LEWES, Del., Nov. 09, 2026 (GLOBE NEWSWIRE) -- Pacific AI, the AI governance platform purpose-built for healthcare, today announced Continuous Risk Assessment, a new capability of its Governor module that keeps AI risk assessments current after they are approved. When one of more than 600 laws, regulations, standards, and frameworks in Pacific AI's open source AI Policy Suite changes, or when an organization updates an internal policy, system documentation, or vendor disclosure, Governor identifies every affected AI system and proposes updated risks and mitigation controls for review.
Health systems are already behind on first assessments. Research on more than 20 leading health systems found that AI project submissions outpaced governance committee decisions nearly 3 to 2; over 75% of programs ran on two or fewer dedicated full-time staff; and more than 60% of leaders called their governance resources insufficient, particularly for ongoing monitoring. With that backlog, an assessment approved at deployment is seldom revisited, while the model, prompts, data pipelines, and use cases behind it can change weekly.
State law is changing just as fast: More than 280 state AI bills were introduced in 2026, and 40 were enacted across 24 states as of October, according to Manatt’s Health AI Tracker. Three laws taking effect on January 1, 2027 each reach a different part of the industry:
- California SB 503 requires developers and deployers of AI clinical decision support to identify, mitigate, and monitor the risk of biased impacts.
- California AB 1979 requires health facilities, clinics, and physicians to take reasonable steps so a licensed provider exercises independent clinical judgment when AI informs patient care.
- Colorado HB 26-1139 bars a health insurer from issuing a medical necessity denial based solely on AI output without review by a licensed clinician, and applies to carriers that use AI through a pharmacy benefit manager or utilization review organization.
A single AI system can fall under several of these laws at once, and a model update, new use case, or change in a vendor's documentation can affect which obligations apply. An annual audit cannot keep pace with that rate.
“A risk assessment starts diminishing the day it’s approved: A model is retrained, a vendor updates its documentation, a team adds a new use case, a state passes a law, and the assessment on file now describes a system that no longer exists,” said David Talby, CEO, Pacific AI. “Keeping hundreds of assessments current by hand has been too expensive for most governance teams to attempt. Continuous Risk Assessment does that analysis automatically whenever something changes, so governance teams spend their time on tasks that need human judgment.”
When an input changes, Governor calculates what changed, reassesses only the affected sections and risks, and proposes new or revised risks, risk levels, mitigation controls, and tasks. Previously approved decisions stay in place unless their inputs changed, and every new or modified item goes to a human reviewer who can accept or override it. When the Policy Suite added California AB 489, a law that bars AI systems from implying they hold a healthcare license, every affected system was reassessed and received tasks to test its LLM against the requirement and monitor it in production.
Continuous Risk Assessment helps healthcare organizations:
- Catch changes that affect risk: detect changes to system architecture, documentation, use cases, and internal policy that add new risks or alter existing assessments.
- Track new regulations: map each quarterly Policy Suite update to the specific AI systems it affects.
- Turn risks into controls: receive proposed mitigations, along with the Gatekeeper tests needed to verify them, drawn from 60+ healthcare-specific test suites.
- Catch drift in production: Guardian alerts when a production metric falls a set amount below its pre-release baseline, using the same tests and thresholds that gated the release.
- Stay audit ready: every change to a risk, control, or decision is versioned, with a full audit trail across the system's lifecycle.
Available now, Continuous Risk Assessment runs inside each customer's own AWS or Azure environment, so system documentation, risk data, and production probes stay within the customer's network. Pacific AI Platform Core is free, and customers pay per credit only for the AI work, such as risk assessments. Pacific AI presented the workflow in a session at this year’s Applied AI Summit. To learn more, visit pacific.ai/continuous-ai-risk-assessment.
About Pacific AI
Pacific AI is dedicated to helping organizations deliver AI systems that comply with the rapidly evolving regulatory landscape. Whatever your starting point, Pacific AI can help you reach the next level of AI governance, implement tools and controls for automated governance, testing, and monitoring, and audit and certify what you’ve already built. To learn more, visit: https://www.pacific.ai.
Contact
Gina Devine
Head of Communications
Pacific AI Corp.
gina@pacific.ai
