Questionnaire, audit or Trust Center: what do enterprise customers ask for, and when?
A questionnaire asks what you do, an audit checks that your answers hold, and a Trust Center lets the customer fetch the evidence without asking. The EU AI Act requires none of the three. It changes the questions, because your customer now carries duties of its own.
Written 1 November 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI); Articles 13 and 26 and Article 50(1) to (6) were not amended.
In short
- Questionnaire: questions in the customer's own file, usually at procurement or vendor onboarding. You answer what you do, per system, with evidence.
- Audit: the customer checks that your answers hold and asks for the proof behind them. Any audit right comes from your contract, not from the Act.
- Trust Center: a page the customer opens on its own. No article of the Act requires one.
- What the Act adds: the customer has duties as a deployer: Article 4, Article 50(3) and (4) where they reach it and, for a high-risk system, Article 26, each from its own date. Its questions to you follow from them.
- One supplier agreement is the Act's own: if your customer provides a high-risk system and you supply something used or integrated in it, Article 25(4), as replaced, requires a written agreement, with an open-source exception.
How do a questionnaire, an audit and a Trust Center differ?
| Questionnaire | Audit | Trust Center | |
|---|---|---|---|
| What it asks | What you do. | Whether what you said holds. | Nothing: it answers before anyone asks. |
| When it tends to come | Procurement and vendor onboarding, often again at renewal. | When an answer has to be shown, not stated: at renewal, after an incident, or for a use the customer must answer for itself. | Any time: a reviewer before a questionnaire goes out, or a new team at the customer. |
| What it needs from you | An answer per question and per system, with its evidence. | The record behind each answer: the classification and its article, the document, who confirmed it and when. | The documents you choose to publish, and a rule for who gets the rest. |
| Where it comes from | The customer's vendor-risk process. | The audit clause in your contract. | Your own choice. |
Every cell in the second row is practice rather than law, and customers differ. Neither Regulation (EU) 2024/1689 nor the amending act mentions a Trust Center or a customer's audit of its supplier. The one questionnaire in the Act is a template the AI Office develops to help deployers with their fundamental rights impact assessment (Article 27(5), as replaced). None is set for suppliers.
When does a customer send a questionnaire?
Before it signs. A procurement or vendor-risk team sends a spreadsheet or a Word document, with the AI questions beside the security and data protection ones. It asks what you do and cannot yet check it.
Answer per system: Article 6 classifies AI systems, not companies. The evidence is light: each system's classification with its date, the record behind each control, and an owner. How to answer AI supplier questionnaires sets out the five parts of an answer, and the 30 AI Act questions your enterprise customers will ask lists what they ask.
When does a customer audit instead?
When an answer has to be shown. The audit takes the questionnaire you returned, or the contract's own list, and asks for the proof: the classification and its article, the document behind the control, and who confirmed the answer and when.
The audit right comes from the contract. The Act's own audits are something else: a notified body carries out periodic audits of a provider's approved quality management system and gives the provider an audit report (point 5.3 of Annex VII). What an EU AI Act audit looks like sets out what the Act does provide.
When is a Trust Center enough?
When the customer wants evidence it can fetch itself. It does not replace a questionnaire the customer's process requires; it shortens one, because an answer can point to a published, dated document.
It cannot stand in for a duty the Act addresses to someone else. Under Article 50(5), the transparency information reaches the person "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure": where the person meets the system or its content, not on a page about it. What to publish in an AI Trust Center goes item by item.
How does the EU AI Act change what customers ask?
The customer is a deployer: a person or body "using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity" (Article 3, point (4)). If you develop the system or have it developed and place it on the market or put it into service under your own name or trademark, you are its provider (Article 3, point (3)). Each of the customer's duties becomes questions to you.
AI literacy. Article 4(1), as replaced by Regulation (EU) 2026/1744, requires providers and deployers to "take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The measures take into account those persons' technical knowledge, experience, education and training, the context of use and the persons the systems are used on. The obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". Article 4 has applied since 2 February 2025 (Article 113, third paragraph, point (a)), in this wording since 27 July 2026 (Article 4 of Regulation (EU) 2026/1744), and binds you too, so the customer asks what your measures are. The asking is practice; the duty is law.
Transparency. Article 50(1) and (2) are provider duties. A system intended to interact directly with people is designed so that they are informed that it is an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances and context of use. A system generating synthetic audio, image, video or text has its outputs marked in a machine-readable format and detectable as artificially generated or manipulated. Article 50(3) and (4) are deployer duties: informing people exposed to emotion recognition or biometric categorisation, and disclosing deep fakes and AI-generated text published to inform the public on matters of public interest.
