Artificial intelligence entered Polish hospitals faster than the language needed to discuss it at the procurement table.

A director signing a contract for an AI solution today receives a presentation, a reference list and an assurance that the algorithm is „ninety-something percent accurate”. What they do not receive are answers to the questions they would ask about any other purchase of comparable weight: on which population was it validated, what happens when the data is incomplete, who is accountable for an incorrect recommendation, what does it really cost in year three, and what happens to the data when the contract ends.

Healthcare Poland Foundation announces AICACT SDAI — the AI Supplier Standard for Healthcare. It is a voluntary certification programme run by the Centre for Quality, Audit and Certification of Healthcare Poland, with a single purpose: that the hospital has complete information before signing, and the supplier faces one set of questions instead of twenty different questionnaires from twenty different facilities.

Consultations on the standard open today and we invite everyone to take part: AI suppliers, hospitals, scientific societies, professional self-governing bodies, patient organisations, academic centres and regulators. No exceptions, no membership criterion, no division into technology camps. This is a programme of good practice above the divides, and it was designed that way from the first sentence of its rules.

Why now

Three things came together.

The problem we are solving: information asymmetry

The supplier knows everything about its product: the data it was trained on, where it performs worse, how it behaves with an atypical patient, what maintenance costs after year three. The buyer knows almost nothing and — worse — often does not know what to ask.

This asymmetry is nobody’s bad faith. It results from the absence of an agreed disclosure format. Every hospital asks differently, every supplier answers differently, and comparing two offers side by side is often impossible because they describe entirely different things. Both sides can lose: the hospital deploys a solution whose limitations it did not know, and a diligent supplier loses to one that promises more.

What AICACT SDAI is

AICACT SDAI is a voluntary certification mark issued by the Centre for Quality, Audit and Certification of Healthcare Poland to suppliers of artificial intelligence based solutions intended for healthcare providers.

The subject of assessment is the supplier, its processes and the completeness and diligence of the documentation it discloses to the buyer — in relation to a specific solution, a specific version and a specific intended use. The auditor verifies that the supplier actually holds what it declares: a description of the target population, a validation report prepared according to a recognised reporting methodology, a data processing map, an incident response plan, a procedure for handling an incorrect recommendation, contract exit conditions, and a full life-cycle cost calculation.

Where the criteria come from

We did not build the standard from scratch and we consider that a strength, not a shortcut. Its substantive basis is the AI Buyer’s Guide for healthcare — a document prepared by experts of the Coalition for AI and Innovation in Health, the wZdrowiu team and the Polish Hospital Federation. AICACT SDAI has ten criteria domains and each corresponds to exactly one question from the Guide.

The methodological layer of the standard draws on recognised international frameworks: standards for certification bodies and AI management systems, health software standards, international consensus guidelines for trustworthy AI in medicine, and recognised reporting checklists for studies involving AI. The standard recognises documentation produced for conformity assessment purposes and does not duplicate it.

Three levels — because suppliers differ

A start-up after its first deployment and a class IIb device manufacturer after a prospective study are not the same entity and should not be measured with the same yardstick. The standard provides three levels, differing in the depth of evidence required, validity period and intensity of surveillance.

The level is not a ranking. A higher level does not mean a better solution — it means a broader scope of verified disclosure and deeper evidence. An administrative solution supporting operating theatre scheduling does not need a prospective study and should not be penalised for its absence.

How the process works

The process is predictable and described in terms of stages, deadlines and responsible persons. No undisclosed stages and no discretionary judgements.

1. Application. The supplier identifies the solution, version, intended use and the level applied for.
2. Application review. The Centre determines scope and effort, checks for absence of conflicts of interest, and presents the offer and contract.
3. Assessment. Documentation review, interviews with the supplier’s team, verification of evidence in public sources, demonstration of the solution in a working environment.
4. Technical review. Independent verification of findings by a person who did not take part in the assessment.
5. Closing non-conformities. The supplier has a defined time to provide evidence of closure. This stage is normal, not embarrassing — that is what an audit is for.
6. Decision. Taken by a person who took part in neither the assessment nor the technical review. A refusal always includes written reasons.
7. Certificate issuance and entry in the public register. Together with a mark licence and rules for its use.
8. Surveillance. Scheduled — on an annual cycle. And event-driven.

