What documentation should we request from an AI vendor before we start evaluating?

Ask for the packet before the demonstration, not after. At minimum: a description of the intended use and the population the model was validated on, the performance evidence and where it came from, the data flow and what leaves your environment, the model update and notification process, the monitoring support available after deployment, current security attestations, and a signable Business Associate Agreement if protected health information is involved.

Requesting this early does two useful things. It tells you quickly whether the vendor has sold into a health system before, and it gives your internal reviewers something to work from rather than a set of claims they have to independently reconstruct.

The full list is in the healthcare AI vendor evaluation checklist.