Responsible AI Adoption Requires Clear Policies, Ongoing Oversight

Managed care organizations adopting artificial intelligence (AI) must plan for ongoing costs, evolving governance requirements, and dedicated implementation support, Leanna Baker, PharmD, MS, digital solutions lead at Cencora, said in the second part of an interview at the Academy of Managed Care Pharmacy Nexus 2026 meeting.

The interview followed Baker's October 27 session, “Is Your Organization Ready for AI? A Managed Care Playbook,” which presented primary research on AI adoption trends, perceived value, barriers, and gaps across managed care.

Costs extend beyond the model's token usage to include the time teams spend developing processes, obtaining approval from IT or governance teams, and assigning someone to monitor each system. Because policies and internal processes change, that person must continually confirm that each tool delivers the anticipated value and update it as needed, Baker emphasized.

AI governance spans both internal and external considerations, she said. Internally, organizations must determine whether a tool is accurate and trustworthy and whether it operates within a framework that protects internal information. Externally, state and federal legislation can restrict how AI is used. For example, if a law prohibits using AI for automatic approvals, organizations need a way to recognize that change and update their systems accordingly, Baker noted.

Implementation also requires dedicated oversight, she added. Baker described ongoing cost and governance review as a job in itself, one that helps ensure organizations are not put at risk.

Responsible AI adoption depends on considering everyone a tool affects, including patients and the staff who work within these systems, Baker said. Employees should understand what a tool can and cannot do, and organizations should maintain a clear use policy without gaps and establish a way to communicate updates. For example, a policy prohibiting the use of AI with personally identifiable information should specify whether it applies to names, dates of birth, or anonymized data.

“…it's not just having a policy but also being able to communicate that down so no one feels scared about using whatever technology has been rolled out,” Baker concluded.