What should you ask an AI vendor? A due diligence checklist (DPA, Article 13, Article 53)
Ask for four papers: a data processing agreement if the vendor handles personal data for you, instructions for use if its system is high-risk (Article 13), model documentation if you build on its general-purpose AI model and it is not exempt as open-source (Article 53(2) and Article 53(1), point (b)) and its usage policy. Then ask what Article 26 and Article 25 need from it.
Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article 25(2), the first subparagraph of Article 25(4) and Article 111(2) were replaced; Article 13, Article 26, Article 53, Article 111(3) and Annex XII were not amended.
The short answer
- The DPA is a GDPR document (Article 28 of Regulation (EU) 2016/679), outside the law this site pins.
- A high-risk system comes with instructions for use (Article 13(2) and (3)), and Article 26(1), (5) and (9) depend on them.
- A general-purpose AI model's provider owes documentation to those who integrate it (Article 53(1), point (b) and Annex XII), unless Article 53(2) exempts it on its conditions, which never cover a model with systemic risk.
- Dates: Article 53 since 2 August 2025 (Article 113, third paragraph, point (b)), or by 2 August 2027 for models placed on the market before then (Article 111(3)); Articles 13, 25 and 26 from 2 December 2027 under Annex III and 2 August 2028 under Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), with a transitional rule for systems already on the market (Article 111(2), as replaced).
What does the vendor of a high-risk system owe you?
"High-risk AI systems shall be accompanied by instructions for use in an appropriate digital format or otherwise that include concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers" (Article 13(2)). Article 13(3) sets the minimum:
- (a) "the identity and the contact details of the provider and, where applicable, of its authorised representative";
- (b) "the characteristics, capabilities and limitations of performance of the high-risk AI system", in seven listed items;
- (c) "the changes to the high-risk AI system and its performance which have been pre-determined by the provider at the moment of the initial conformity assessment, if any";
- (d) "the human oversight measures referred to in Article 14, including the technical measures put in place to facilitate the interpretation of the outputs of the high-risk AI systems by the deployers";
- (e) "the computational and hardware resources needed, the expected lifetime of the high-risk AI system and any necessary maintenance and care measures, including their frequency, to ensure the proper functioning of that AI system, including as regards software updates";
- (f) "where relevant, a description of the mechanisms included within the high-risk AI system that allows deployers to properly collect, store and interpret the logs in accordance with Article 12".
You take "appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6" (Article 26(1)). You "monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72" (Article 26(5)). And "Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680" (Article 26(9)). The Article 13 guide reads point (b) in full.
What does a general-purpose AI model provider owe you?
Only if you build on the model. Article 53(1), point (b) requires providers of general-purpose AI models to "draw up, keep up-to-date and make available information and documentation to providers of AI systems who intend to integrate the general-purpose AI model into their AI systems". It must "enable providers of AI systems to have a good understanding of the capabilities and limitations of the general-purpose AI model and to comply with their obligations pursuant to this Regulation" and "contain, at a minimum, the elements set out in Annex XII". All of it is "Without prejudice to the need to observe and protect intellectual property rights and confidential business information or trade secrets in accordance with Union and national law". A company that only uses a chat assistant integrates no model, and point (b) does not address it.
Point 1 of Annex XII is a general description of the model, including:
- "the tasks that the model is intended to perform and the type and nature of AI systems into which it can be integrated";
- "the acceptable use policies applicable";
- "the date of release and methods of distribution";
- "how the model interacts, or can be used to interact, with hardware or software that is not part of the model itself, where applicable";
- "the versions of relevant software related to the use of the general-purpose AI model, where applicable";
- "the architecture and number of parameters";
- "the modality (e.g. text, image) and format of inputs and outputs";
- "the licence for the model".
Point 2 describes "the elements of the model and of the process for its development", including "the technical means (e.g. instructions for use, infrastructure, tools) required for the general-purpose AI model to be integrated into AI systems", "the modality (e.g. text, image, etc.) and format of the inputs and outputs and their maximum size (e.g. context window length, etc.)" and "information on the data used for training, testing and validation, where applicable, including the type and provenance of data and curation methodologies".
Article 53(2): "The obligations set out in paragraph 1, points (a) and (b), shall not apply to providers of AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available." "This exception shall not apply to general-purpose AI models with systemic risks." Ask whether the model meets that test, and whether it has systemic risk under Article 51.
Chapter V has applied since 2 August 2025 (Article 113, third paragraph, point (b)), but providers of models placed on the market before that date "shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027" (Article 111(3)). The GPAI obligations guide covers the rest.
What does Article 25 change for you as the buyer?
Where Article 25(1) makes you the provider of a high-risk system, in any of its three cases, each with its own condition, the initial provider "shall no longer be considered to be a provider of that specific AI system for the purposes of this Regulation" and "shall closely cooperate with new providers and shall make available the necessary information and provide the reasonably expected technical access and other assistance that are required for the fulfilment of the obligations set out in this Regulation" (Article 25(2), as replaced). Where relevant, that includes "making available of technical documentation sufficient to assess compliance with the requirements laid down in Article 16", "informing the new providers about known limitations and failure modes" and "providing the new providers with targeted technical access, including for testing and validation". None of it applies where "the initial provider has clearly specified that its AI system is not to be changed into a high-risk AI system and therefore does not fall under the obligation to cooperate with the new providers and hand over the documentation". All of it is "without prejudice to the need to observe and protect intellectual property rights, confidential business information and trade secrets in accordance with Union and national law" (Article 25(5)). Ask whether yours has; when a deployer becomes a provider reads the three cases.
