Thirty-one questions to ask a CDE vendor before you sign

The demonstration will be a tour. Four folders called Work in Progress, Shared, Published and Archive. A search bar that finds a drawing while you watch. A federated model spun round twice. Somebody will say ISO 19650 inside the first four minutes. Your IT lead will ask about single sign-on and hosting region, which are fair questions and entirely beside the point of this meeting. What nobody in the room usually asks is whether those four folders are four states or just four folders.

That is the question the order form turns into money. So the list below is thirty-one ways of asking it, in the words a sceptical buyer would actually use.

A list that only one product can pass is a brochure. A list any supplier can sit — in a live project, or in a sandbox you control — is diligence. Take it into the room, ask for the answer in the product rather than on a slide, and write down what you saw.

How to use it

Print it. Do not email it to marketing as a questionnaire; you will get thirty-one paragraphs of yes. Sit it in a demonstration you are running.

For each question, accept only one of four answers:

Shown — you watched the product do it, on data that looks like yours.
Configured — they changed a setting and then showed it. Note who will own that setting on day one.
Services — it exists if you buy a professional-services package. The price and the lead time are the answer.
Not in product — which includes "on the roadmap" and "our partner does that".

Do not score suppliers against each other here. Score each answer against the job you actually run: one live package, one transmittal, one site engineer who will not wait for a seat to be provisioned. If two suppliers both answer "shown" on the issued set and one of them cannot export the audit trail, you already know which conversation to continue. Any ranking is yours to make. The list does not have a favourite.

A yes that cannot be shown is a no.

States

ISO 19650 describes a common data environment as an agreed source of information for collecting, managing and disseminating each information container through a managed process. The practice that grew up around it uses four states: work in progress, shared, published, archive. A state is a claim about the container, enforced by a gate. A folder name is a costume for a state.

Can a container be in only one state at a time — or can a copy of it sit in two folders, or two libraries, with nobody being told?
Who is allowed to move something from shared to published, and is that a recorded action or a drag-and-drop that anyone with write access can do?
Can you stop a work-in-progress container being downloaded, plotted or issued as though it were published, without a recorded review?
Pick one container and show me every state it has been in and who moved it — without reconstructing the story from folder history and email.
What was in Published for this package on a named date last month? Answer that from the system of record.

If question 1 fails, stop. The rest of the tour is a folder tree.

Suitability

A suitability — the S and A codes in UK practice — is a sentence about permitted use. S2 is not a decoration. It is the difference between "use this to coordinate" and "build this". ISO 19650-1 clause 12.1 asks for a status on each container so the recipient can see the permitted use, and a filename suffix somebody forgets is not that status.

Does every container carry a suitability or status from an agreed list we can configure — including a project list that is not the UK National Annex default — or is the code a string in the filename?
Can the system refuse to issue, transmit or plot a container whose suitability still says coordination, information or review?
Does the recipient see the suitability on the issued package and on the site set, or only the person who applied it?
Has anyone on a live customer project recorded an action the code forced — a hold, a refusal to use, a request for a new revision? Show me that record.

A code that never constrains a subsequent action is metadata. Metadata is not suitability.

The issued set

Nobody in the demonstration will define this term, so define it before you go in. An issued set is bounded and authorised — these revisions, this purpose, this list of recipients, this moment — rather than whatever happens to be newest in a folder, and a transmittal is the evidence that the act took place. Software that cannot answer the issued-set question is a filing cabinet with a search bar.

What is an issued set in this product — a view of "latest", or a bounded authorised collection with revisions, purpose, named recipients and a timestamp that still answers after the issuer has left the company?
Produce a transmittal from the system rather than from a mailbox: number and date, recipients, the exact containers and revisions, the purpose, and any acknowledgement.
Once a revision is superseded, can the old sheet still be downloaded, plotted or treated as live by somebody who was never told?
Can a site engineer get the current issued set for one live package in ten minutes, from the published or issued location, without ringing the document controller and without opening last week's email?

If the demonstration runs on a tidy sandbox and will not attempt question 13 on a package that looks like yours, you have watched a brochure.

Audit trail

Version history is a stack of saves. An audit trail is a log of authorised actions: who issued, who moved state, who downloaded, who changed suitability, and when. The two get sold as the same feature by people who know they are not.

Show me who viewed, downloaded, issued, or changed the state or suitability of a container, with timestamps that belong to the project rather than to somebody's personal activity feed.
Is that a history of file saves, or a history of authorised acts — issue, supersede, reject, transmit?
Can we export the audit trail as a record we own, in an open format, or does it only exist inside your interface while the subscription is live?
What happens to that history when a user is deactivated, a company share ends, or a guest account expires — is the action still attributable, or does the name become "former user"?