Who can apply

The programme is open to everyone. We apply no criterion of registered seat, legal form, size, membership of any organisation or origin of capital. Applicants may include:

Entities that took no part in developing the standard may also apply — on the same terms, at any stage, with no waiting period. This rule is written into the programme rules and is not subject to discretion.

What the supplier gains, and what the hospital gains

Public register and transparency

All certificates — valid, suspended, restricted, withdrawn and expired — are entered into a free public register with full history. An entry covers the identification of the supplier, the solution and version, intended use, level, scope, dates and status.

The register is a register, not a sales catalogue. It contains no promotional materials, user reviews or performance claims. We publish the fact of certification and its scope — the remaining commercial communication is conducted by the supplier, on its own responsibility.

We also publish an annual programme report: the number of applications, certificates issued, refusals with anonymised reasons, suspensions, withdrawals and appeals. A programme that does not show how many entities it refused is not a certification programme.

A programme of good practice above the divides

Certification is a tool, not the goal. The goal is a shared language for describing AI solutions in Polish healthcare — used by hospitals, suppliers, the payer and the regulator, regardless of who agrees with whom on other matters.

AICACT SDAI is therefore part of the broader Good Practice Above the Divides Programme, which we address first to the Polish Hospital Federation — as the organisation bringing together the largest community of Polish hospitals and, at the same time, a co-author of the AI Buyer’s Guide. We invite the Federation to act as substantive partner of the programme: host of the debate, co-author of the criteria and the voice of the hospital community on the standard-setting body.

What „above the divides” means in practice

The principles we stand on — and one we say out loud

A certification programme run in an environment that includes buyers must have a built-in safeguard against the simplest abuse: turning the certificate into a market entry barrier. We wrote this in as an absolute prohibition, not a declaration of good will.

To this are added the operator’s impartiality rules. The Centre does not advise the entities it certifies — it does not design, configure or integrate their solutions, nor run deployments for them aimed at meeting the standard’s criteria. A person who in the last two years provided services to the applicant within the certified scope may not take part in its assessment or decision. Auditors’ remuneration is not linked to the number of certificates issued or to assessment outcomes.

This is not excessive caution. It is the difference between a standard that builds trust and a mark that becomes a subject of dispute two years later.

The programme development path

The standard launches as a voluntary mechanism based on public criteria and an open procedure. In parallel, we are working towards accreditation of the operator by the Polish Centre for Accreditation in the field of voluntary conformity assessment. The Act on conformity assessment and market surveillance systems expressly permits such accreditation, and precedents exist in other sectors.

Until it is obtained we say it plainly: the AICACT SDAI certificate is not a certificate from an accredited body within the meaning of public procurement law. It may, however, function as a label within the meaning of those provisions, provided the conditions of openness, transparency and independence are met — and the standard was designed to meet them. We do not promise more than we can deliver.

Scope of the Centre for Quality, Audit and Certification

AICACT SDAI is not being created in a vacuum. The Centre for Quality, Audit and Certification of Healthcare Poland is a distinct area of the Foundation’s activity, focused on examining quality, processes and compliance in healthcare. The Centre conducts audits and certification of both healthcare providers and technology suppliers, covering in particular:

• audits of process and documentation compliance with standards for quality management, information security and business continuity;
• cybersecurity of healthcare providers, including preparation for national cybersecurity system obligations;
• personal data protection and data governance in the medical environment;
• preparing medical device suppliers for conformity assessment — noting that conformity assessment itself is carried out solely by a notified body;
• sustainability and environmental reporting for healthcare providers;
• support in building formal evidence used in public procurement procedures;
• training programmes and micro-credentials confirming staff competence.

Timeline and invitation

Today we announce the standard in its consultation version. The next steps:

We invite you to take part at each of these stages. To the consultations — because a standard created without those it concerns has no right to be good. To the pilot — because the first participants genuinely shape the criteria. To the conversation — including those who believe we are doing this badly, or that someone else should be doing it. We will publish critical comments together with our reply.

Frequently asked questions