Medical AI data procurement checklist

1. Define the task and intended use

• What model task is in scope: classification, detection, segmentation, report generation, retrieval or another defined task?
• Which modality, anatomy, population, care setting and disease or finding are relevant?
• Is the data for research, model development, internal evaluation or another purpose? What uses are out of scope?
• What representativeness, exclusions and known limitations should be documented?

2. Check provenance and permitted use

• Who collected or created each data element, and what evidence supports its source?
• Which party can authorize the proposed use, and what purposes, users, regions and retention periods are permitted?
• Do the rights cover model training, evaluation, derivative labels, publication or onward access separately?
• What restrictions apply to redistribution, re-identification, linkage or use outside the agreed project?

3. Agree privacy and transfer controls

• Which direct and indirect identifiers may be present in images, text, metadata or free-text fields?
• What de-identification method, residual-risk review and handling of exceptions are required?
• Where will data be accessed, stored and processed? Which personnel and subprocessors may access it?
• For cross-border access or transfer, which jurisdictions and written approvals or agreements apply?

Do not send patient-identifiable records through a general inquiry form or email. Confirm the permitted secure channel and handling terms before any transfer.

4. Specify annotation and quality review

• What label schema, instructions, examples and edge-case rules define the annotation?
• Which qualifications or experience are required for each task, and when is specialist review needed?
• How will disagreements, uncertainty, missing evidence and adjudication be recorded?
• Which quality measures, sampling method, error categories and rework process will determine acceptance?

5. Make delivery and acceptance testable

• What are the agreed volume, file formats, schema, metadata, identifiers and delivery method?
• What sample size and review window will be used for a pilot, and what happens if criteria are not met?
• How are versioning, corrections, rejected items, change requests and final sign-off handled?
• What are the retention, return or deletion steps at project close?

6. Confirm commercial and operational boundaries

• Separate data access, annotation, evaluation and platform services into clearly scoped deliverables.
• Record assumptions, exclusions, dependencies, fees, milestones and acceptance responsibilities in writing.
• Use an NDA or other appropriate agreement before exchanging non-public technical or commercial details.
• Confirm the contracting entity and applicable governing terms for the specific engagement.