After a supplier presents a certificate, the next procurement task is to establish how it supports the exact product, configuration and use being purchased. The certificate may be important evidence, but the purchasing decision also needs usable limitations, change arrangements, support commitments and a workable response when something goes wrong.
This article concerns supplier due diligence, not whether a completed NHS pilot should be scaled. Regulatory and assurance sources were checked on 13 October 2026. The questions below are an editorial procurement framework, not a replacement for legal, information-governance or clinical safety review.
Verify the claim before negotiating around it
A purchasing team should identify the legal manufacturer, product, issuing body, assessment framework and relevant scope. If the certificate concerns a management system, it should not be treated as product conformity evidence. If it concerns a device, the team should establish whether the proposed functions and configuration are covered.
The European Commission's notified-body guidance and the MHRA's approved-body list provide starting points for checking the assessment organisation. A recognised brand is not enough when the contract names another legal entity or the proposed route differs.
For a fictional community provider buying a clinical review tool, a reasonable opening request is a mapping between the purchase specification and the supplier's assessment documents. That is more useful than receiving the same certificate again with a stronger assurance in an email.
Ask for evidence that can support a purchasing decision
The supplier should explain the intended use, relevant evaluation findings, known limitations and important unresolved questions. A buyer does not necessarily need unrestricted access to every proprietary document, but confidentiality should not make meaningful due diligence impossible.
The joint transparency principles support communicating information relevant to safe use and local acceptance testing. Procurement can translate that principle into a request for a clear evidence summary and controlled access to further material where necessary.
Ask whether the study concerns the current configuration and the proposed population. A paper about earlier documentation software does not establish the performance of a later action-taking module simply because the products share a name.
Use follow-up questions that expose practical gaps
The table illustrates the level of specificity to seek. It does not imply that every contract must use identical wording.
| Procurement question | An informative answer would include | Follow-up when unresolved |
|---|---|---|
| What exactly is covered? | Product, function, configuration and applicable scope | Which proposed element lacks a clear mapping? |
| What has been demonstrated? | Relevant evaluation and its limitations | What evidence supports the actual use we intend? |
| What must users check? | Review tasks and necessary source access | Has that review been assessed with comparable users? |
| What happens after a change? | Notification and impact-assessment arrangements | Can we restrict or defer a consequential change where necessary? |
| What happens after a concern? | Named contacts and investigation cooperation | What information will be available to identify affected outputs? |
| What happens if we stop? | Continuity, unfinished-work and export arrangements | Can the service continue without losing track of pending work? |
An unresolved issue should remain visible in the decision record. It should not become an assumption merely because the contracting deadline is approaching.
Negotiate for the lifecycle, not only installation
Imagine that the fictional provider completes acceptance testing for a draft-only workflow. The supplier later adds automatic messaging as a default. Even if the subscription price does not change, the purchased service now has different consequences.
A proposed change schedule should identify the types of change requiring notice, the information accompanying them and the responsibilities for reassessment. It should distinguish urgent security work from changes to clinical behaviour, sources, permissions or intended users, without assuming that one category is always harmless.
The joint predetermined change-control principles support bounded, evidence-based change management. They should not be interpreted as a promise that all future updates will be covered by the original assessment. The contract needs an operational process that matches the actual regulatory and clinical safety responsibilities.
Make investigation cooperation specific
If a clinician reports a potentially unsafe output, the organisation may need to establish which inputs, configuration and actions were involved. Procurement should ask what records can be made available, under what conditions and through which authorised process.
This does not mean retaining every patient conversation indefinitely or copying sensitive logs into personal accounts. Retention, access and disclosure require appropriate information-governance assessment. The purchasing question is whether necessary evidence can be obtained lawfully and proportionately when it is needed.
A generic promise of support is less informative than a named route for clinically significant concerns. The team should understand how it can temporarily restrict use, how the supplier will help investigate and how affected records or actions can be identified. A technical fix may not resolve the clinical consequences already created.
Test exit arrangements before dependence grows
A supplier can remain clinically useful while a contract becomes unsuitable. Services can also change ownership, pricing or availability. A proposed exit plan should therefore address approved records, unfinished work, configurations, relevant safety evidence and staff training for the replacement workflow.
The fictional community provider should ask what happens to a review queue when access ends. Exporting final documents may not identify which patients still need follow-up. A successful exit test would need to examine continuity of the work, not simply whether a file can be downloaded.
These are recommended diligence questions, not assertions about any named supplier's financial position. They help avoid treating business continuity as separate from patient safety when a clinical team has become dependent on the workflow.
Connect the purchase to local clinical safety
For applicable English NHS deployments, DCB0129 and DCB0160 distinguish supplier and adopter responsibilities. Procurement should ensure that the information and cooperation needed for the local assessment are available, rather than purchasing first and asking the clinical safety team to resolve inaccessible evidence later.
A supplier may have strong product evidence but a poor fit with the organisation's staffing or integration. Another may offer a narrower function that matches the local need more closely. The appropriate buying decision should reflect that fit, not a generic preference for the broadest platform.
As described on 13 October 2026, Insights by iatroX offers clinical safety and readiness support. This can assist evidence review and implementation planning, but it does not replace independent conformity assessment or the buyer's contract and governance decisions.
What should change the purchasing decision?
A clear scope, relevant evidence and credible lifecycle commitments may justify proceeding to local acceptance work. A correctable documentation gap may justify further diligence. A mismatch between the proposed use and supporting evidence may require a narrower purchase or a pause.
The strongest procurement outcome is not the largest folder of assurances. It is an agreement the organisation can operate responsibly, with enough information and authority to challenge, correct and stop the tool when circumstances require it.
Frequently asked questions
Is a certificate enough to complete clinical AI procurement?
No. The buyer still needs to establish scope, evidence fit, implementation requirements and workable arrangements for changes, concerns and continuity.
Must a supplier disclose all its proprietary material publicly?
Not necessarily. The organisation needs sufficient usable evidence for its responsibilities, which may include appropriately controlled access rather than unrestricted public disclosure.
Should unresolved safety questions be left until after signing?
Consequential gaps should be visible before commitment and linked to conditions or further work. A contract should not silently assume that missing evidence or local controls will appear later.