Requirements

Plec de prescripcions tècniques (PPT)

The document "AQUAS-2025-42 PPT IA DERMATOLOGIA*Final GEEC-000.pdf" is the Plec de Prescripcions Tècniques (PPT), which means "Technical Prescriptions Document". This document is essential in a public bidding process, as it establishes the technical and operational requirements that the contracted solution and services must meet.

The PPT is structured in 9 main sections and annexes:

1. RESUM EXECUTIU (Executive Summary)
2. ANTECEDENTS (Background)
3. INTRODUCCIÓ I CONTEXT (Introduction and Context): Provides the background to the development of AI in healthcare in Catalonia, the relevance of skin cancer, the current organization of screening at SISCAT, the role of dermoscopy imaging and AI, and the objectives of the challenge:
   • improving the identification and prioritization of skin lesions
   • optimizing collaboration between PC and dermatology
   • providing the information system for decision-making.
4. OBJECTE DEL CONTRACTE (Object of the Contract): describes the current needs and the desired care flow with the incorporation of the AI solution.
   • Explicitly defines the two main components of the contract:
     • Component 1: Services for the implementation, deployment, and maintenance of an AI solution for screening and prioritizing patients with skin lesions in Primary Care.
     • Component 2: Services for the development, improvement, and/or validation of new AI solutions in dermatology, in collaboration with SISCAT entities.
   • Presents the specific use cases for the AI solution:
     • basal cell carcinoma,
     • squamous cell carcinoma
     • malignant melanoma
5. REQUISITS DE SEGURETAT I PROTECCIÓ DE DADES (Security and Data Protection Requirements)
6. REQUISITS APLICABLES A LA SOLUCIÓ BASADA EN IA I ELS SERVEIS DE DESPLEGAMENT ASSOCIATS (Requirements Applicable to the AI-Based Solution and Associated Deployment Services)
7. REQUERIMENTS APLICABLES A LA SOLUCIÓ BASADA EN IA I ELS SERVEIS DE DESPLEGAMENT ASSOCIATS (Requirements Applicable to the AI-Based Solution and Associated Deployment Services)
8. REQUISITS I REQUERIMENTS APLICABLES ALS SERVEIS DE SUPORT PEL DESENVOLUPAMENT, MILLORA I/O VALIDACIÓ DE NOVES SOLUCIONS IA (Requirements and Requirements Applicable to Support Services for the Development, Improvement, and/or Validation of New AI Solutions)
9. CONDICIONS D’EXECUCIÓ DEL CONTRACTE (Contract Execution Conditions)
10. ANNEXOS (Annexes)

