EU AI Act: 12 questions to ask an AI vendor before you deploy their tool
Short answer: most small businesses using AI are deployers under the EU AI Act, not providers. Your safest first step is to ask each AI vendor the same short set of questions, keep the written answers, and note which tools touch hiring, credit, customers or public content, because those carry more duties.
Why ask vendors at all
The EU AI Act splits duties between providers (who build and place an AI system on the market) and deployers (who use it in their business). Deployers of high-risk systems must use them according to the provider's instructions, assign human oversight and keep the logs they control. You cannot do any of that without information from the vendor. Read the official text before you rely on a paraphrase: Regulation (EU) 2024/1689 on EUR-Lex.
The 12 questions, and what a good answer looks like
| Question to the vendor | What a good answer looks like |
|---|---|
| 1. What exactly does the AI do in your product, and which model or models power it? | A named model family or provider and a short description of the AI features, not just 'proprietary AI'. |
| 2. Do you consider yourselves the provider of this AI system under the EU AI Act? | A clear yes or no. If they built and sell it under their name, they are usually the provider; you are usually the deployer. |
| 3. Which risk category do you place the system in, and why? | A stated category with reasons. Tools used for hiring, credit, education or access to essential services deserve extra care, because Annex III lists those areas. |
| 4. If it is high-risk, can you share the instructions for use? | Providers of high-risk systems must supply instructions for use; ask for them in writing. |
| 5. Does the tool talk to people or generate images, audio, video or text that could be taken as real? | If yes, ask how it supports the Article 50 transparency notices and labels you may need to show. |
| 6. Is a general-purpose AI model underneath, and does its provider publish technical documentation and a training-data summary? | A link or named document. General-purpose AI model duties under the Act have applied since 2 August 2025. |
| 7. What data do you send to the model, where is it processed, and is it used for training? | Regions, sub-processors and a clear training opt-out. This is a GDPR question as much as an AI Act one. |
| 8. What logs can we get, and for how long are they kept? | Exportable logs with a stated retention period, so you can explain a decision later. |
| 9. How can a human review, override or switch off the AI output? | A described human-oversight control, not just 'contact support'. |
| 10. How do you test accuracy and bias, and how often? | A testing approach and date of last review. Treat marketing figures without method as unverified. |
| 11. How will you tell us about model changes, incidents or serious errors? | A notice channel and timeframe written into the contract or terms. |
| 12. Can we get this in writing in our contract or a signed questionnaire? | Yes. Verbal answers are hard to rely on later. |
How to run this in an afternoon
- List every AI tool your team uses, including free ones and AI features switched on inside existing software.
- Send each vendor the 12 questions by email or through their trust or security page.
- Save each reply with the date and who answered.
- Flag tools used for hiring, staff monitoring, credit, education or public-facing content for a closer look.
- Set a reminder to re-ask when the vendor announces a new model or major feature.
Where to keep the answers
A shared folder and a spreadsheet are enough. If you want each AI system, its vendor answers, risk notes and evidence dates in one place, the EURO AI Register free edition runs in the browser with no account and no upload (up to 3 AI systems and 10 evidence records). A paid membership removes the limits; you do not need it to use this checklist.
This guide is general information, not legal advice. A questionnaire or register is a record-keeping aid, not proof of compliance. Unadhi is not affiliated with the EU or any EU authority.
Related: what to put in an AI inventory · Article 50 disclosure checklist · AI literacy (Article 4)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.