Each paragraph carries exceptions of its own; the four Article 50 disclosures sets them out. Article 50 has applied since 2 August 2026 (Article 113, second paragraph). A provider whose synthetic-content system was placed on the market before that date has until 2 December 2026 for Article 50(2) (Article 111(4), as added by Regulation (EU) 2026/1744).
High-risk use. A deployer of a high-risk system takes appropriate technical and organisational measures to use it in accordance with its instructions for use (Article 26(1)). It assigns human oversight to people with the necessary competence, training and authority, as well as the necessary support (Article 26(2)). Where applicable, it uses the information provided under Article 13 for its data protection impact assessment (Article 26(9)).
Those are three of Article 26's twelve paragraphs; the deployer obligations guide has all of them. Paragraphs 1 and 9 both rest on what you send: the instructions for use that, under Article 13(2), accompany a high-risk system. Articles 13 and 26 apply from 2 December 2027 for a system high-risk under Annex III, and from 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced). They do not apply to high-risk AI systems related to products under Section B of Annex I (Article 2(2), as replaced).
Supplying a high-risk provider. "The provider of a high-risk AI system and the third party that supplies an AI system, AI model, tools, services, components, or processes that are used or integrated in a high-risk AI system shall, by written agreement, specify the necessary information, capabilities, technical access and other assistance based on the generally acknowledged state of the art, in order to enable the provider of the high-risk AI system to fully comply with the obligations set out in this Regulation" (Article 25(4), as replaced). It does not apply to third parties making tools, services, processes or components, other than general-purpose AI models, accessible to the public under a free and open-source licence. Article 25 takes the same dates and the same Section B exception as Article 26.
How do the three fit together?
They draw on one record. The questionnaire answer is what the audit checks, and the Trust Center publishes the part you choose. Tie each answer to a system, its dated classification, a document and an owner, and the audit asks only for what you hold.
The three must agree: a control answered as Planned cannot appear as done on the Trust Center.
In Complipath, a questionnaire is answered from what the workspace holds, each answer with its source and confirmed by a person (answer customer AI questionnaires). The audit room, report and pack are on Starter and up, the room shared with the customer on Growth and up (customer audits). The Trust Center is on Growth and up; a requested file goes out only after your yes, on a seven-day link.
What this means for you
If you're a provider: expect questions on Article 50(1) and (2), provider duties only you can answer for. For a high-risk system, your instructions for use are what the customer's Article 26 work rests on, and Article 25(4), as replaced, may require a written agreement with a customer that is itself a high-risk provider.
If you're a deployer: send the same questions to your own AI providers; their answers are your evidence. Article 4 is yours whatever the risk tier, Article 50(3) and (4) where they reach you, and Article 26 for a high-risk system from the dates above.
FAQ
Does the EU AI Act require us to answer customer questionnaires? No. The Act sets no supplier questionnaire; its only questionnaire is the AI Office's template for a deployer's fundamental rights impact assessment. The supplier arrangement it does require is a written agreement between a high-risk system's provider and a third party supplying something used or integrated in it (Article 25(4), as replaced), with an open-source exception.
Can a customer audit us under the AI Act? Not under the Act itself: a customer's audit right comes from your contract. The audits the Act provides for are a notified body's periodic audits of a provider's approved quality management system, ending in an audit report (point 5.3 of Annex VII). A customer's audit checks what you told the customer, against the proof you hold.
Is a Trust Center a substitute for a questionnaire? Not where the customer's process requires its own questionnaire, but it can shorten one: an answer can point to a published, dated document. It cannot replace an Article 50 notice either, which reaches the person at the latest at the time of the first interaction or exposure (Article 50(5)), inside the product.
Which AI Act duties make customers ask us questions? Their own. Article 4 has bound them since 2 February 2025, and Article 50(3) and (4) bind them where they reach them. For a high-risk system, Article 26 applies from 2 December 2027 under Annex III and 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I (Article 113).
Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 2(2), Article 3, points (3) and (4), Article 4, Article 6, Article 13, Article 25, Article 26, Article 27(5), Article 50, Article 111, Article 113 and Annex VII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 2(2), Article 4, the first subparagraph of Article 25(4), Article 27(5) and Article 113, third paragraph, points (a) and (c); it also added Article 111(4); it entered into force on 27 July 2026 (its Article 4).
Where this question meets the product: what counts as evidence for each requirement. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: AI Act technical documentation software. Tools ranked on it: Best Annex IV documentation software. Everything else: every live Complipath feature.
How Complipath helps
Complipath turns each confirmed classification into the requirements it brings, each with an owner, a status and the date it applies from, and drafts the Annex IV documentation from your register. What we do best, from that same record: customer questionnaires, customer audits and a Trust Center. It is done for you: send two files you already have, and you confirm.