Vendor due diligence checklist
A procurement checklist aligned to the six dimensions of the RUAIH Vendor Score method. Use it before you sign, or during the evaluation, to make sure nothing material was skipped. Check what you can verify, note what you cannot, and take the result into the room where the decision is made.
Built against the RUAIH Vendor Score v1.2. Review our full review policy for how scores are produced and maintained.
1. Independent validation
Whether anyone outside the vendor has shown the product works, and on which population. The gap between a marketing figure and a peer-reviewed study is the gap between assertion and evidence.
2. Regulatory position
Whether the product's regulatory status is stated accurately and verifiable against public records. "FDA registered" is not a clearance, and a marketed indication that exceeds the cleared indication is a procurement problem, not a marketing choice.
3. Transparency
Whether the vendor has published enough about the model for you to know what it was trained on, what it is for, what it cannot do, and when it last changed. A model card is the minimum; a versioning policy is what keeps you from discovering your evaluated product has silently become a different one.
4. Security and data rights
Where your patient data goes, whether it can be used to train a shared model, and whether the vendor can prove their security posture with something beyond assertion. The difference between "we take security seriously" and a current SOC 2 Type II is the difference between a claim and an artefact.
5. Governance artefacts
Whether the product ships the evidence you will need to survive an audit two years after go-live. Audit logs, human override capture, monitoring and drift detection are not features — they are the artefacts your governance framework will ask for, and retro-fitting them is expensive.
6. Commercial terms
Whether you can leave if this fails, take your data with you, and predict what you will pay next year. A product with strong evidence and no exit rights is a product you cannot walk away from when the evidence changes.
Progress summary
Everything runs in this page. Nothing is stored and nothing is sent anywhere. Your checklist state is saved in your browser's local storage so it persists between visits — clear it with the reset button above.
How to use this checklist
Work through each dimension during vendor evaluation. For every item you cannot check, write a note explaining why — that gap is the finding. A vendor that scores well on five dimensions with a blank in security and data rights is not a strong product with a small gap; it is a procurement problem. The weakest dimension is the one that decides whether you can defend this purchase.
The checklist mirrors the six dimensions of the RUAIH Vendor Score method, which scores the quality of the evidence a buyer can independently verify. It does not score whether the product works. That distinction matters: a product with excellent real-world performance and no published evidence scores badly, because at procurement time a buyer cannot tell the two apart.
Nothing here is a clinical, safety, regulatory or outcome claim. Nothing here is a statement about any particular product.
The Operations Edge
One operational argument a week, what broke, what the numbers said, and the instrument that would have caught it. Written for people who have to implement rather than opine.
New titles and toolkits go to this list first. No vendor sponsorship, no list sharing, unsubscribe in one click.