Checking whether a clinic vendor is what it says

Start with the legal entity, because everything hangs off it

Find the company on Companies House and check that the name on the contract matches the name on every claim. Brand and manufacturer names differ constantly in this market, and that mismatch is what breaks traceability on every other check you are about to do.

Look at the filing history rather than just the incorporation date. Accounts filed on time, a registered office that is not a mail forwarding service, directors who appear in the company's own public material. A young company is not a problem, and an overdue set of accounts on a company asking for a three year commitment is a fair question to raise.

Then check that the entity you are contracting with is the entity holding the registrations. A group structure where the sales company and the registered manufacturer are different is normal, and you should be able to see how they connect.

The ICO register, which takes two minutes

Any organisation processing personal data in the UK as a controller generally needs to be registered with the Information Commissioner's Office and pay the data protection fee. A supplier handling recorded consultations that does not appear on the register is worth a direct question.

It is a low bar, which is exactly why failing it matters. Registration is cheap and administrative. A company that has not done it has either not thought about data protection or has decided it does not apply to them, and both answers are informative.

While you are there, ask for the Article 28 processor agreement rather than a privacy policy. They are different documents and only one of them is a contract. Our walkthrough of UK GDPR for ambient scribes covers what it needs to say.

Device claims, and the trap inside them

Since the MHRA guidance of 29 July 2026, most transcription and summarisation products are not medical devices in Great Britain, so the absence of a registration is no longer a red flag on its own. What matters now is whether a claim that is made can be verified.

If a vendor claims registration or certification, get four things. Which legal entity holds it. Which product and which feature it covers. Under which regime and at which class. And who assessed it, or whether it is self-declared. Then check the MHRA public register yourself against that entity name.

The distinction that catches people out is registered against certified. Registered means listed, and at Class I a manufacturer self-declares with no external assessment. Certified means a UK Approved Body assessed it, which is mandatory at Class IIa and above. A vendor saying it is registered has told you much less than one saying it is certified.

Certificates have numbers

ISO 27001, ISO 13485, Cyber Essentials and UKCA marks are all verifiable, and the way to verify them is the certificate number and the issuing body rather than the badge on the website. Ask for the certificate itself as a document.

Read the scope line on it, which is where most of the surprises live. A certificate can be genuine and cover a different legal entity, a different site, or a different product in the same range. Scope is the part nobody reads and the part that decides whether the certificate means anything for what you are buying.

Check the expiry date too. A lapsed certificate on a current website is common and is usually an administrative failure rather than a deception, which is still worth knowing about a supplier who will hold your patients' consultations.

One customer you can actually phone

Ask for a clinic of roughly your size, in roughly your setting, that you may call without the vendor on the line. That last clause is the whole test. Written testimonials cost nothing to produce and a named reference who will take a cold call is a different kind of evidence.

Ask the reference three things. What went wrong during implementation, because something did. What they would check if they were buying again. And whether the product does the thing they bought it for, or the thing it turned out to be good at.

A vendor too early to have a reference should say so plainly. That is a real answer and an early-stage product can still be the right purchase. A vendor who has references and will not connect you to one is answering a different question.

Whether the price is public is itself a signal

It is not a compliance point and it tells you something anyway. A published rate card means the same number is quoted to everyone, and it means a practice can budget and compare on a Sunday without entering a sales process.

In this market the products that publish are the minority. Our read of what AI scribes actually cost sets out who publishes and who does not, with the dates each figure was read.

An unpublished price is a legitimate commercial choice rather than a warning sign. It does mean the first hour of your evaluation is spent on a call rather than on the product, and that cost is worth counting.

Run it on us

Our price is published on one page. Our legal entity, our registrations and our position on every question on this page are available in writing before a demo rather than after an order.

We will give you a clinic to call without us on the line. If we were too early to have one we would say so, and there will be products on your shortlist that are.

If an answer does not satisfy your information governance lead, tell us and we will either fix it or say plainly that we cannot. Clinicians still decide what enters the record.

Frequently asked questions