JMIR Publications

ABSTRACT

Clinical artificial intelligence (AI) governance has advanced rapidly in technical validation, regulatory compliance, risk management, human oversight, and postdeployment monitoring. A more fundamental question remains, answered by default rather than through explicit governance: under what conditions are health institutions justified in exercising consequential authority through AI over patients, clinicians, and communities? Institutional approval, granted through executives, procurement, clinical leaders, legal counsel, and AI governance committees, establishes organizational permission. It does not establish public authorization. This viewpoint argues that legitimacy should be recognized as an independent governance requirement, distinct from technical assurance, legal and ethical compliance, trust, acceptance, and institutional approval. Drawing on public value theory, we argue that its concept of the authorizing environment requires adaptation to health care. Authority is distributed across regulatory mandates, institutional accountability, professional judgment, and affected-public participation. Yet deployment-level choices concerning purpose, threshold, population, and priority often lack a clearly articulated and publicly defensible locus of authorization. We call this the unclaimed decision and argue that governance must make it locatable, claimable, and revisable. For consequential deployments, we specify three minimum auditable conditions: visibility, so that a deployment is discoverable by those it affects; affected-party input, provided before purposes and governing conditions are fixed; and conditional reviewability, meaning that at least one predefined review trigger can prompt formal reconsideration and be invoked by a named party outside the deploying team. Governance intensity should scale with clinical consequence, distributive reach, and difficulty of reversal. A Five-Question Public Authorization Test complements these procedural conditions by examining publicly defensible purpose, distribution of benefits and burdens, exclusion, contestability, and renewal. These minimum conditions are deliberately procedural because they can be externally verified from observable governance artifacts. They do not replace substantive justification, which must remain publicly reasoned and scrutinizable but cannot be reduced to a binary audit criterion. We propose three candidate indicators for future evaluation: authorization coverage, time to affected-party input, and invocable review-trigger rate. Legitimacy is not a one-time certification or a measure of popularity; it is an ongoing and substantively contestable condition of justified institutional authority, supported but not exhausted by auditable procedural evidence. Clinical AI should not be regarded as publicly legitimate merely because an institution has granted itself permission to deploy it.