AI Vendor Questionnaire Template: EU AI Act Due Diligence for Deployers

Before you sign a contract with an AI system vendor, the EU AI Act creates clear expectations for you as a deployer. Under Article 26, you must use the system only within its intended purpose and verify that the provider has met their obligations. For high-risk AI systems under Annex III, the provider's Annex IV technical documentation is your primary compliance evidence. A standard IT security questionnaire will not get you any of that.

This template organises the questions a deployer should ask across eight themes that map to the Act's obligations on providers. For high-risk AI systems, send the full template and request documentary evidence — not attestations. For minimal- or limited-risk tools, Sections 1, 2, and 4 are usually sufficient.

One framing note: this is deployer due diligence, not a list of statutory "vendor obligations." The Act imposes obligations on providers (Article 16), deployers (Article 26), importers (Article 23), and distributors (Article 24) — "vendor" is not a legal category. When you send these questions, you are exercising your right, and your responsibility, to verify that the provider has done what the law requires.

The compliance deadline for stand-alone high-risk Annex III systems is 2 December 2027, extended from the original August 2026 date under the Digital Omnibus political agreement of May 2026. High-risk AI embedded in regulated Annex I products applies from 2 August 2028. Non-compliance with provider and deployer obligations carries a maximum fine of €15,000,000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)).

---

1. Classification and Role — Is the System High-Risk?

Under Article 6, a system is high-risk if it falls within one of the eight Annex III use-case areas and the Article 6(3) exemption does not apply. That exemption removes high-risk status only where the system performs a narrow procedural task, improves a previously completed human activity, detects patterns without influencing human assessment, or does preparatory work — and it never applies to a system that profiles natural persons.

The Article 25 trap. If your organisation puts its own name on a high-risk AI system, substantially modifies it, or changes its intended purpose, Article 25 reclassifies you from deployer to provider — and the full Article 16 obligations become yours: conformity assessment, Annex IV documentation, CE marking, EU database registration. Contracts should require the vendor to notify you before any change that could trigger this shift.

---

2. Conformity Evidence — Has the Provider Proved Compliance?

For most Annex III systems, conformity assessment follows the internal self-assessment route under Annex VI. For Annex III point 1 systems (biometrics), the Annex VII notified-body route generally applies where harmonised standards have not been used. Once assessed, the provider issues an EU Declaration of Conformity (Article 47), affixes CE marking (Article 48), and registers the system in the EU database under Article 49 (the database established under Article 71).

---

3. Technical Documentation and Transparency

Article 11 requires providers of high-risk AI to maintain an Annex IV technical documentation file covering nine areas: general system description; design logic; training, validation, and test data information; performance metrics and limitations; monitoring arrangements; the Article 9 risk management system; lifecycle changes; standards applied; and the Declaration of Conformity. Article 13 entitles deployers to information sufficient for meaningful use. Without access to at least a summary of that file, a deployer cannot verify compliance.

---

4. Data Governance (Article 10) and GDPR

Article 10 requires that training, validation, and testing datasets are governed by appropriate data governance practices: relevance, representativeness, and freedom from error where feasible. The GDPR runs in parallel: a DPIA under GDPR Article 35 is triggered where processing is likely to result in a high risk to natural persons, and GDPR Article 22 governs automated individual decisions with significant effects.

---

5. Human Oversight Design (Article 14)

Article 14 is a provider obligation — oversight measures must be built into the system before it reaches the deployer. If the system's architecture does not support meaningful intervention, the deployer's Article 26 duty to implement those measures becomes impossible to discharge.

---

6. Logging (Articles 12 and 19), Incident Handling (Article 73), and Post-Market Monitoring (Article 72)

Article 12 requires high-risk AI systems to generate logs automatically. Article 19 requires providers to retain the logs they control for at least six months. Article 73 requires serious incidents to be reported to the national market surveillance authority — within 15 days of awareness under Article 73(2), 2 days for critical-infrastructure disruption or widespread infringement (73(3)), or 10 days where a death has occurred (73(4)). Article 72 governs the provider's ongoing post-market monitoring. These are provider obligations, but deployers need to understand them: contractual and regulatory exposure can run both ways when a provider fails to report.

---

7. GPAI — Downstream Documentation (Articles 53 and 55, Annex XII)

GPAI model obligations under Article 53 have applied since 2 August 2025. Article 53 requires all GPAI providers to produce technical documentation and supply downstream deployers — via an Annex XII technical summary — with information sufficient to understand the model's capabilities, limitations, and terms of use. For systemic-risk GPAI models (Article 51's rebuttable presumption applies at 10²⁵ FLOP training compute), additional safeguards under Article 55 apply.

---

8. Post-Market Monitoring, Updates, and Ongoing Commitment

Compliance at launch does not mean compliance at renewal. AI systems change; datasets drift. The deployer needs contractual certainty that the provider will maintain compliance and will give notice when something material changes.

---

Scoring and Evaluation

Weight responses by risk tier. For high-risk AI systems, a questionnaire answer is the opening step in due diligence — documentary evidence must be reviewed.

Disqualifiers for high-risk AI deployment:

• System classified as prohibited under Article 5
• No conformity assessment completed
• Provider cannot produce any Annex IV technical documentation
• No human oversight mechanism built into the system
• Serious incidents have occurred without regulatory notification under Article 73

Red flags requiring follow-up:

• Classification analysis absent or superficial — "we don't think it's high-risk" without Annex III analysis
• Technical documentation exists in principle but unavailable for deployer review
• Human oversight exists on paper but the system architecture does not support meaningful intervention
• No DPIA under GDPR Article 35 for a system processing personal data at scale
• Vendor cannot identify the GPAI model provider or confirm whether an Annex XII summary exists

Strong positive indicators:

• Technical documentation proactively shared without being pressed
• Notified Body conformity assessment (Annex VII) for biometric systems
• Disaggregated performance metrics available without being asked
• ISO/IEC 42001 certification in place or formally in progress
• Named AI compliance contact who speaks to specific Article references, not just general policy

---

How Confir Helps

Confir's rule-based engine records vendor responses against specific obligations — classification under Articles 5 and 6, conformity evidence under Articles 43, 47, 48, and 49, transparency under Article 13, human oversight under Article 14. The same intake always produces the same finding: deterministic, reproducible, explainable. Where responses point to a gap, Confir flags it against the relevant Article so your team knows what to escalate. Vendor assessments feed into your organisation-wide AI register under the AIGM governance module (Articles 9, 72, 73). Pricing starts at €600/year.

---

Frequently Asked Questions

Is sending this questionnaire sufficient for EU AI Act deployer compliance?

No. Article 26 requires deployers to verify that providers have conducted an appropriate conformity assessment — not merely to collect attestations. For high-risk AI systems, you should review the actual Annex IV technical documentation, not just a questionnaire answer that claims it exists. A vendor's "yes, we're compliant" carries no evidential weight without the documentation behind it. Treat questionnaire responses as the opening step in due diligence, not the conclusion.

How often should we re-send this questionnaire to existing AI vendors?

At minimum annually, and whenever a vendor announces a significant model update, a retraining cycle, a change to the system's intended purpose, or an incident. Article 26 requires deployers to use AI systems in accordance with the provider's instructions — and those instructions change when systems change. This is an ongoing obligation, not a one-time onboarding exercise.

What if a vendor refuses to answer questions about technical documentation?

For high-risk AI systems, refusal to provide or summarise Annex IV technical documentation is a compliance failure on the vendor's part. Article 13 requires providers to supply deployers with information sufficient to understand the system's capabilities, limitations, and oversight requirements. A vendor who cannot produce that material is in breach of their transparency obligations. For minimal- or limited-risk systems, incomplete responses may be proportionate depending on the use case.

Does the Article 25 role-shift risk affect how we should structure vendor contracts?

It should. If your organisation puts its own name on an AI system, substantially modifies it (as defined in Article 3(23)), or changes its intended purpose in a material way, Article 25 reclassifies you from deployer to provider — triggering the full Article 16 obligation stack: conformity assessment, Annex IV documentation, CE marking, EU database registration. Contracts should require the vendor to notify you before any change that could trigger this shift and confirm that the vendor carries Article 16 obligations for the system as supplied.

Should this questionnaire go to SaaS vendors whose products include AI features?

Yes, where the AI feature performs a function that qualifies as high-risk under Annex III — regardless of how peripheral it is to the broader product. A recruitment module with automated CV screening is Annex III point 4(a) whether it is a standalone product or embedded in an HRIS. The deployer's Article 26 obligation applies to the AI feature regardless of how it is packaged. If the vendor cannot tell you whether their AI feature has been classified, that is itself a significant finding.

What is the penalty exposure if a deployer relies on a non-compliant vendor?

The deployer's own exposure under Article 26 is separate from the provider's under Article 16. Using a high-risk AI system without verifying the provider's conformity assessment is a breach of Article 26 — carrying a maximum fine of €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). The vendor's non-compliance does not insulate the deployer. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage — but compliance remains mandatory.

---

Related guides

• EU AI Act deployer compliance checklist
• open source AI exemptions
• importer and distributor duties
• deployer obligations framework
• AI policy template
• Article 13 transparency requirements