# AI vendor questions checklist

Start with who the provider is and whether the system is high-risk, because most of what a vendor owes you follows from those two answers. This free checklist from complipath.io groups the questions by what they settle, names the provision behind each one and marks as practice the questions the Regulation does not ask.

## Who is the provider, and what is the system for?

- Who is the provider of this system under the EU AI Act: who develops it or has it developed and places it on the market or puts it into service under its own name or trademark?
- What is its intended purpose, as stated in your instructions for use, promotional or sales materials and statements, as well as in the technical documentation?
- Is it built on a general-purpose AI model, and whose?

Provision: Article 3, points (3) and (12)

## Is it high-risk?

- Do you classify it as high-risk, and under which route: Article 6(1) with Annex I, or Article 6(2) with a point of Annex III?
- If it is in Annex III and you consider it not high-risk, did you document that assessment before placing it on the market or putting it into service (Article 6(4)), and register it under Article 49(2)?
- Does it perform profiling of natural persons? An Annex III system that does is always high-risk (Article 6(3), third subparagraph).

Provision: Article 6

## For a high-risk system: the instructions for use

- Can we have the instructions for use, with at least the information Article 13(3) lists?
- What level of accuracy, including its metrics, robustness and cybersecurity, was it tested and validated against, and which known and foreseeable circumstances may affect it (Article 13(3), point (b)(ii))?
- Which known or foreseeable circumstances, in intended use or under reasonably foreseeable misuse, may lead to risks to health and safety or fundamental rights (Article 13(3), point (b)(iii))?
- Which human oversight measures are built in, and which do you expect us to implement (Article 13(3), point (d); Article 14(3))?
- Where relevant, how can we collect, store and interpret the logs (Article 13(3), point (f))?
- Which changes to the system and its performance did you pre-determine at the initial conformity assessment, if any (Article 13(3), point (c))?

Provision: Article 13(3)

## For a high-risk system: conformity, registration and logs

- Has it undergone the relevant conformity assessment procedure before being placed on the market or put into service, have you drawn up the EU declaration of conformity and is the CE marking affixed (Article 16, points (f), (g) and (h))?
- Do you have a quality management system that complies with Article 17 (Article 16, point (c))?
- Is it registered in the EU database? For a system listed in Annex III, other than in point 2, the provider or, where applicable, its authorised representative registers before placing it on the market or putting it into service (Article 49(1)).
- Do you keep the logs under your control for a period appropriate to its intended purpose, of at least six months unless Union or national law provides otherwise (Article 19(1))?
- If we are a public authority or a Union institution, body, office or agency: we may not use a high-risk system that is not registered in the EU database, and we tell you or the distributor (Article 26(8)).

Provision: Article 16

## For a high-risk system: incidents, corrections and changes

- Who is our contact for a serious incident? We inform you first and immediately. If we cannot reach you, Article 73 applies to us mutatis mutandis (Article 26(5)).
- If the system is not in conformity, how will you tell us? Article 20(1) has you take the necessary corrective actions and inform the distributors and, where applicable, the deployers, the authorised representative and importers.
- Which changes would make us the provider? Article 25(1) names three: our name or trademark on a high-risk system, unless a contract allocates the obligations otherwise; a substantial modification after which it remains high-risk; a change of intended purpose that makes a system high-risk.
- If that happens, what will you give the new provider? Article 25(2), as replaced by Regulation (EU) 2026/1744, names, where relevant, technical documentation sufficient to assess compliance, information on known limitations and failure modes and targeted technical access, including for testing and validation, unless you clearly specified that the system is not to be changed into a high-risk system.
- Practice: how and when do you tell us about a change of model or model version before it reaches us?

Provision: Article 26(5)

## If you build on a vendor's general-purpose AI model

- What information and documentation do you make available to providers who integrate the model into their AI systems, and does it contain at least the elements of Annex XII?
- Does it give us a good understanding of the model's capabilities and limitations, enough to comply with our own obligations (Article 53(1), point (b)(i))?
- The duty is without prejudice to protecting intellectual property rights, confidential business information and trade secrets, so ask what is withheld on those grounds (Article 53(1), point (b)).
- Is the model released under a free and open-source licence that allows its access, usage, modification and distribution, with its parameters, including the weights, the information on the model architecture and the information on model usage made public? Then Article 53(2) lifts point (b), unless it is a model with systemic risk.

Provision: Article 53(1), point (b)

## Transparency

- If it interacts directly with people, does it tell them they are interacting with an AI system, where Article 50(1) requires it?
- If it generates synthetic audio, image, video or text, are the outputs marked in a machine-readable format and detectable as artificially generated or manipulated (Article 50(2))? A system placed on the market before 2 August 2026 has until 2 December 2026 (Article 111(4)).
- If it recognises emotions, categorises people biometrically, makes deep fakes or writes text we publish on matters of public interest, the disclosure is ours as deployer under Article 50(3) and (4): how does the system support it?

Provision: Article 50

## Data, contract and terms

- Is our data used to train your models or anyone else's? Point us to the clause.
- Which subprocessors and model providers receive our data, and where is it processed?
- Will you sign a data processing agreement where you process personal data for us? That is a GDPR question, outside the AI Act and outside the law this checklist was checked against.
- What do your usage terms forbid us to do with the system, and how will you tell us when they change?
- What happens to our data when the contract ends?

## Supporting our own duties

- What material do you offer the people who will use the system? It can feed the AI literacy measures we take for them.
- Practice: who at your company answers our questions about the system, and how fast?

Provision: Article 4(1), as replaced by Regulation (EU) 2026/1744

Source: https://www.complipath.io/templates/ai-vendor-questions-checklist/