Requirements

• 5. Requisits de Seguretat i Protecció de Dades (pp 33- 36)
  • RO-SPD-01: Sign a GDPR-Article 28 data-processing agreement with the contracting authority before handling any personal data; obtain prior written authorization before subcontracting any data-processing tasks; and ensure every sub-processor signs its own compliant agreement before they begin processing.
  • RO-SPD-02: Adopt and maintain a formal Data Protection Policy that defines the security measures and governance rules you’ll use to comply with applicable data-protection laws (RGPD and ENS).
  • RO-SPD-03: Ensure all IT systems you use for data processing meet the Spanish National Security Scheme (ENS) requirements — for low-risk systems by providing a conformity declaration, and for medium/high-risk ones by holding a valid ENS certificate.
  • RO-SPD-04: Perform a Data Protection Impact Assessment (DPIA) whenever you deploy innovative technologies that could pose a high risk to individuals’ rights and freedoms.
  • RO-SPD-05: If you store data on external servers, only use platforms that guarantee GDPR compliance; document who, how, when and where anyone can access the data; and, if any personal-data transfer leaves the EU, comply with RGPD Art 45 and Royal Decree-Law 14/2019 by ensuring all processing stays within EU territory unless a lawful transfer mechanism applies.
  • RO-PD-06: Apply GDPR principles of data minimization, proportionality and purpose limitation so you only collect and process the data strictly necessary for the contract.
  • RO-SPD-07: During both deployment and operational phases, comply with the cybersecurity standards published by the Catalan Cybersecurity Agency and the CTTI.
  • RO-SPD-08: Before contract award, submit all required ENS and GDPR conformity certificates covering your systems and processes.
  • RO-SPD-09: If you process personal data for non-care purposes (e.g. research or algorithm development), implement an informed-consent model and reevaluate minimization, proportionality and suitability to ensure lawful processing under the RGPD.
• 6. Requisits Aplicables a la Solució IA i Serveis de Desplegament (pp 36- 41)
  • 6.1 Instal·lació i Interoperabilitat
    • IA-RO-I-01: Integrate and deploy the AI solution strictly following the CatSalut Information Systems guidelines (and, where applicable, the Department of Health’s Primary Care Strategic Directorate instructions).
    • IA-RO-I-02: Use the IT infrastructures provided by CatSalut for all service delivery activities.
    • IA-RO-I-03: Integrate the AI solution into SIMDCAT using the DICOM interfaces defined under IA-RO-I-04.01.
    • IA-RO-I-04: Package the AI model(s) in a Docker container for consistent deployment across CatSalut environments.
      • IA-RO-I-04.01: Ensure the solution accepts DICOM files and returns results in DICOM format via one or a combination of PUSH (file-based or DICOM Store) or PULL models, subscribing to SIMDCAT notifications and using QIDO-RS/WADO-RS or WADO-URI to retrieve study UIDs.
      • IA-RO-I-04.02: If the model retrieves any clinical patient data, describe and document the API (including data format and communication method: file-based, REST, SOAP, gRPC, etc.) before contract signature.
      • IA-RO-I-04.03: Provide an option to return results in both DICOM and PDF formats—either saving DCM+PDF files via PUSH (file-based) or sending via DICOM STORE.
  • 6.2 Requisits Funcionals
    • IA-RO-F-01: Display analysis outputs with clear reasoning (e.g. probability scores, classification quality criteria, and severity levels).
    • IA-RO-F-02: Allow users to review and adjust prioritizations according to different established classification schemes.
    • IA-RO-F-03: Provide mechanisms for users to report or log errors, operational issues, and performance deviations quickly and intuitively, and to safely halt the system if needed.
    • IA-RO-F-04: Maintain an audit trail recording which professional user performed which actions (and validations) on the solution and its outputs; document the API, data format, and integration method (files, REST, SOAP, gRPC) before contract formalization.
    • IA-RO-F-05: Enable exporting decision audits in a structured format.
  • 6.3 Usabilitat
    • IA-RO-U-01: Provide an intuitive, easy-to-use interface for end users, administrators, and those responsible for monitoring, continuous evaluation, and activity logging.
  • 6.4 Manteniment i Gestió d’Incidències
