Clinical and Technical Validation Protocol for Healthcare AI

How to use this document

• Use it to validate an AI tool with clinical use (diagnosis, triage, decision support, prioritization, clinical documentation) before using it with patients and to monitor it while in use: performance, target population, bias, clinician oversight, patient information, records and change management.
• Give it a clear owner: usually medical leadership or the quality function, with clinical IT, data protection, information security and the institution's ethics or AI committee.
• Before adopting it, the organization should decide who sits on the validation committee, which minimum acceptance criteria it requires by type of tool, who authorizes clinical use and how AI use is recorded in the medical record.
• Complete one validation file per tool and per clinical use. The same tool used in different services or populations may require separate validations.
• This protocol is applied by the institution using the tool. It does not replace the clinical evaluation, health registration or marking that fall to the manufacturer when the tool is a medical device; it complements them with a validation in the local context.
• Set the acceptance criteria in sections 6 to 8 before seeing the results and do not change them afterwards without recording the reason.
• Keep only the country variants that apply (Colombia, Brazil, European Union or United States) and delete the rest.
• Fields marked [COMPLETE] include points to confirm with your regulatory advisor, especially whether the tool is a medical device, its risk class, transition deadlines and adverse event reporting obligations.
• Before approval, have it reviewed by medical leadership, quality, legal or regulatory affairs and the ethics committee. Approve it through the institution's clinical governance body.

Clinical and Technical Validation Protocol for Healthcare AI

Field	Content
Institution	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
AI tool	[AI SYSTEM]
Manufacturer or vendor and version	[VENDOR] / [COMPLETE]
Clinical service or unit	[RESPONSIBLE FUNCTION]
Clinical lead for validation	[OWNER]
Countries of use	[COUNTRY]
Identifier in the AI system inventory	[COMPLETE]
Type of validation	Initial / Due to change / Periodic revalidation
Version and date	[COMPLETE] / [DATE]
Status	Planned / In progress / Approved / Rejected / Suspended
Contact	[AI GOVERNANCE EMAIL]

1. Purpose and scope

1.1 This protocol sets out how [ORGANIZATION NAME] verifies that an AI tool with clinical impact is safe, effective and equitable for its intended use in the institution's population and setting, before using it with patients and throughout its use.

1.2 It applies to in-house tools, purchased tools and tools embedded in other systems (for example, in the electronic health record or imaging equipment), including generative AI tools that draft, summarize or suggest clinical content.

1.3 Tools with no effect on patient care (for example, administrative management without clinical data) are excluded and managed under the general AI policy.

2. Regulatory screening of the tool

2.1 Before starting validation, the committee answers these questions:

Question	Answer	Consequence
Does the tool have a medical purpose (diagnosis, prevention, monitoring, prognosis, treatment or alleviation of disease)?	Yes / No	If yes, check whether it is a medical device or software as a medical device.
Is it a medical device under the country's health authority? Risk class	Yes / No / Under review. Class: [COMPLETE]	Verify current registration, authorization, notification or marking before use.
Number and validity of the registration, notification or certificate	[COMPLETE]	Without current registration where required, it is not used.
Who is the legal manufacturer?	[VENDOR] / The institution	If the institution develops or modifies the tool, consider whether it takes on manufacturer obligations.
Does the institution change the intended purpose or functioning?	Yes / No	A modification may change the regulatory status; consult the advisor.
Does it use identifiable health data?	Yes / No	Data protection impact assessment.
Does it interact directly with patients (for example, a conversational assistant)?	Yes / No	Apply the patient information and escalation-to-clinician rules.
Internal risk level	High / Medium / Low	Determines the depth of validation (section 5.2).