What should you ask an AI vendor under the EU AI Act?

Download it, with no email asked

• AI vendor questions checklist, Markdown

What is in it

Who is the provider, and what is the system for?

• Who is the provider of this system under the EU AI Act: who develops it or has it developed and places it on the market or puts it into service under its own name or trademark?
• What is its intended purpose, as stated in your instructions for use, promotional or sales materials and statements, as well as in the technical documentation?
• Is it built on a general-purpose AI model, and whose?

Provision: Article 3, points (3) and (12)

Is it high-risk?

• Do you classify it as high-risk, and under which route: Article 6(1) with Annex I, or Article 6(2) with a point of Annex III?
• If it is in Annex III and you consider it not high-risk, did you document that assessment before placing it on the market or putting it into service (Article 6(4)), and register it under Article 49(2)?
• Does it perform profiling of natural persons? An Annex III system that does is always high-risk (Article 6(3), third subparagraph).

Provision: Article 6

For a high-risk system: the instructions for use

• Can we have the instructions for use, with at least the information Article 13(3) lists?
• What level of accuracy, including its metrics, robustness and cybersecurity, was it tested and validated against, and which known and foreseeable circumstances may affect it (Article 13(3), point (b)(ii))?
• Which known or foreseeable circumstances, in intended use or under reasonably foreseeable misuse, may lead to risks to health and safety or fundamental rights (Article 13(3), point (b)(iii))?
• Which human oversight measures are built in, and which do you expect us to implement (Article 13(3), point (d); Article 14(3))?
• Where relevant, how can we collect, store and interpret the logs (Article 13(3), point (f))?
• Which changes to the system and its performance did you pre-determine at the initial conformity assessment, if any (Article 13(3), point (c))?

Provision: Article 13(3)

For a high-risk system: conformity, registration and logs

• Has it undergone the relevant conformity assessment procedure before being placed on the market or put into service, have you drawn up the EU declaration of conformity and is the CE marking affixed (Article 16, points (f), (g) and (h))?
• Do you have a quality management system that complies with Article 17 (Article 16, point (c))?
• Is it registered in the EU database? For a system listed in Annex III, other than in point 2, the provider or, where applicable, its authorised representative registers before placing it on the market or putting it into service (Article 49(1)).
• Do you keep the logs under your control for a period appropriate to its intended purpose, of at least six months unless Union or national law provides otherwise (Article 19(1))?
• If we are a public authority or a Union institution, body, office or agency: we may not use a high-risk system that is not registered in the EU database, and we tell you or the distributor (Article 26(8)).

Provision: Article 16

For a high-risk system: incidents, corrections and changes

• Who is our contact for a serious incident? We inform you first and immediately. If we cannot reach you, Article 73 applies to us mutatis mutandis (Article 26(5)).
• If the system is not in conformity, how will you tell us? Article 20(1) has you take the necessary corrective actions and inform the distributors and, where applicable, the deployers, the authorised representative and importers.
• Which changes would make us the provider? Article 25(1) names three: our name or trademark on a high-risk system, unless a contract allocates the obligations otherwise; a substantial modification after which it remains high-risk; a change of intended purpose that makes a system high-risk.
• If that happens, what will you give the new provider? Article 25(2), as replaced by Regulation (EU) 2026/1744, names, where relevant, technical documentation sufficient to assess compliance, information on known limitations and failure modes and targeted technical access, including for testing and validation, unless you clearly specified that the system is not to be changed into a high-risk system.
• Practice: how and when do you tell us about a change of model or model version before it reaches us?

Provision: Article 26(5)

If you build on a vendor's general-purpose AI model

• What information and documentation do you make available to providers who integrate the model into their AI systems, and does it contain at least the elements of Annex XII?
• Does it give us a good understanding of the model's capabilities and limitations, enough to comply with our own obligations (Article 53(1), point (b)(i))?
• The duty is without prejudice to protecting intellectual property rights, confidential business information and trade secrets, so ask what is withheld on those grounds (Article 53(1), point (b)).
• Is the model released under a free and open-source licence that allows its access, usage, modification and distribution, with its parameters, including the weights, the information on the model architecture and the information on model usage made public? Then Article 53(2) lifts point (b), unless it is a model with systemic risk.

Provision: Article 53(1), point (b)

Transparency

• If it interacts directly with people, does it tell them they are interacting with an AI system, where Article 50(1) requires it?
• If it generates synthetic audio, image, video or text, are the outputs marked in a machine-readable format and detectable as artificially generated or manipulated (Article 50(2))? A system placed on the market before 2 August 2026 has until 2 December 2026 (Article 111(4)).
• If it recognises emotions, categorises people biometrically, makes deep fakes or writes text we publish on matters of public interest, the disclosure is ours as deployer under Article 50(3) and (4): how does the system support it?

Provision: Article 50

Data, contract and terms

• Is our data used to train your models or anyone else's? Point us to the clause.
• Which subprocessors and model providers receive our data, and where is it processed?
• Will you sign a data processing agreement where you process personal data for us? That is a GDPR question, outside the AI Act and outside the law this checklist was checked against.
• What do your usage terms forbid us to do with the system, and how will you tell us when they change?
• What happens to our data when the contract ends?

Supporting our own duties

• What material do you offer the people who will use the system? It can feed the AI literacy measures we take for them.
• Practice: who at your company answers our questions about the system, and how fast?

Provision: Article 4(1), as replaced by Regulation (EU) 2026/1744

The same work, in the app

Vendors groups the AI systems in your register by the company behind them and marks each paper you need from it Have, Missing or Expired; Request papers writes the email listing what is missing, for you to send from your own address. Vendors and vendor papers.

The provisions it names

Article 3, points (3) and (12); Article 4(1), as replaced by Regulation (EU) 2026/1744; Article 6; Article 13(3); Article 14(3); Article 16; Article 19(1); Article 20(1); Article 25(1); Article 25(2), as replaced by Regulation (EU) 2026/1744; Article 26(5) and (8); Article 49(1) and (2); Article 50; Article 53(1), point (b); Article 53(2); Article 111(4), added by Regulation (EU) 2026/1744; Annex XII. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.