    • IA-RO-GI-01: Guarantee correct AI solution operation by responding to incidents within the service-level times agreed upon with CatSalut.
    • IA-RO-GI-02: Provide second-level user support, including: troubleshooting unresolved first-level issues, fixing software bugs, root-cause analysis, ad-hoc reporting, and weekly updates logged in CatSalut’s GSO system.
    • IA-RO-AP-01: During contract and warranty periods, incorporate all improvements and new product versions as part of continuous service enhancement.
    • IA-RO-AP-02: Bear all costs for any complementary software required for these updates.
    • IA-RO-AP-03: Provide training to clinical professionals on newly implemented functionalities.
  • 6.5 Requisits Tècnics i Ètics
    • IA-RO-TE-01: Deliver a completed Annex 2 before contract signing, detailing information for IA-RO-TE-02 through IA-RO-TE-12 and all required documentation.
    • IA-RO-TE-02: Validate the AI tool on datasets representative of diverse clinical environments to ensure reliability.
    • IA-RO-TE-03: Use transparent, scientifically recognized, and comparable evaluation metrics.
    • IA-RO-TE-04: Maintain stable performance across different healthcare centers and workflows.
    • IA-RO-TE-05: Standardize and validate data labeling for consistency.
    • IA-RO-TE-06: Apply suitable explainability techniques for healthcare professionals.
    • IA-RO-TE-07: Enable human oversight of AI results.
    • IA-RO-TE-08: Include mechanisms to detect and mitigate potential biases.
    • IA-RO-TE-09: Provide an analysis of training-data representativeness to demonstrate equal performance across population groups.
    • IA-RO-TE-10: Include clear documentation covering tool use, capabilities, limitations, development, and validation.
    • IA-RO-TE-11: Implement mechanisms to record errors and improvement suggestions.
    • IA-RO-TE-12: Ensure activity logs remain accessible throughout contract execution and warranty for transparency and continuous improvement.
  • 6.6 Desinstal·lació
    • IA-RO-D-01: Provide a transparent, complete uninstallation process removing all software components, data, and configurations without residuals; inform stakeholders of items to be deleted and system impact beforehand; and restore the system to its prior state without compromising function or security.
• 7. Requeriments d’Implementació, Desplegament i Manteniment (pp 41- 51)
  • 7.1 Requeriments Generals
    • IA-RG-01: Present a Technology Plan (“Pla Tecnològic”) describing the overall AI solution and detailing how it meets each requirement defined in this PPT
    • IA-RG-02: Submit an Operational and Deployment Plan (“Pla Operatiu i de desplegament”) with a detailed description of the proposed solution, explaining how it addresses all defined requirements
    • IA-RG-03: Provide a Quality Plan (“Pla de Qualitat”) that describes how the proposed solution will satisfy the requirements, including processes, methods, and metrics
    • IA-RG-04: Include an Evidence Generation Plan (“Pla de Generació d’evidència”) detailing studies to demonstrate the solution’s impact on the health system, using Annex 6 as a reference for domains and measures
    • IA-RG-05: When describing the above plans, base them on the phases, milestones, deliverables, and template in Annex 3 of this PPT
  • 7.2 Requeriments Funcionals de la Solució IA
    • IA-R-F-01: The AI solution must perform automatic image analysis of skin lesions to identify those matching the use cases in section 4.4.1 (primary-care staff screening)
    • IA-R-F-02: Support automatic analysis of images captured by mobile devices (phones, tablets) and dermatoscopes
    • IA-R-F-03: Verify image quality before analysis to ensure only suitable images are processed
    • IA-R-F-04: For any additional use cases beyond those defined in 4.4.1, display a notification (“This use case has not yet passed quality testing using SISCAT images”) alongside the results until quality validation is complete
    • IA-R-F-05: Allow users to review inference outputs and log whether results match expected clinical criteria
    • IA-R-F-06: Enable users to record if the result aligns with their professional clinical judgment
    • IA-R-F-07: Provide an option to generate a PDF report of inference results including the user’s review and final decision
  • 7.3 Requeriments d’Usabilitat i Interfície d’Usuari
    • IA-R-UI-01: The AI solution must be accessible via web, mobile, and API interfaces
    • IA-R-UI-02: Ensure the user interface works on desktops, tablets, and iOS/Android devices
