CHAI's 57 draft intake controls, read from the vendor side

The Coalition for Health AI's new draft framework compresses more than 800 questions from approximately 16 health system questionnaires into 57 draft controls across 11 domains. If you sell AI into hospitals, that is the closest thing yet to a single list of what intake reviewers want from you.

CHAI released the AI Intake Playbook and a companion AI Intake Controls and Evidence Workbook on Oct. 1. It is a draft, and CHAI says so: it plans to pilot the framework with health systems and AI vendors and revise it based on real-world use. It is also explicit that the resources are not meant to impose a single approval decision or replace each organization's judgment. Treat it as a strong signal of where intake is heading, and expect the details to change.

The problem it is aimed at

The release names the pain directly. Most institutions in CHAI's AI Intake Working Group reported that approving a vendor AI solution can take between two weeks and two months, with reviewers spending more time gathering information and chasing missing documentation than doing the assessment itself.

Founders feel the other side of that. Every health system sends its own questionnaire, asking similar things in different words, and each one restarts the clock. One working group member in the release, UNC Health's Ada Tsoi, describes a common failure: the first vendor contact is sometimes a sales representative who cannot answer detailed technical questions. Every one of those gaps is a follow-up email and another week.

What the framework actually changes

Three design choices matter most for a vendor.

Controls are yes-or-no statements tied to evidence. CHAI says each control is written as a plain-language yes-or-no statement and mapped to the evidence that can support it. That is easier to prepare for than open-ended prose, and harder to bluff. A yes needs something behind it.

Depth scales with risk. Controls are applied according to the risk of the proposed deployment. In the release, Onboard AI founder Troy Bannister puts it plainly: a low-risk administrative use should not face the same evidence burden as an agentic system that affects clinical workflow. CHAI also says 40 percent of controls can be satisfied through vendor attestation alone, without individual artifact review.

The model card does a lot of the work. CHAI says a completed Applied Model Card fully satisfies 12 controls and partially addresses 29 more, which means it provides at least some information for 72 percent of the controls. The rest is concentrated in operational areas the release lists: lifecycle governance, security operations, resilience, integration, feedback, and ongoing monitoring.

The release does not name all 11 domains, so I am not going to guess at them here. Read the workbook itself for the exact structure.

Prepare once, reuse many times

The practical move for a founder is to build one evidence package that maps to the controls, then reuse it for every health system. Here is how I would sequence it.

1. Complete the Applied Model Card first. Given the coverage CHAI describes, it is the most useful single document you can produce, and you will reuse it constantly.
2. Go through the workbook control by control and sort each into three piles: already true with evidence, true but undocumented, and not true yet. The middle pile is usually the biggest and the cheapest to fix.
3. Write the operational evidence the model card does not cover. Lifecycle governance, security operations, resilience, integration, feedback, and monitoring are where reviewers will spend their time. For each, have a short document a reviewer can read in minutes.
4. Separate what you can attest from what needs artifacts. If a control can be satisfied by attestation, make sure a named person at your company is prepared to sign it, and that it is true.
5. Describe each use case separately. Bannister notes in the release that the use case is often the hardest level to evaluate because one platform can support many applications with different risk. If your product has an administrative feature and a clinical one, write them up as distinct uses.
6. Put a technical person on intake. Do not route detailed review questions through sales.

Where founders will find the hard parts

The release is candid about which evidence is hardest. Bannister says performance and subgroup fairness evidence are often among the hardest materials for vendors to produce, and that workflow evidence is equally important. Tsoi adds that adding a human reviewer does not resolve every concern, since organizations still have to consider that person's workload and what happens when the tool is wrong or uncertain.

That maps directly to the questions founders tend to skip. Is your training population relevant to this health system's patients? What did you validate, on whom? What does a clinician actually have to check in your output, and is that realistic in their day? If your answer to oversight is "a human reviews it," expect a follow-up asking how long the review takes and what happens when it is skipped.

The leadership read

For a founder or board, the framework is a readiness checklist written by your buyers. A company that can hand over a clean, control-mapped package on the first call moves faster through every review, and a shared format makes that advantage repeatable. A company that cannot will keep answering the same questions in different spreadsheets.

CHAI is also seeking healthcare delivery organizations and AI vendors for its pilot, particularly pairs already in an active procurement. If you are mid-deal with a health system, that is worth a conversation with them.

Start with the three piles

Download the workbook, sort every control into true with evidence, true but undocumented, and not true yet, and count the middle pile. That count is roughly how much faster your next intake review could have gone.