AI is arriving in quality departments through two doors. Some of it is bought deliberately, as a new tool for document drafting, deviation analysis or review. Much more of it arrives quietly, as a new feature switched on inside software the company already owns.
Either way, the contract and the supplier assessment are the best chance a quality leader has to set the terms. Once the tool is in use, changing them is much harder. Here are seven questions worth asking before signing.
1. What exactly does the AI do in this product?
Ask for a list of every function that uses AI, and for each one, what it produces. Vendors often describe AI broadly, as "AI-powered". You need specifics, because you will validate specific functions, not a marketing claim.
2. Is each output a draft or a decision?
For each AI function, find out whether its output is reviewed and approved by a person before it becomes a record, or whether it acts directly. Drafts reviewed by qualified people are far easier to control. Decisions made by AI need much stronger evidence, and in many GxP uses should not be allowed at all.
3. How was the AI evaluated, and can we see the evidence?
A credible vendor can explain how they tested the AI for its intended use, on what kind of data, and with what results. Ask to see it. If the answer is that the underlying model is widely used and therefore reliable, that is not evidence for your use.
4. How will we know when the AI changes?
AI models are updated more often than ordinary software, and the change may not be visible in the interface. The contract should require notice of changes to AI functions, information on what changed and how it was tested, and ideally a way to test the change before it reaches your production environment.
5. What happens to our data?
Find out where your data goes when the AI processes it, whether it is stored, and whether it is used to train models that serve other customers. For GxP data, and for anything that includes patient information, the answers matter both for data integrity and for privacy law.
6. Can the AI be switched off, and does the product still work?
You may need to switch AI features off while you validate them, if a change goes wrong, or if a regulator asks. The product should keep working without them, and you should be able to control this yourself.
7. What does the audit trail show?
The record should show what the AI produced, what a person changed, and who approved the result. Without that, nobody can later show that a human decision was made.
Why this matters now
Regulators are clear that responsibility stays with the regulated company, whoever built the AI. Annex 11 already sets expectations for suppliers of computerised systems, and they apply to AI vendors today. The draft EU GMP Annex 22 and FDA's draft guidance on AI credibility point the same way.
The contract is where you can make these questions the vendor's obligation rather than your problem. It is worth the extra week of negotiation.
For the practical detail, see GxP AI vendor qualification.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.