If you provide a high-risk system and a vendor supplies "an AI system, AI model, tools, services, components, or processes that are used or integrated in a high-risk AI system", the two of you "shall, by written agreement, specify the necessary information, capabilities, technical access and other assistance based on the generally acknowledged state of the art" (Article 25(4), first subparagraph, as replaced, which added "AI model"). That "shall not apply to third parties making accessible to the public tools, services, processes, or components, other than general-purpose AI models, under a free and open-source licence".
The checklist
| Ask the vendor | Why | Provision |
|---|---|---|
| Do you process personal data for us? Send the data processing agreement. | GDPR, not the AI Act | Article 28 of Regulation (EU) 2016/679 |
| Is the system high-risk, and on which route? | Decides most of this list | Article 6 |
| Send the instructions for use. | Article 26 rests on them | Article 13; Article 26(1), (5) and (9) |
| Which logs does it generate, and which are under our control? | You keep those for a period appropriate to the intended purpose, at least six months unless Union or national law provides otherwise | Article 13(3), point (f); Article 26(6) |
| How do we reach you about a risk or a serious incident? | On a risk you inform the provider or distributor and the market surveillance authority and suspend use; a serious incident goes immediately "first the provider", then the importer or distributor and the market surveillance authorities, and if you cannot reach the provider, Article 73 applies | Article 26(5) |
| If we build on your model: send the Annex XII information. | Owed to providers who integrate it | Article 53(1), point (b) |
| Is the model open-source with public parameters, and does it carry systemic risk? | Decides whether that documentation is owed | Article 53(2) |
| When was the model placed on the market? | Before 2 August 2025, its provider has until 2 August 2027 | Article 111(3) |
| Have you said the system is not to be changed into a high-risk one? | If so, its duty to cooperate with you and hand over the documentation does not apply | Article 25(2) |
| If your part goes into our high-risk system: the written agreement. | Required, except for public open-source parts other than general-purpose AI models | Article 25(4) |
| Send the usage policy and terms. | What you may not use it for | Your contract; point 1(b) of Annex XII for a model |
For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation in the first subparagraph of Article 26(5) "shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service law", and they "shall maintain the logs as part of the documentation kept pursuant to the relevant Union financial service law" (Article 26(6)). Answering supplier questionnaires is the other side of this list.
What does Complipath do here, and what does it not?
The vendor page groups your systems by the vendor your register names and shows which papers you hold from each, which are missing and which have expired. It always lists a data processing agreement and the usage policy and terms. It adds instructions for use where one of that vendor's systems is recorded as high-risk, and the Article 53(1), point (b), documentation where the vendor is a model provider on its list and the system is recorded as a third-party model via API or a fine-tuned third-party model. It does not test the Article 53(2) exception, so whether that covers your model is yours to decide. Expired means the review date you entered has passed; you choose which paper a file is, and Complipath does not check what it says. Request papers drafts an email listing what is missing or expired, which you send yourself.
Usage policy monitoring reads once a day the public usage policies of five vendors: Anthropic, OpenAI, Google, Microsoft and Mistral AI. A change counts when the new text holds on a second read and on the next day's run. The vendor's card then shows the date, and where one of your systems names that vendor, your workspace admins get an email. It changes nothing else and does not judge whether the change matters to you. Every live Complipath feature is on one page, and the ranking of compliance tools for mid-size companies compares the alternatives.
What this means for you
If you're a provider: building on a general-purpose AI model makes you the provider Article 53(1), point (b) addresses, so ask for the Annex XII information and check Article 53(2) first. A vendor's part in your high-risk system needs the Article 25(4) written agreement, unless it is a tool, service, process or component other than a general-purpose AI model that the vendor makes accessible to the public under a free and open-source licence.
If you're a deployer: get the instructions for use of every high-risk system before Article 26 applies to it, because Article 26(1), (5) and (9) cannot be met without them.
FAQ
Is a data processing agreement required by the EU AI Act? No. It is a GDPR document, under Article 28 of Regulation (EU) 2016/679, which this site does not pin or quote. The AI Act ties a vendor's papers to the GDPR in Article 26(9): deployers of high-risk systems use the Article 13 information for their data protection impact assessment, where applicable.
What must an AI vendor's instructions for use contain? At least the six points of Article 13(3): the identity and contact details of the provider and, where applicable, its authorised representative; its characteristics, capabilities and limitations of performance; pre-determined changes, if any; the human oversight measures referred to in Article 14; its resources, lifetime and maintenance needs; and, where relevant, how deployers collect, store and interpret its logs.
Does an open-source model provider owe us Annex XII documentation? Not where Article 53(2) applies: a model released under a free and open-source licence allowing access, usage, modification and distribution, with its parameters (weights included) and its architecture and usage information made public. The exception never applies to general-purpose AI models with systemic risk.
When does a general-purpose AI model vendor have to provide this documentation? Chapter V has applied since 2 August 2025 under Article 113, third paragraph, point (b). A provider whose model was placed on the market before 2 August 2025 has until 2 August 2027 under Article 111(3). Ask when the model you use was placed on the market.
Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 6, Article 12, Article 13, Article 14, Article 25, Article 26, Article 51, Article 53, Article 111, Article 113, Annex XI and Annex XII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 25(2), the first subparagraph of Article 25(4), Article 111(2) and Article 113, third paragraph, point (c). Article 13, Article 25(1), Article 26, Article 53, Article 111(3) and Annex XII were not amended. Article 28 of Regulation (EU) 2016/679 is outside the pinned corpus and is not quoted.
Where this question meets the product: AI vendor risk management. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: the AI inventory. Tools ranked on it: Best AI governance software, mid-size firms. Everything else: every live Complipath feature.