In THIS ISSUE
Signal of the Week, shadow agents are already inside health systems.
Framework of the Week, The Badge Test: four steps before any agent gets in.
5 Things Worth Reading, shadow AI, trust, and a pharma deal.
Tool of the Week, Semantic Scholar.
Reading time: ~8 min read
🎯 Signal of the Week
Health systems say they control their AI agents, yet 72% admit some run without IT approval.
Welcome to Issue 11,
In 2024, an AI meeting agent joined a hospital physicians' meeting through a recurring calendar invite, transcribed what was said about seven patients, and emailed a summary to 65 invitees, some of whom had already left the hospital. Nobody approved it. Axios retold the story last week, and it is the cleanest picture I know of what "shadow AI" means once the AI can act rather than just answer.
The numbers behind it come from an Imprivata survey, fielded by Vanson Bourne among 250 US healthcare leaders and published in mid-September. 72% say AI tools or agents are deployed without formal IT approval, at least occasionally. 28% already run agentic AI in production, another 44% are piloting it, and 88% expect agents to act with some autonomy. Yet 86% say they are fairly confident they can fully control what agents do. Both things cannot comfortably be true at once. Axios also cites the Cloud Security Alliance on a summer 2026 case in Australia, where an AI agent researching public health spending reportedly got into non-public parts of a government network holding health program data. Read the caveats too: Imprivata sells access management, the sample is US providers rather than pharma, and the coverage does not report a margin of error.
Figure 1. How an unapproved AI meeting agent turned one calendar invite into 65 inboxes, and the survey figure behind it. Sources: Axios; TechTarget.
Here is why this belongs on a Medical Affairs agenda. Your teams are not hospitals, but they use the same tools: meeting note-takers on HCP calls, copilots inside the CRM, agents that summarize insights and draft replies. A recording of an HCP conversation can contain safety information, off-label questions, and personal data. An unapproved note-taker that stores it creates a gap you cannot see, and the first time you learn about it may be an audit. Last week's issue asked whose interests an answer engine represents. This week's question comes earlier: who let the agent in at all?
Now the opinionated part. The most dangerous word in the survey is "confident". A hospital manager quoted by Healthcare IT News described an AI that autonomously exported patient information in batches, and said the risk was only pinned down quickly thanks to audit logs. That is what real control looks like: not a feeling, but a log you can read. Medical Affairs should not wait for IT to find its agents. Take the inventory yourselves, because you know which tools your people actually use on the job.
🧠 Framework of the Week
The Badge Test: four steps before any AI agent gets into your systems.
Seventy-two percent is not a statistic about hackers. It is a statistic about colleagues: people who found a tool that saves an hour and plugged it in before anyone asked. That is why the usual answer, a policy PDF, rarely works. The tool is already inside, and the person using it believes they are being productive, not reckless.
This builds on the thread from recent issues. We followed the agent into the workflow, the system of record, a shared rental, the exam room, and last week into the question of whose interests it serves. This week we ask the most basic question of all: who is it, and who said it could come in? An agent that acts in your systems is closer to a new employee than to a piece of software, and employees get a badge, a manager, and access limited to the job.
Read the framework as a ladder, because the order matters. You cannot badge what you have not found, and you cannot limit what you have not badged. Steps 1 and 2 tell you who is inside. Steps 3 and 4 tell you what they may do and what they did. Medical Affairs adds the most value at steps 3 and 4, because you know which acts are high-risk in your world: anything touching safety information, patient data, HCP records, or content that leaves the company.
Figure 2. The Badge Test: four steps before any AI agent gets into your systems. Source: iCHealth Pathway framework (original).
Name it. Build an inventory of every AI tool and agent in use in your function, approved or not, each with a named human owner. Ask openly, with an amnesty, rather than scanning logs first: the goal is the map, not blame. An agent without an owner is a stranger with a login.
Badge it. Give each agent its own identity and permissions, never a borrowed staff login. Imprivata's phrase is a "governable digital identity". In the survey, 37% of leaders still provision agent identities in an ad hoc or unapproved way. If your logs cannot tell an agent's actions from its human's, you cannot investigate anything.
Limit it. Least access, per task, for a set time. Write down the high-risk acts that always need a human: safety information, patient data, HCP records, and anything sent outside the company. Check what meeting bots and calendar integrations are allowed to join, because an invite should not be a way in.
Log it. Keep an audit trail of inputs, outputs, actions, and which identity did them, then replay one real workflow every month from the logs alone. If you cannot explain an agent's day to an auditor, it has not earned the next permission. Expand deployments only as fast as your monitoring matures.
The first two steps tell you who is inside. The last two tell you what they did. Most teams will start with Log it, because a log feels like control. Start with Name it instead. And treat confidence as a hypothesis, not a finding: in the same survey, 86% were fairly confident they could govern agent actions, while 72% admitted some tools ran without approval, and 37% provision agent identities ad hoc.
Figure 3. In control, they say: what 250 US healthcare leaders report about AI agents in their organizations. Sources: TechTarget, 17 Sep 2026; Healthcare IT News, 15 Sep 2026.
Before you ask what your agents can do, ask who let them in, what they can touch, and whether you can replay it.
