AI Vendor Due Diligence Questionnaire (EU AI Act)

Document 11 of the RegShelf kit is a fill-in questionnaire — one copy per vendor per AI system — with five question sections (General; Transparency; Data & GDPR; Robustness & support; AI Act posture), a green/amber/red scoring rubric, a list of seven contract items to request, and a decision record. Its premise is stated on page one: "We are AI Act compliant" is a marketing sentence. The questionnaire asks for the specific artefacts — instructions for use, documentation, test results, a DPA — that let you verify the claim, and treats a vendor who cannot answer as itself an answer about risk.

Any company deploying third-party AI: standalone tools, APIs, and AI features inside broader SaaS products. Your vendor's gaps surface in your product — if a vendor chatbot lacks the built-in AI-interaction disclosure its provider owes under Article 50(1), your customers see the gap, and you separately carry your own deployer duties under Article 50(3)–(4). If a vendor screening tool turns out to be high-risk and undocumented, you are the one using it on real candidates. And if you white-label a vendor system under your own brand, the Act treats you as its provider, with the full provider duty set.

The questionnaire is careful about who owes what:

• Article 25 allocates responsibilities along the AI value chain — information, cooperation and notification duties between providers and downstream actors belong in the contract, which is why Section 7 lists clauses rather than hopes.
• Article 50 attribution: AI-interaction disclosure by design (50(1)) and machine-readable marking (50(2)) are the provider's; informing people about emotion recognition or biometric categorisation (50(3)) and visible deepfake/public-interest-text labels (50(4)) are yours as deployer — question B4 asks what features the vendor provides to support your labelling duty, not theirs.
• Training-data summaries: the duty to publish one (Article 53(1)(d)) applies to GPAI model providers, not to every AI vendor — question C1 asks accordingly instead of demanding a GPAI artefact from an ordinary system provider.
• Supervision: for AI systems based on a general-purpose AI model developed by the same provider, the AI Office acts as market surveillance authority (Article 75) — question E7 captures which authority is competent for your vendor.

Over thirty questions across five sections:

• A — General: legal identity and EU establishment, system and version, intended purpose in plain language, the vendor's own role under the Act, and written confirmation that your intended use is within the intended purpose;
• B — Transparency (Article 50): disclosure features, machine-readable marking and its survival across transformations, deepfake-labelling support, defaults and configuration;
• C — Data & GDPR: training-data categories, training on your inputs and the opt-out, data residency, DPA with SCCs, retention and sub-processors;
• D — Robustness & support: evidenced accuracy claims, known limitations and failure modes, incident process, update notices, human-oversight features, security certifications;
• E — AI Act posture: the vendor's own classification and reasoning, Annex III preparation status for 2 December 2027, upstream GPAI models, deployer documentation, Article 5 screening including the December 2026 CSAM/NCII safeguards, and regulatory history;

plus seven contract items (compliance warranty, notification duties, cooperation clause, no silent repurposing, training-data/IP indemnity, exit terms), the one-red-blocks-adoption scoring rule, and a decision table with a worked example.

Send one questionnaire per vendor per AI system, score each section green, amber or red — and do not average: one red section blocks adoption until resolved. Feed the outcome into your AI system inventory, set written conditions with deadlines for ambers, and re-run the questionnaire on material vendor changes (new model version, changed terms, acquisition). Any answer suggesting an Article 5 prohibited practice means running the prohibited practices screen immediately.