Managing AI Vendors Under the EU AI Act: Deployer Due Diligence
As a deployer, AI vendor management means verifying the provider's conformity package — CE marking, documentation, registration — and securing cooperation.
Most organisations meet the EU AI Act, Regulation (EU) 2024/1689, as deployers of vendor AI, not as builders of high-risk systems. That makes vendor management the core compliance activity: not a statutory "vendor obligation", but the due diligence a deployer does on a provider's compliance package. Done well, it is most of what a deployer owes.
Frame it as due diligence, not a vendor duty
The Act imposes obligations on providers, deployers, importers and distributors — not on "vendors" as a separate category. So when you assess an AI vendor, you are doing deployer due diligence on whether the provider has met its obligations, so that you can rely on the system and meet your Article 26 duties. Frame it that way; it keeps the responsibilities straight.
What to verify for a high-risk system
If the system you are buying is high-risk, confirm the provider has the package in order:
- CE marking (Article 48) and a Declaration of Conformity (Article 47).
- Technical documentation (Article 11, Annex IV) and a completed conformity assessment (Article 43).
- EU database registration (Article 49).
- For non-EU providers, an EU authorised representative (Article 22).
- Clear instructions for use (Article 13) — you need these to operate the system correctly and exercise oversight.
For a non-high-risk system, the diligence is lighter, but you still confirm any Article 50 transparency obligations are handled and that the provider's GPAI position (for the underlying model) is sound.
What to secure in the contract
Two things matter beyond the package. First, Article 25(2) cooperation: if you might modify or rebrand the system (which would flip you to provider under Article 25), secure the original provider's commitment to cooperate and share the information and technical access you would need. Second, information and assistance to meet your deployer duties — instructions, logs access, incident-notification channels for Article 73.
Ongoing, not one-off
Vendor management is continuous. Re-verify on substantial modification, on a vendor's model change, and on role changes (a customisation that turns you into the provider). Keep a record of each vendor's compliance status alongside the system in your register, so an authority's question has a documented answer.
Worked example: procuring an HR-tech tool
Borealis Group procures a high-risk recruitment-screening tool. Its vendor due diligence confirms the provider's CE marking, Declaration of Conformity, Annex IV documentation, EU database registration and (the provider being non-EU) its authorised representative, and obtains the instructions for use. The contract secures Article 25(2) cooperation in case Borealis later customises the tool, and an incident-notification channel. Borealis records the vendor's status in its register and re-checks it at renewal.
How Confir helps
Confir structures the vendor due-diligence record against the provider's obligations — CE marking, Declaration, documentation, registration, authorised representative — alongside each system in your inventory, and flags where a planned customisation would flip you to provider under Article 25. The engine is deterministic and rule-based, so the diligence record is consistent and auditable.
Frequently asked questions
What is AI vendor management under the EU AI Act?
It is the deployer due diligence on an AI provider's compliance package — verifying the provider has met its obligations so you can rely on the system and meet your own Article 26 duties. The Act imposes obligations on providers and deployers, not a separate "vendor obligation", so it is best framed as diligence.
What should we verify for a high-risk vendor system?
CE marking (Article 48), the Declaration of Conformity (Article 47), the technical documentation (Article 11, Annex IV) and completed conformity assessment (Article 43), EU database registration (Article 49), an EU authorised representative for non-EU providers (Article 22), and clear instructions for use (Article 13).
What should the contract secure?
Article 25(2) cooperation and information-access from the original provider (important if you might modify or rebrand the system and become its provider), instructions and logs access to meet your deployer duties, and an incident-notification channel for Article 73 serious incidents.
Is vendor management a one-off check?
No. Re-verify on substantial modification, on a vendor's model change, and on any role change that could turn you into the provider. Keep each vendor's compliance status with the system in your register and re-check at renewal.
Do we need to verify non-high-risk vendors too?
Lighter diligence applies. Confirm any Article 50 transparency obligations are handled and that the provider's GPAI position for the underlying model is sound, but there is no high-risk conformity package to verify for a minimal- or limited-risk system.
Related guides
- Article 26 deployer obligations
- AI value-chain roles
- Vendor assessment as deployer due diligence
- Article 25 value-chain roles
- The AI use case register
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →