Questions to ask any clinical AI vendor
Any vendor handling patient data should answer every question on this list before you sign. Each one comes with why it matters and what a good answer sounds like.
Every clinical AI vendor will pass your demo. The contract is where the differences live, and the questions below are the ones that surface them. wai publishes its own answers to this list on our security page, and we would ask you to hold any vendor, us included, to the same standard.
Data
Where is patient data processed and stored?
The answer decides which laws apply and which regulator can act. A good vendor names the region and every subprocessor without being pushed.
Is our data used to train your models?
Training on patient data extends its life far beyond your contract. A good answer is a plain no, in writing, not a settings page you have to find.
What is the retention period?
Data kept indefinitely is a liability you are underwriting. A good answer gives a number in days and describes deletion on request.
Will you sign a data processing agreement?
Without a DPA the legal responsibility sits with you alone. A good vendor sends one unprompted as part of the standard paperwork.
Regulatory
What is your lawful basis under UK GDPR?
Health data is special category data and needs a named basis, not a vague appeal to consent. A good answer cites the specific articles and conditions that apply.
Are you DTAC compliant?
For NHS-adjacent work the Digital Technology Assessment Criteria are the entry ticket. A good answer is a completed assessment you can read, not a promise to look into it.
Will you sign a HIPAA business associate agreement?
For US practices a BAA is the legal floor for handling protected health information. A good vendor offers a standard BAA before you ask for one.
Is the product a regulated medical device?
Software that informs clinical decisions can cross the device line, and the classification changes who carries the risk. A good answer states the classification and the reasoning, whichever way it falls.
Operational
What happens when the AI is wrong?
Every model is wrong sometimes, and the process around the error is what protects patients. A good answer describes how mistakes are caught, corrected and owned.
Does a human approve output before it enters the record?
Clinical responsibility cannot be delegated to software. A good answer keeps a clinician's sign-off in the loop by design, not as an optional setting.
Can we export everything if we leave?
Exit terms are best negotiated before you sign, not after. A good answer is full export in standard formats at no extra charge.
The copied version holds the questions alone, ready to paste into an email. The notes on why each one matters stay here for when the answers come back.
Questions about the list
Do these questions apply to ambient scribes as well as full platforms?
Yes. Any product that hears a consultation or touches a patient record carries the same obligations, whatever its size or price. The scope of the tool changes the depth of the answers you need, not whether you need them.
What should we do if a vendor will not answer one of them?
Treat the silence as the answer. A vendor that cannot say where data lives or what happens when the model is wrong has told you what you need to know. Every question on this list has a short factual answer, and a mature vendor will have written it down long before you asked.
Where does wai publish its own answers?
On our security page, in the same order a buyer would ask them. We would rather be measured against this list than avoid it, and we suggest you hold every vendor, us included, to the same standard.