    • IA-R-UI-03: Regardless of access method (web, mobile, API), data must be synchronized and available in real time to guarantee continuity in clinical case management
    • IA-R-UI-04: Support rapid navigation between studies, with customizable notifications, filters, and options to export images and reports
    • IA-R-UI-05: Per the PCAP administrative clauses, all user-facing elements (interfaces, PDF reports, etc.) must be available in Catalan at a minimum
  • 7.4 Requeriments de Rendiment
    • IA-R-RS-01: Ensure the average inference latency does not exceed 6.5 seconds per lesion analysis (measured from image input to prediction output)
  • 7.5 Requeriments de Relació amb Proveïdors de Salut
    • IA-R-RP-01: In line with IA-RO-I-03, integrate the solution into all SISCAT information systems as per the clinical data flow defined in sections 4.1 and 4.2; describe deployment across primary-care teams and interfaces with specialized-care references
    • IA-R-RP-02: For a scaled rollout, plan initial deployment with at least 200 primary-care physicians in the EAPs of SISCAT
  • 7.6 Requeriments de Definició de Rols i Responsabilitats dels Usuaris
    • IA-R-DR-01: Allow unlimited creation of user accounts in the solution
    • IA-R-DR-02: Assign a unique identifier to each user following SISCAT systems criteria
    • IA-R-DR-03: Implement advanced authentication and access-control methods to safeguard patient data confidentiality
    • IA-R-DR-04: Support creation and management of user profiles with role-based permissions (primary care, specialized care, management, etc.) as defined by SISCAT or corresponding Directorate
    • IA-R-DR-05: In the Operational and Deployment Plan, detail which personnel have platform access, their roles, and justification for access rights
    • IA-R-DR-06: Describe required professional oversight levels when the technology is used in clinical practice, ensuring acceptability to healthcare professionals
    • IA-R-DR-07: Configure the audit trail to log each user’s unique ID and interactions with the AI solution as part of the clinical workflow
  • 7.7 Requeriments de Suport Tècnic i Manteniment de Primer Nivell
    • IA-R-SM-01: Provide an open, toll-free communication channel for first-level user incidents and queries, accessible to all centers using the solution
    • IA-R-SM-02: Offer user-support services from 08:00 to 20:00 CET Monday- Friday, with the ability to extend hours upon CatSalut request within seven days
    • IA-R-SM-03: Staff first-level support with experts capable of resolving operational questions and basic incidents for healthcare professionals
  • 7.8 Requeriments de Gestió del Canvi i Formació
    • IA-R-GC-01: Include a Change Management strategy in the Operational and Deployment Plan, engaging key stakeholders and co-designing the rollout across all SISCAT primary-care centers and teams
    • IA-R-GC-02: Define a Pre- and Continuous Training Plan for both first- and second-level users, addressing all established requirements
    • IA-R-GC-03: Offer training activities and resources in Catalan, and optionally in Spanish and English
    • IA-R-GC-04: Implement an evaluation system to ensure all users assimilate training content; passing is required before any clinical use authorization
    • IA-R-GC-05: Include a user-satisfaction evaluation mechanism for the training provided
    • IA-R-GC-06: For clinical staff, incorporate in-person sessions, self-learning resources, and guided practice with real or simulated cases
    • IA-R-GC-07: Positively evaluate availability of an online interactive self-learning platform with open, downloadable resources
    • IA-R-GC-08: Propose continuous training, detailing interface and procedural updates after deployment
    • IA-R-GC-09: Include mechanisms to resolve doubts related to training activities and resources
  • 7.9 Requeriments de Traspàs i Transferència de Coneixement
    • IA-R-TT-01: Within six months after contract end, deliver all documentation on solution use and maintenance to AQuAS
    • IA-R-TT-02: Provide AQuAS with the databases used during contract execution, and purge any sensitive contract information
    • IA-R-TT-03: Grant CatSalut an indefinite, unlimited license to use the AI solution after contract completion
  • 7.10 Requeriments de Governança i Gestió de Riscos
    • IA-R-QGC-01: Ensure compliance with the contract governance model defined in section 9.3 of this PPT
    • IA-R-QGC-02: Reflect in the Quality Plan how the governance requirement IA-R-QGC-01 is fulfilled
    • IA-R-QGR-01: Describe the Risk Management Plan in the Quality Plan, covering identification, categorization, mitigation, and continuous monitoring of risks associated with the AI solution
    • IA-R-QGR-02: In the Quality Plan, include the Service Management risk plan detailing risks related to contract services, error-logging, and continuous improvement
    • IA-R-QGR-03: Specify an audit and review schedule in the Quality Plan to ensure the effectiveness of adopted measures
  • 7.12 Requeriments de Monitorització dels Serveis i de la Solució IA
    • IA-R-MS-01: The Quality Plan must propose key indicators to monitor solution performance and usage during contract execution, referencing Annex 5 for a non-exhaustive list
    • IA-R-MS-02: Implement a system to log and monitor service activity, AI solution usage, performance, and impact post-deployment, capturing at minimum user actions, performance metrics, human-oversight modifications, annotations, incident reports, and user satisfaction
    • IA-R-MS-03: Periodically report first- and second-level incident logs as part of contract monitoring to assess service quality
    • IA-R-MS-04: Maintain a record of all training sessions provided to first- and second-level users, including counts by type, participant numbers, resource access statistics, satisfaction levels, and content assimilation metrics
    • IA-R-MS-05: Enable periodic visualization and extraction of activity and monitoring reports (per IA-R-MS-02, IA-R-MS-03, IA-R-MS-04)
    • IA-R-MS-06: Support customizable dashboards for different user needs, adapting activity and monitoring report views to various query types
  • 7.13 Requeriments de Generació d’Evidència
    • IA-R-GE-01: The Evidence Generation Plan must define how to study clinical and technical safety, efficacy, and effectiveness via a study protocol justifying objectives, design (ideally comparative), sample-size calculation, and specific outcome variables
• 8. Suport a Nous Models de Col·laboració (pp 53- 55)
  • 8.1 Requisits de Sistemes de la Informació
    • MC-RO-I-02: During service delivery, use the IT infrastructures provided by CatSalut, following the guidance of the CatSalut Information Systems Area and, where applicable, the Department of Health’s Primary Care Strategic Directorate.
    • MC-RO-I-03: Ensure any solution you design, develop, improve or validate can integrate with all SISCAT information systems according to the data flow required for the selected care pathway, including the IA-HES platform environment.
    • MC-RO-I-04: Package your AI model(s) in a Docker container for consistent deployment.
    • MC-RO-I-04.02: If the model retrieves clinical patient information, describe the proposed API for obtaining that data (format, endpoints, communication method: files, REST, SOAP, gRPC, etc.) before contract signature.
    • MC-RO-I-05: In the case of skin-lesion analysis models, plan for integration with SIMDCAT.
    • MC-RO-I-05.01: The AI solution must accept DICOM files and return results in DICOM via one or a combination of PUSH (file-based or DICOM STORE) or PULL modes, subscribing to SIMDCAT notifications and using QIDO-RS/WADO-RS or WADO-URI to retrieve study UIDs.
    • MC-RO-I-05.02: The solution must return results in DICOM format via PUSH (file-based) or DICOM STORE of the new series/images.
  • 8.2 Requeriments Operatius del Model de Col·laboració
    • MC-R-01: Submit a Collaboration Model proposal detailing the offered services, use-case scenarios, and result-management approach in accordance with requirements MC-R-02 through MC-R-07.
    • MC-R-02: Ensure your proposed model supports joint work on at least one AI model to be developed during the contract.
    • MC-R-03: Account for the use cases defined in section 4.4.2 and describe your technological approach to address them.
    • MC-R-04: Consider the contract’s execution schedule, phases, milestones, and deliverables (sections 9.1 and 9.2) and propose a work plan to cover them.
    • MC-R-05: Include, at minimum, the design of Change Management plans required for deploying any new AI solution(s).
    • MC-R-06: Include, at minimum, the design of Validation and Certification plans for the AI solution(s) in compliance with current regulations.
    • MC-R-07: Include, at minimum, the design of Evidence-Generation studies to assess the impact of new solution(s).
    • MC-R-08: Incorporate a Risk Management and Monitoring plan covering both the AI solution(s) and the execution of the Collaboration Model.

