Free contract language · v1.0 · CC BY 4.0

The Model Governance Rider

A component of Closed-Loop Defensibility (CLD-SPEC-v1.0) — the contract lane.

Every hospital that buys AI asks vendors for governance documentation, and every vendor sends a different PDF. The fix costs one paragraph in the contract: require a sealed Model Governance Record — a machine-readable file your team can verify independently, in ten seconds, forever. Below is that paragraph, drafted, free to paste into any RFP, BAA appendix, or renewal.

For hospital counsel & risk — ready to use

The rider as a drop-in file, plus a one-page checklist your team can take into any AI vendor review. Free, CC BY 4.0, no signup.

Download rider (Word) Rider (PDF) GC checklist (Word) Checklist (PDF)

Why contract language, not policy

A governance policy binds your staff. A contract binds the vendor. The moment "sealed Model Governance Record, independently verifiable" appears in a purchase agreement, three things become true: the vendor's governance claims acquire a delivery date, an unaltered-since-sealing guarantee replaces trust in the vendor's word, and non-delivery has a remedy. None of that is achievable with a questionnaire.

How verification works after signature

The record format is an open specification with free reference implementations. Your analysts verify a delivered record with one command — npx @healthcareai/mgr verify record.json or pip install healthcareai-mgr && mgr-verify record.json — or in the browser at the verification page. No vendor cooperation is needed at verification time; that is the point of the seal.

The rider

Copy it whole, or hand it to counsel to adapt. It is licensed CC BY 4.0 — use it in any contract, no permission needed.

MODEL GOVERNANCE RIDER (v1.0)

This Rider is incorporated into the Agreement between the Customer and the
Vendor for the artificial-intelligence-enabled product or service identified
in the Agreement (the "System").

1. GOVERNANCE RECORD. Within thirty (30) days of the Effective Date, and
   quarterly thereafter, the Vendor shall deliver to the Customer a Model
   Governance Record for the System conforming to the Model Governance
   Record open specification, version 0.1 or later
   (https://healthcareaiops.com/standards/mgr/), as a machine-readable JSON
   document.

2. SEALING AND VERIFICATION. Each delivered record shall be sealed under the
   specification's integrity chain such that the Customer can independently
   verify, using any conforming implementation of the specification, that
   the record has not been altered since sealing. Delivery of a record that
   fails independent verification is non-delivery.

3. CONTENT. Each record shall state, at minimum: the accountable owner of
   the System within the Vendor's organization; the approval baseline and
   its metrics; dated monitoring entries at no less than quarterly cadence,
   including subgroup results where the Customer's population is stratified;
   and any incident affecting the System's clinical use, with resolution.

4. MATERIAL CHANGES. The Vendor shall deliver an updated sealed record
   within fifteen (15) days of any model version change, retraining event,
   or modification affecting the System's intended use, in addition to the
   quarterly cadence.

5. NO SUBSTITUTE FOR REGULATORY OBLIGATIONS. Nothing in this Rider limits
   or replaces the Vendor's obligations under applicable law or regulation,
   including FDA requirements where applicable.

6. REMEDY. Failure to deliver a conforming, verifiable record within the
   periods above, uncured for thirty (30) days after written notice, is a
   material breach of the Agreement.

Licensed CC BY 4.0 by The Healthcare AI Institute. This is contract
language for adaptation by the parties and their counsel; it is not legal
advice, and no attorney-client relationship is created by its use.

For vendors on the receiving end

If this rider arrived in your RFP: the specification is open, the tooling is free, and producing a conforming sealed record is an afternoon's work with the reference SDKs. Vendors who publish their sealed record proactively can add it to their Transparency Registry company page, where the diligence teams reading this rider already look.

This page provides contract language for adaptation by the parties and their counsel. It is not legal advice.