AI procurement — 12 questions to ask every vendor
You buy AI, you carry deployer obligations. Ask these twelve questions before you sign — the answers tell you whether the vendor can actually support your compliance.
1. What is the system's intended purpose — exactly?
The intended purpose drives classification. Vague purposes ('assists HR') are a red flag; precise ones ('screens applicants and recommends shortlists for human review') let you classify honestly.
2. Have you classified it under Article 6?
Ask for the classification record and the Annex I / Annex III reasoning. A vendor that hasn't done this is behind before you start.
3. Can we see the technical documentation?
Article 11 documentation should exist before market placement. If a vendor can't show it, they're not ready for the EU market.
4. What does your risk management file cover?
Hazards, mitigations, testing, residual risk. Ask for the summary and the testing evidence behind any accuracy claims.
5. How is training data governed?
Data provenance, representativeness analysis, bias detection and correction. For hiring or credit models, this is where the real risk lives.
6. What performance metrics do you declare — and by subgroup?
Overall accuracy hides demographic failures. Ask for subgroup breakdowns and the methodology behind the metrics.
7. Does the system log automatically?
Logging must be built in (Art. 12), with six-month retention. Ask who operates the logs and how you access them in an investigation.
8. What human oversight measures are included?
Can your people interpret output, override decisions, and stop the system? Ask for the oversight playbook, not just the checkbox.
9. Do you provide instructions for use in our language?
Article 13 requires instructions in the official languages where the system is used. Confirm your languages are covered before signing.
10. What happens if we materially modify the system?
Material modification can make you the provider (Art. 26(9)). Ask the vendor to define what counts as modification and to keep the documentation current for your deployment.
11. Do you support our FRIA and transparency duties?
Deployers in scope must run a FRIA and inform workers. Ask for the information pack that makes that possible.
12. What are your post-market and incident processes?
Who watches for drift and incidents? How do serious incidents get reported? Your post-market obligations depend on their answers.
Go deeper
Related guides & tools
See where your AI actually lands
Describe your system in the free Risk Scanner for a preliminary classification and the obligations that likely apply.
Open the Risk ScannerPreliminary EU AI Act clarity summary. Not legal advice.