Regulatory Requirements

9.5. Applicable regulations

Each of the AI solutions presented in the bidder's proposal must be certified with:

CE marking, in accordance with Regulation (EU) 2017/745 on medical devices.

• In the case of the AI solution to be provided as part of the services to implement, deploy, and maintain an AI-based solution to support the screening and prioritization of patients with skin lesions, the corresponding AI solution must have CE marking of class IIb or higher for the intended use corresponding to such use cases.

Compliance with Regulation (EU) 2017/745 on medical devices, including:

• EU Declaration of Conformity
• Certificate of registration in the AEMPS (Spanish Agency of Medicines and Medical Devices) Registry of Medical Devices

Intellectual property

Here is the full English text of Section 9.7 “Intellectual Property” (pp. 72- 74) from the Technical Prescriptions Document.

9.7 Intellectual Property

9.7.1 Intellectual property for the services to implement, deploy, and maintain an AI-based solution

• The intellectual property of the technological solution belongs exclusively to the awardee. However, once the contract has ended, the Generalitat de Catalunya has the right to use and modify the developed solution.
• All IP rights arising during the performance of the services under this part of the contract will belong solely and exclusively to the awardee.
• Any additional economic compensation or exploitation rights will be agreed by mutual consent.
• The awardee shall grant the Generalitat de Catalunya a perpetual, unlimited-use license to the technological solution. This license includes the Generalitat’s right to adapt, modify, or add any of its own elements to the solution for its sole internal use.** The awardee will not be liable for any such additions, modifications, or adaptations** under any circumstances.
• The awardee agrees to hold the Generalitat de Catalunya harmless against any third-party claims arising from infringement of these rights caused by performance of the services under this contract.

9.7.2 Intellectual property for the services to develop, improve, and/or validate new AI solutions

• CatSalut will contribute its healthcare- and systems-related expertise and project-management experience.
• AQuAS will provide the data and images required to develop the algorithms and the resources to validate them, if applicable.
• SISCAT entities (designated by CatSalut or the Salud/IA Programme bodies) involved in executing this contract component will contribute their domain knowledge of care environments, processes, pathologies, and/or relevant use cases.
• The awardee will contribute its expertise in developing AI-based technological solutions in dermatology.
• Any other areas of expertise must be agreed between the awardee and the contracting authority.
• The results obtained from these services are considered collective works whenever multiple authors make contributions toward a common work.
• Any dissemination of this project must follow the requirements set out in section 9.8, acknowledging the contributions and authorship of all parties involved.
• Copyright and related rights will be governed by the applicable laws specified in the services contract.

Plec de clàusules administratives particulars (PCAP)

The document "AQUAS-2025-42 PCAP IA DERMATOLOGIA*Final GEEC-000.pdf" is the *Specific Administrative Clauses Document (PCAP)*, which sets out the administrative, legal, and procedural requirements governing the contract.

The PCAP is organized into two main parts, with a total of 12 clauses:

1. DISPOSICIONS GENERALS (General Provisions): Defines the contract scope and services, administrative needs, budget and credit arrangements, contract duration and extensions, legal framework, variant options, procurement processing and award procedures, electronic communication requirements, eligibility criteria, and tenderer solvency rules.
2. DISPOSICIONS RELATIVES A LA LICITACIÓ, L’ADJUDICACIÓ I LA FORMALITZACIÓ DEL CONTRACTE (Tendering, Awarding, and Formalisation): Sets out the requirements for submitting documentation via the electronic envelope system ('sobre digital'), including three encrypted envelopes (A: administrative, B: technical, C: financial) secured by bidder-defined passphrases, as well as the procedures for opening bids, evaluating offers, awarding the contract, and formalising agreements.

📄️ Plec de clàusules administratives particulars (PCAP)

I. DISPOSICIONS GENERALS

📄️ Plec de prescripcions tècniques (PPT)

Serveis pel desplegament d’una solució basada en intel·ligència artificial per suport al cribratge I priorització de pacients amb lesions cutànies mitjançant anàlisi d’imatges en l’àmbit de l’atenció primària I desenvolupament de nous algorismes en dermatologia

📄️ Quadre de característiques del contracte

Núm. de l’expedient: AQUAS-2025-42