If the history dies when a share ends, you have a session log rather than an audit trail.

Export

The appointing party will need the record after the licence ends. Handover, a claim, a facilities team, an enquiry four years from now: none of them waits for a renewal. Treat export as the exit clause it is, and test it like one.

Can we export every container together with its metadata — state, suitability, revision, naming fields, issue date — in open formats we can open without your product?
Is that export the whole record: superseded revisions, comments, transmittals and the audit trail? Or only the files that happen to be current?
Who is entitled to run it — the appointing party, the information manager, or only your services team — and what does the second one cost?
How many days after the contract ends can we still take a complete export, and is that in the order form or only in the demonstration script?

Ask to watch an export happen, then open the files on a machine that has never had the product installed. If you cannot, you have been shown a download button.

Offline

Site work does not wait for a signal. An environment that is authoritative only on a good connection will lose Tuesday morning to a plot and a phone photograph.

Can field users get the current issued set without a reliable connection — and is what lands on the device the issued set, or a cache of whatever they last opened?
When they reconnect, does the device refuse to treat a stale local copy as live, or can last week's sheet still be plotted off the tablet?
Can a mark-up, an acknowledgement or a hold made offline come back into the record with its time and author, or does it die on the device?

Offline that cannot supersede is how the unofficial set gets born.

Permissions

Access control is necessary, and it is a different job from managing containers through states. A locked cupboard can still contain the wrong drawing. What matters here is whether permissions match the appointment — who may see work in progress, who may see the issued set, who must never see another company's commercial folder — and whether those facts survive people leaving.

Are permissions scoped to appointed companies and roles, or only to folders and security groups that a coordinator has to keep in step by hand?
Can the appointing party see the issued set without seeing another appointed party's work in progress, and can that party's commercial folder stay shut without hiding the published record?
When a person moves company, or a company leaves the job, do their past actions stay attributable, and does their access end without deleting the containers they issued?

If the only answer to "who can see this?" is an access-control list, you have bought security. You have not yet bought a common data environment.

Migration

You will arrive from something and you will leave for something. The incumbent is usually a shared drive, a previous environment, or a consultant's portal nobody intends to renew. Migration that preserves files and loses states, transmittals and the issued-set history is a copy, not a move.

Can you migrate us into this environment from what we have now without losing revision history, states, suitability and transmittals — and can you name a project that already did it?
Can we migrate out on the same terms, into an open package the next information manager can load, with no release fee and no format that only you can read?
Who performs the migration, what is contractually guaranteed to survive, and what is accepted as "best endeavours" — files only, or files plus the record of issue?
After the move, can we still answer the issued-set question for a date that predates the migration, from the new system of record?

If question 29 is weaker than question 28, the friendly import is the product and the lock-in is the business model.

Section	Questions	If it fails
States	1–5	Stop — the rest of the tour is a folder tree
Suitability	6–9	The code is metadatanot suitability
The issued set	10–13	You have watched a brochure
Audit trail	14–17	A session lognot an audit trail
Export	18–21	You have been shown a download button
Offline	22–24	The unofficial set gets born
Permissions	25–27	You have bought securitynot a common data environment
Migration	28–31	The friendly import is the productlock-in is the business model

What to do with the answers

You do not need a weighted score. You need holes.

Mark every question that was not Shown. A hole in states, suitability or the issued set is not a negotiation point; it is a reason not to call the thing a common data environment, whatever the BEP says later. A hole in export or migration is a reason to get the exit written into the order form before the logo goes on anyone's slide. A hole in offline or permissions tells you roughly which week the unofficial set will appear.

Then hand the marked list to the person who will actually run the register, not only to the person who will sign. If the document controller cannot picture themselves asking question 13 on a wet Tuesday, do not sign.

What thirty-one clean answers do not buy

They do not buy compliance. ISO 19650, CDM, the Building Safety Act, NEC, FIDIC, JCT, COBie and MOMRA each have owners, and none of them certifies software. Compliance is a process you run with people in it. What a product can do is hold the mechanics that process needs — one state at a time, a suitability that constrains, one issued set, a trail you can export — or decline to, and these questions only tell you which purchase is in front of you.

So use the leverage while you have it, because it expires the day you sign. Before the discount is agreed, get the export right, the export window and the migration-out terms into the order form itself rather than a sales email; if the supplier has to build the audit-trail export, that is a price and a date, and you are entitled to both now. Ask for a sandbox loaded with one of your own packages and run questions 4, 5 and 13 in it yourself. Budget for the seat that will own suitability and state changes on day one, because a product configured by a supplier and then owned by nobody drifts back into a shared drive inside a year. And if the appointing party is the one paying, the appointing party should be in the room for the export questions — those are the four that decide who holds the record when the job is over.