existing tools under governance, and establish that no new tool enters clinical workflow without passing through the committee.