📚 5 things worth to read
Five paywall-free reads, each summarized so you get the value without the click
01
Shadow AI prevalent as 72% of health orgs deploy without IT approvalThe cleanest statistical rundown of the survey behind this week's signal, and the source of most numbers in Figure 3. It reports that 88% of leaders expect AI agents to act with some autonomy, 28% have agentic AI deployed, 44% are in pilots, and 37% provision agent identities ad hoc or without approval. The twist is easy to miss: 73% of leaders at organizations with a chief AI officer say agentic AI can be deployed without IT approval, against 54% where a CIO leads. The sponsor sells access management, and the piece does not report survey dates or a margin of error, so read it as directional. The line to keep: a governance title is not the same thing as governance.
02
Agentic AI access: a pressing governance challenge for providers
The best read for what a failure actually looks like. Beyond the survey headline, it carries practitioner voices: a hospital manager describing an AI that autonomously exported patient information in batches, found quickly only because audit logs existed, and who will expand deployment only once monitoring is mature. An Australian health service reports about 800 staff using unapproved AI. Imprivata's Sean Kelly argues an agent should be treated as a governable digital identity with access suited to its role. It maps neatly onto Badge it and Log it. The line to keep: let monitoring maturity, not enthusiasm, set your rollout pace.
03
AI in Health Care Moves Toward More Autonomous RolesA wide-angle view from October 8 on where autonomy is heading. It reports that more than 200 companies have CMS approval to test AI tools that go beyond narrow support, that four have been allowed for Medicare patients outside the FDA's standard approval process, and that the FDA has no rules yet for newer generative AI devices, with public comment open until October 19. It also summarizes research showing a more conversational chatbot earned more trust even for false claims, and only about half of people offered a verify option used it. The line to keep: fluency is not evidence, so build the check into the workflow instead of hoping users will.
04
GSK drinks in Chai Discovery's AI models after wet-lab validation
The pharma deal of the week, and a useful model of how to let an AI in. GSK signed with Chai Discovery after testing its protein-design models on a panel of diverse targets without target-specific training, then confirming in its own wet lab that the designs bound every target tested. Chai joins Bristol Myers Squibb, Eli Lilly, Novartis, and Pfizer on its 2026 partner list, and its series C was $400 million. Financial terms were not disclosed, and the piece notes clinical validation is still missing. GSK also says it retrains its internal models on its own wet-lab data. The line to keep: test a model in your own lab before you license it.
05
Generative AI in Medical Affairs: use cases and compliance guardrails
A long, practical reference, updated on September 20, that works as a checklist for steps 3 and 4 of the framework. Its guardrail section lists human-in-the-loop review, source attribution and traceability, adversarial testing with re-validation as models change, privacy filters for PHI, role-based access, escalation of low-confidence queries, audit logging, ethics review boards, and transparency. It also walks through ten use cases, from medical information responses to KOL insight extraction. It is a vendor-published guide and some case studies are illustrative scenarios rather than documented results, so verify against current regulatory text. The line to keep: every use case needs its guardrail written down before launch, not after.
🔧 TOOL OF THE WEEK
Semantic Scholar
What it is: a free, AI-powered literature search and discovery tool from Ai2, the non-profit Allen Institute for AI. It indexes more than 200 million academic papers and adds one-sentence AI summaries called TLDRs (currently limited to computer science and biomedical papers), a Library where you organize papers in folders, Research Feeds that recommend new work based on those folders, and Paper Alerts that email you when a paper you track gets new citations. It also labels citations as background, method, or result extension, and flags highly influential citations.
How to use it for Medical Affairs and MSLs: create one Library folder per therapy area or key trial, mark about five papers as relevant and a few as not relevant, and let the Research Feed (built from papers of the last three months, refreshed daily) become a weekly input for insight meetings; set a Paper Alert on your pivotal trial and filter its citations by intent, so you can see who extended the result versus who only cited it before a scientific exchange; and, as a companion to this week's Name it step, add the tool to your inventory with an owner, since discovery tools are exactly what teams sign up to without asking.
Where to access it: semanticscholar.org on the web. It is free, and a free account is optional for reading but needed for the Library, feeds, and alerts. A separate API exists for developers, with most endpoints public and rate-limited and some requiring a key. Confirm current features on the site before you rely on them.
COMPLIANCE NOTE
Semantic Scholar is a discovery aid, not a systematic search method and not a source of MLR-approved content. TLDRs are AI-generated and can omit or distort a paper's findings, so read the full paper before you cite or act on it. Citation counts lag, and coverage has gaps, so recent or niche work may be missing. Folders are private by default but can be made public by link, so check sharing settings before saving anything that reveals your priorities. Do not upload unpublished manuscripts, confidential data, or patient-identifiable information, and check your company's policy on third-party tools before using a work account.
That is Issue 11. If a colleague forwarded this to you, you can get it yourself every Monday at newsletter.ichealth-ai.com/subscribe.
One email a week. No sponsorship. See you next Monday.
iCHealth Pathway is a weekly research note by Dr. Issam Chebouti on AI transformation for Pharma, Medical Affairs, and Healthcare leaders.
iCHealth-AI, ichealth-ai.com, [email protected]
Issue 11, Monday, October 18th, 2026.
Parts of this issue were produced with AI assistance and checked before publication.