AAAHC v45 Puts AI Governance in the Standards. You Have Until December 15.

On August 18, 2026, AAAHC released version 45 of its Standards and Handbooks, effective for surveys conducted on or after December 15, 2026. One year to the week after v44, and the same 90-day runway. The difference this time is the subject. The centerpiece of v45 is a governance framework for artificial intelligence, and the reason it matters for ASCs is not that centers are rushing to buy AI. It is that most centers already have it, arriving quietly through vendors, and nobody has been asked to own it until now.

What v45 actually governs

The framing AAAHC chose is the important part. V45 does not attempt to regulate specific technologies, model types, or vendors. It regulates the organization around them. "AI alone does not improve quality or patient safety," said Noel Adachi, AAAHC president and CEO. "Our new Standards are built on a simple principle: technology changes, but good governance endures." Board chair Steven Butz, MD, described v45 as "a practical framework that can evolve with technology while keeping patient safety at the center."

That distinction is what makes v45 survivable. A standard written against a named tool would be obsolete in eighteen months. A standard written against governance asks a question that stays the same regardless of what your EHR vendor ships next quarter: who decided to use this, what did they consider, who is accountable, and how would you show a surveyor any of it.

Six anchors run through the framework.

• Leadership accountability. A named owner and a governing body decision, not a departmental purchase.
• Risk assessment. Evaluated before adoption and revisited, per use case rather than per vendor.
• Cybersecurity. AI tools treated as systems that touch ePHI, because they do.
• Human oversight. A person accountable for the output, with the review step written into the workflow rather than assumed.
• Transparency. Staff and patients able to know where AI is involved in their care and their data.
• Continuous readiness. Governance reviewed on a cycle, not signed off once and filed.

V45 also carries the usual pass of refinements across the handbooks, reflecting evolving clinical practice, regulatory change, and emerging risk. It applies across all AAAHC accreditation and certification programs, including Ambulatory, Medicare Deemed Status, Advanced Orthopaedic Certification, Health Plans, Health Plans FEHB, and Patient-Centered Medical Home. As with v44, it went through expert committee review, surveyor input, feedback from accredited organizations, and a 30-day public comment period, so the released version should not feel like an ambush to centers that were on the distribution list.

Why ASCs are more in scope than they think

The common reaction in an ASC is that this standard belongs to health systems. It does not. AI did not arrive at ambulatory surgery centers through a strategy document. It arrived through the back door, in the form of features nobody separately approved.

• An EHR vendor ships an ambient documentation or note-summarization feature and turns it on by default.
• A coding or revenue cycle partner adds AI-assisted code suggestion to an existing workflow.
• A scheduling or phone system starts routing, triaging, or transcribing patient calls.
• A transcription tool gets adopted by one physician, on one device, with a personal account.
• Staff paste operative notes or patient questions into a general-purpose chatbot to save fifteen minutes.

Only the last two are what people usually mean by shadow AI, and the first three are the bigger governance problem, because they came with a contract, they touch PHI, and no one at the center made an affirmative decision about them. When a surveyor asks in January which AI-enabled tools operate in your center and who approved them, "none that I know of" is not an answer that survives five minutes of follow-up questions.

The 90 days before December 15

Four workstreams cover the ground. None of them require an AI strategy. They require the same discipline the standards already expect everywhere else.

1. Inventory every tool with an AI component

Start from your vendor list, not from your imagination. For each system that touches clinical documentation, scheduling, coding, billing, imaging, communication, or patient intake, ask the vendor directly and in writing whether the product includes AI or machine learning features, whether they are enabled in your instance, what data trains or informs them, and whether any of that data leaves your environment. Then add the tools nobody bought: the browser extensions, the personal transcription apps, the chatbot tabs. One line per tool, with an owner and a use case.

2. Put a decision behind each one

Leadership accountability is the standard most likely to be scored partially met, because the tools are in use and the decision is nowhere. Take the inventory to the governing body or the QAPI committee, review each use case, and record the decision to approve, restrict, or discontinue. The minutes are the evidence. An AI use policy that names the approval path, the acceptable-use rules for staff, and the prohibition on entering PHI into unapproved tools should come out of the same meeting.

3. Write the human oversight step into the workflow

For every approved use, the standard question is who reviews the output before it becomes part of the record or the decision. An ambient scribe draft is not a note until a clinician reads and attests to it. An AI code suggestion is not a claim until a coder accepts it. Say so in the policy, build the attestation into the workflow, and make sure the training reflects it. This is the area where policy most often runs ahead of practice, exactly as it did with informed consent under v44.

4. Close the cybersecurity and vendor loop

Any AI tool processing PHI needs a business associate agreement, and one written before generative AI was on anyone's radar probably says nothing about model training, data retention, subprocessors, or output ownership. Pull the BAAs for every tool on the inventory, confirm the security attestation is current, and confirm in writing that your data is not used to train models outside your instance. The HIPAA Security Rule overhaul slipping to a July 2027 final action does not buy time here. It just means the accreditation deadline arrives first.

Gaps to expect

• Tools in use with no decision behind them. The feature was enabled by the vendor, adopted by staff, and never went to the governing body. The fix is a meeting and a minute, not a project.
• An AI policy that bans what the center is already doing. A one-page prohibition downloaded from a template, contradicted daily in practice, is worse at survey than no policy at all. Surveyors read practice, not paper.
• Oversight assumed rather than documented. Everyone agrees a clinician reviews the AI-generated draft. Nothing in the workflow proves it happened, and nothing distinguishes a reviewed note from an accepted one.
• BAAs that predate the feature. The agreement covers the platform as it existed in 2021 and is silent on the model that now reads your notes.

What not to do

Do not write an AI ban you cannot enforce, and do not rewrite the policy manual. V45 is a targeted addition, not a reset. The centers that will survey well in the spring are not the ones with the most sophisticated AI program. They are the ones that can produce a short, current inventory, a governing body decision for each item on it, a policy that matches what staff actually do, and a named human accountable for every output that reaches a patient record. That is a quarter of work for most ASCs, and it is considerably cheaper in September than it is in a corrective action plan.

AAAHC also released a complimentary 1095 Advance AI Governance Guide on August 17, 2026, aimed at moving organizations from adoption to governance. It is worth reading alongside the handbook, which remains the source of truth for what will actually be scored.

How DocForms helps

The v45 AI framework is a documentation and accountability problem, which is the problem the platform was built for.

• Vendor Management holds the AI inventory where it belongs, next to each vendor's BAA, security attestation, contract, and renewal date, so "which of our systems have AI enabled and what did the vendor tell us" is a report rather than an email search.
• Compliance Logs maps the new standards to the policies that satisfy them, tracks the risk assessment for each approved use case, and keeps the evidence attached where a surveyor can be walked through it.
• Meeting Management captures the governing body and QAPI decisions that make leadership accountability provable, with agenda, documentation, and closure on the record.
• Learning Management carries the acceptable-use training and the staff attestations, so the oversight rule is not just written but acknowledged.
• Incident Reporting gives AI-related events, a wrong summarization, a miscoded claim, an unapproved tool discovered in use, a structured path into root cause analysis and corrective action instead of a hallway conversation.