Key points
- A clinic AI vendor can be checked in an afternoon with fifteen questions, each with a written answer and a document behind it.
- Under UK GDPR, a controller to processor contract must contain 8 minimum terms, from documented instructions to deletion at the end.1
- In the US, a business associate agreement must require the vendor to return or destroy patient information at termination where feasible.2
- Count the systems patient data will pass through. In a Deloitte survey, 53% of US health system executives named multiple disparate software platforms as a barrier to meeting data-sharing rules.4
- wai publishes its prices, names every subprocessor with thirty days notice of change, and states plainly which certifications it does not yet hold.6
Summary
Before buying clinic AI, check the contract and data protection terms, the subprocessor list, where records are hosted, how clinical output is signed off, what happens to the data on exit, and whether the price is published. Get each answer in writing, with a document behind it.
Run the fifteen questions below in an afternoon and the clinic signs with a full file of written answers, ready for any regulator or auditor who asks. Each question comes from what regulators require.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoBring this checklist to the demo and see each answer shown on the product, with the documents sent after.
| Area | What to ask for | A good answer | Warning sign |
|---|---|---|---|
| Contract roles | Who is controller and who is processor, in writing | Roles named in the contract | Roles left undefined |
| Data processing agreement | The signed DPA, checked against the 8 Article 28 terms | All 8 terms present | A generic terms of service only |
| US business associate agreement | When the BAA is signed | Before any patient data is processed | Offered after go-live |
| Subprocessors | The current list, each with its role and agreement | Named list with notice of changes | No list, or no notice period |
| Hosting location | The country where records are stored and processed | The clinic's own country, in the contract | Location not stated |
| Security controls | Encryption, access control and key management | Stated standards and role-based access | Vague assurances |
| Certifications | Certificates held and those in progress | Documents attached, open gaps dated | Badges with no documents |
| Clinical sign-off | Who signs notes, letters and codes | The clinician, every time | Anything sends automatically |
| Intended use | A one-sentence intended use and device status | Clear statement in writing | Unable to say |
| Audit trail | An export of the event log from a test session | Every action with a name and time | No export |
| Patient consent and notices | Template wording for patients | Ready-made notice and consent text | Left entirely to the clinic |
| Accessibility | WCAG level of patient-facing parts | WCAG 2.2 AA | No stated level |
| Exit and export | Export format, window and deletion date | Full export, deletion confirmed | Export by request only, no date |
| Pricing | Published price, setup and usage terms | Public prices, limits agreed before billing | Price only after several calls |
| References | A clinician who uses it daily | A live demo by a working clinician | Slides only |
Answers in writing
Ask each vendor for a written answer and the document behind it, for every row. The contract terms, the US agreement and the medical device questions are all set out in public guidance, and the checklist turns that guidance into questions for one meeting.
Contract and data protection
Under UK GDPR, the clinic is usually the controller and the vendor a processor. The ICO sets out the minimum terms the contract must contain, processing only on documented instructions, a duty of confidence, security measures, rules on sub-processors, help with patients' rights, help to the controller, end-of-contract provisions, and audits and inspections.1 Ask for the data processing agreement and tick each one off.
In the US, the matching document is the business associate agreement. The HIPAA rules require it to oblige the vendor to make sure its subcontractors accept the same restrictions, and to return or destroy all protected health information at termination where feasible.2 Ask when it is signed. For wai Checkout, the BAA is signed before anything goes live.
The UK terms say a processor must not engage another processor without authorisation and must tell the clinic of intended changes so it can object.1 wai names every subprocessor, with what it does and the agreement in place, and gives thirty days notice before anything changes.6
Clinical safety and sign-off
Ask the vendor what the software is for, in one sentence, and whether it is a medical device. The MHRA asks manufacturers of software to write an intended use statement because intended purpose decides how the product is regulated.3
Then ask who signs. The clinician should review and sign every note, letter and code, and no clinical message should reach a patient without a clinician's signature. wai states that rule on its security page, alongside approval by the team for every operational message.6
Ask to see the event log of a test session. Every draft, edit, approval and signature should be visible with a name and a time, and the clinic should be able to export it.
Certifications and honest gaps
Ask which security certifications the vendor holds today, with the certificate or report attached, and which are in progress with a date. A dated list of open gaps is a good sign.
wai lists on its security page AES-256 encryption at rest and TLS 1.3 in transit, and offers each open gap with a status and a date on request.6
Exit, pricing and references
Ask for the export format for notes, letters, messages and the event log, how long export stays open after termination, and the date by which copies are deleted. The UK terms require deletion or return at the end of the contract at the clinic's choice.1
In a Deloitte survey of 30 finance leaders at large US health systems, 53% named multiple disparate software platforms as a barrier to meeting data-sharing rules.4 OECD reporting adds that 38% of member countries have no clinical standards or vendor certification for EHR systems, so the clinic makes this check itself.5
Ask for the price in writing, including setup, usage allowances and what happens beyond them. wai publishes its prices on the pricing page, and Admin starts with a demo and a 90-day pilot.7 Then ask to speak with a clinician who uses the product daily.
The checklist
Each row in the table is one question, the answer to expect and the warning sign. Filed together, the written answers become the clinic's due diligence record.
Where to start
Send the checklist to every shortlisted vendor before the demo, and ask for written answers and documents within a week. Score each row green, amber or red, and only book a pilot with vendors who have no reds.
Then agree the pilot measures before signing, using our guide to pilot success criteria, and ask each vendor where the data will sit, using our data residency questions.
Send us the checklist before the demo and get each row answered in writing and shown on the product.
Frequently asked questions
What is the single most important document to ask for?
The data processing agreement, or in the US the business associate agreement. It sets what the vendor may do with patient data and what happens to it at the end.1
Should we require SOC 2 or ISO 27001?
Ask which certifications are held, with documents, and which are in progress with dates. wai answers a vendor assessment in writing, control by control, and sends its open work on request.6
Is clinic AI a medical device?
It depends on its intended purpose. Ask the vendor for its intended use statement, which the MHRA treats as the starting point for classification.3
What should the contract say about leaving?
That the vendor deletes or returns all personal data at the clinic's choice, deletes existing copies unless law requires them kept, and gives a full export before that.1
How do we compare prices fairly?
Ask for the full price in writing, including setup, usage allowances and charges beyond them. wai publishes its prices on the pricing page.7
How long should procurement take?
For a private clinic, about two weeks. One week for written answers, one for the demo and scoring, then a pilot with measures agreed in advance.
Sources
- 1Information Commissioner's OfficeWhat needs to be included in the contract?Read 14 October 2026Read source
- 2Electronic Code of Federal Regulations, US Government45 CFR 164.504, uses and disclosures, organizational requirementsRead 14 October 2026Read source
- 3Medicines and Healthcare products Regulatory Agency, 2025Software and artificial intelligence (AI) as a medical deviceRead 14 October 2026Read source
- 4Deloitte, 2021Greater transparency and interoperability in health careRead 14 October 2026Read source
- 5OECD, 2023Health at a Glance 2023, OECD IndicatorsRead 14 October 2026Read source
- 6wai, 2026Security at waiRead 14 October 2026Read source
- 7wai, 2026PricingRead 14 October 2026Read source
Sign with every row of the checklist answered in writing.
Fifteen minutes with a clinician who uses wai daily, then the documents. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits