A hospital network is scoping a new GenAI-powered clinical documentation assistant. The project team plans to build a working prototype first and bring in the responsible AI review board only once the tool is ready for a pilot with real patients. What is the primary risk with this sequencing?

Governance by design means decisions made early — what data will train or ground the tool, what its intended use is, where human oversight will sit — shape the system's risk profile from the outset, and those choices are far more expensive to unwind once a prototype is built than to get right at the start. Claiming the prototype phase is too early for governance involvement gets it backwards: intended-use and data-sourcing decisions made before any real patient data is involved still carry governance implications, since they set the foundation the eventual pilot will build on. Claiming there's no risk because responsible-AI review only matters once real patient data is involved inverts the correct answer — the prototyping phase, while requirements are still forming, is exactly when governance input is cheapest and most useful to apply. Assuming earlier review would only slow prototyping without adding value undervalues that input by treating it as pure overhead, when in practice it can prevent costly rework later, which is the actual risk in this scenario. Operational check: before development begins, ask whether the intended data sources and human-oversight points have been reviewed — if that review is deferred until a working prototype exists, expect any needed changes to cost far more than they would have upfront.