Key points
- The procurement checklist asks the questions, and the evidence pack holds the answers as dated documents the clinic can file and audit.
- Every security document carries a status and a date, so the clinic knows exactly what it is relying on.
- The MHRA, FDA and Health Canada set out 10 guiding principles for machine learning in medical devices, asking for intended use, subgroup performance and known limitations to be given to users.1
- US certification lists nine groups of source attributes for predictive decision support, from intended use to external validation and monitoring, a ready template for any AI vendor.2
- wai sends the credentials, documents and open gaps relevant to the clinic's intended use, each with a status and a date, on request.4
Summary
Before signing, request a pack of dated documents from the vendor. It holds the security credentials with a status and a date for each, the DPA or BAA, the subprocessor list, the intended use statement, the clinical safety case, the evaluation report and two references who use the product daily.
Every promise in a folder as a dated document, a contract signed with confidence and a pilot that starts on time. The questions to ask are in the clinic AI procurement checklist, and this pack is where the answers are kept.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoAsk for wai's evidence pack for your intended use. Each document arrives with a status and a date.
| Document | What it should contain | Status and date to record | Reviewed by |
|---|---|---|---|
| Security certificates and reports | Scope, issuer and expiry of each | Held, in progress with target date, or not held | IT or security lead |
| Security controls summary | Encryption, access control, logging and incident response | Date of last review | IT or security lead |
| Independent security test | Summary of the latest test and fixes | Test date and next due | IT or security lead |
| DPA or BAA | Signed agreement with all required terms | Date signed, before any patient data | Data protection lead |
| Subprocessor list | Each subprocessor, its role, location and agreement | List date and notice period for changes | Data protection lead |
| DPIA input | Data flows, retention, hosting country and risks | Date supplied | Data protection lead |
| Intended use statement | Purpose, users, patient population, decisions informed | Version and date | Medical director |
| Clinical safety case and hazard log | Hazards, mitigations and open items | Version, date and open items with dates | Clinical safety lead |
| Evaluation report | Method, dataset, measures, subgroups and limitations | Date of evaluation and of next review | Medical director |
| Monitoring and update plan | How performance is watched after go-live and how updates are released | Frequency and date of last update | Clinical safety lead |
| References | Two clinics of similar size, contacts agreed | Date contacted | Practice lead |
A pack of documents, each with a status and a date
Ask for every item in writing, with the date it was issued and its status. Held means a current document is attached, in progress means a named target date, and not held is stated plainly. File the pack with the contract, and ask for an updated copy at each renewal.
Security documents
Request the certificates or audit reports the vendor holds, with their scope and expiry, and any in progress with a target date. Add the encryption standards, how access to patient records is controlled and logged, the incident response procedure and the latest independent security test summary.
wai lists on its security page AES-256 encryption at rest, TLS 1.3 in transit and role-based access enforced in the database.4 It sends the credentials, documents and open gaps relevant to the clinic's intended use, each with a status and a date, on request.4
Contract and data protection documents
Request the signed data processing agreement, or in the US the business associate agreement, dated before any patient data is processed. Add the current subprocessor list with each one's role, location and agreement, and the notice period for changes.
Ask for the vendor's input to the clinic's data protection impact assessment. The ICO lists artificial intelligence and machine learning among its examples of innovative technology, a factor that points to a DPIA, and the controller must carry one out before processing likely to result in high risk.3 The vendor holds most of the facts the assessment needs.
Intended use and the clinical safety case
Request a one sentence intended use, the intended users and patient population, and the decisions the output informs. The guiding principles ask that users get the intended use, model performance for appropriate subgroups, the characteristics of the training and test data, acceptable inputs and known limitations.1
Request the clinical safety case and hazard log for the workflows the clinic will use, with open hazards and their mitigations. For public-sector buyers in England, wai provides its DCB0129 and DCB0160 materials for the proposed use, open work included.5
Evaluation methods and results
Request how the product was tested, on what data, against which measure and when. The guiding principles ask for testing independent of the training data, a focus on the clinician and the AI working together, and monitoring once the model is deployed.1
The US certification criterion for predictive decision support gives a template any vendor can fill. Its nine groups of source attributes include intended use, cautioned out-of-scope use, training data, fairness, external validation, quantitative performance, ongoing monitoring and the update schedule.2 Ask for answers against those headings in any country.
References and a live demonstration
Request two references at clinics of similar size, and a demonstration on a workflow the clinic chooses by a clinician who uses the product daily. wai's demo is fifteen minutes with a clinician who uses it every day.
Agree what the pilot will measure before the pack is closed, using our guide to pilot success criteria.
Where to start
Copy the table into a request and send it to every shortlisted vendor with a two week deadline. Score each row as held, in progress with a date, or not held.
Book pilots with the vendors whose pack is complete or dated. The clinic signs with every document filed, and the pilot starts on the date agreed.
Send us your evidence request. We return each document for your intended use with its status and date.
Frequently asked questions
How is the evidence pack different from a procurement checklist?
The checklist is the set of questions, set out in the procurement checklist. The pack is the documents that answer them, each dated and filed with the contract.
What if a vendor is still working towards a certification?
Record it as in progress with a target date, or as not held, and decide whether the other controls fit the intended use. A dated gap is a sound basis for a decision.
Does wai hold SOC 2 or ISO 27001?
Ask wai for the evidence that fits your intended use. It answers a vendor assessment in writing, control by control, and sends current evidence and open work with a status and a date.4
Do we need a DPIA for clinic AI?
Very likely. The ICO lists artificial intelligence and machine learning among its examples of innovative technology that point to a DPIA.3 The vendor supplies the inputs.
What evaluation evidence should a vendor provide?
Where does wai host clinic records?
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.
Sources
- 1MHRA, US FDA and Health Canada, 2021Good machine learning practice for medical device development, guiding principlesRead 14 October 2026Read source
- 2Electronic Code of Federal Regulations, Office of the National Coordinator for Health IT45 CFR 170.315(b)(11), decision support interventions, source attributesRead 14 October 2026Read source
- 3Information Commissioner's OfficeWhen do we need to do a DPIA?Read 14 October 2026Read source
- 4wai, 2026Security at waiRead 14 October 2026Read source
- 5wai, 2026wai for government and public sectorRead 14 October 2026Read source
A pilot that starts on time, with every document already filed.
Fifteen minutes with a clinician who uses wai daily, with our evidence for your intended use. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits