AI Vendor Due Diligence Questionnaire for the EU AI Act

Before you buy an AI tool, you want one thing from the vendor: evidence that, if the system is high-risk, the provider has done the provider's homework. This questionnaire gives you that — a structured set of questions a deployer asks a provider before signing.

Frame it correctly from the start, because the framing changes what you are entitled to expect. This is deployer due diligence on a provider's package — not a statutory "vendor obligation" you are enforcing. The EU AI Act puts the conformity duties on the provider (Articles 16, 43, 47, 48, 49). As a deployer your own duties live in Article 26 — use the system per its instructions, ensure human oversight, monitor operation. The questionnaire is how you confirm, commercially and contractually, that the provider has met its duties before you take on the deployer ones. Asking these questions is good procurement; it is not you policing the law.

The first question filters everything else.

---

Question 0: Is the System High-Risk?

If the system is not high-risk, most of this questionnaire does not apply. A minimal-risk tool needs no CE mark, no Declaration of Conformity, no EU database entry. A limited-risk tool needs only the Article 50 transparency features. So the threshold question is whether the system falls in an Annex III category (or is a safety component of an Annex I product) and survives the Article 6(3) filter.

Ask the vendor to state, in writing, their Article 6 classification of the system and the reasoning. A provider who cannot tell you how they classified their own system is a flag in itself. If their answer is "high-risk," work through the rest of this questionnaire. If it is "not high-risk," get the reasoning, sanity-check it against your intended use (the same tool can be high-risk for one use and not another), and keep the analysis on file.

---

The Due Diligence Questionnaire (High-Risk Systems)

For a system the provider classifies as high-risk, ask for documented evidence on each point. The article references tell you what each artefact is and where it comes from.

A few practitioner notes on the entries:

• CE marking and the Declaration of Conformity (rows 1-2) are the headline artefacts. The CE mark (Article 48) is the visible claim; the Declaration of Conformity (Article 47, content set by Annex V) is the signed document behind it. Ask for both — the mark without the declaration is incomplete.
• The conformity-assessment route (row 3) tells you a lot. Most Annex III systems use Annex VI internal self-assessment; only biometrics (Annex III point 1) routes through a notified body under Annex VII. If a provider of a biometric system cannot name a notified body, dig further.
• EU database registration (row 5) is the provider's duty under Article 49; you can often verify it yourself once the database is populated.
• The authorised representative (row 6) matters most when you buy from outside the EU — under Article 22 a non-EU provider of a high-risk system must appoint one, and that representative is your and the authorities' anchor.
• Article 25(2) cooperation (row 8) is worth writing into the contract, not just the questionnaire — it converts a statutory expectation into a commitment you can rely on.

---

What This Questionnaire Does Not Make You

Filling this in does not turn you into the provider, and it does not transfer the provider's duties onto you. You remain a deployer, with Article 26 duties. The exception to watch: if you substantially modify the high-risk system, or put it on the market under your own name or trademark, Article 25 can flip you into the provider role for that system — at which point the questionnaire stops being diligence-on-someone-else and becomes a list of things you now owe. Fine-tuning a vendor model on your own data is the classic trigger. If you plan to customise heavily, flag it in procurement and reassess your role.

---

Worked Example: An SME Procuring a High-Risk Tool

Take Banca Lagune S.p.A., a fictional Italian regional lender — about 200 employees, ~€40 million turnover — procuring an AI credit-scoring tool from a US-based vendor. Credit scoring of natural persons is squarely in Annex III, so this is high-risk, and Banca Lagune is the deployer.

Working the questionnaire:

• Q0 / Article 6: the vendor confirms high-risk classification — correct, and it matches Banca Lagune's intended use (scoring loan applicants).
• Rows 1-4: the vendor produces a CE mark, an Annex V Declaration of Conformity, confirmation of an Annex VI internal conformity assessment, and an Annex IV technical-documentation summary.
• Row 5: the vendor confirms Article 49 EU database registration — Banca Lagune notes it will verify this independently.
• Row 6: because the vendor is US-based, Banca Lagune asks for the Article 22 EU authorised representative — and gets a named entity in Ireland. Good.
• Rows 7-9: instructions for use arrive (feeding Banca Lagune's own Article 26 oversight setup), an Article 25(2) cooperation clause goes into the contract, and the Article 73 serious-incident channel is documented.
• Article 25 check: Banca Lagune will run the tool as supplied, not fine-tune it, so it stays a deployer. Good — if it had retrained the model on its own portfolio, it might have crossed into provider territory.

The result: Banca Lagune has documented, before signing, that the provider met its duties, has the instructions it needs for its own deployer obligations, and has a contractual cooperation commitment. Its remaining job is the Article 26 deployer work — human oversight of the scoring decisions and, because credit scoring is an Annex III(5)(b) use, an Article 27 FRIA.

---

How Confir Helps

Confir's classification engine is rule-based and deterministic, so it first settles Question 0 reproducibly — is this system high-risk for your intended use? — and tells you which rule fired. For high-risk procurements it structures the vendor-evidence trail (CE mark, Declaration of Conformity, conformity route, registration, authorised representative, instructions for use) alongside your own Article 26 deployer record and any Article 27 FRIA, keeping the procurement diligence and the deployment obligations in one org-wide register.

---

Related guides

• deployer obligations under Article 26
• the AI vendor questionnaire template
• AI vendor risk assessment
• AI due-diligence checklist
• CE marking explained
• EU database registration
• authorised representatives
• provider vs deployer roles