EU AI Act Vendor Questionnaire for Buyers and Sellers

Why questionnaires replaced “trust us”

Enterprise buyers no longer accept a homepage badge. They send vendor questionnaires covering role under the AI Act, high-risk signals, transparency, oversight, subprocessors, and documentation.

If you buy AI SaaS: use this as a diligence baseline.
If you sell AI SaaS: prepare answers before the RFP lands — empty cells kill deals.

Questionnaire (copy into your RFP)

A. Identity & role

1. Legal entity name and country of establishment
2. Are you a provider, deployer, both, or GPAI provider for the offered system?
3. Do you place the system on the EU market or is output used in the EU?

B. System description

4. Intended purpose (one paragraph)
5. List of AI features in scope of this contract
6. Output nature: determines / ranks / preparatory / assistive
7. Does the system materially influence decisions about people?
8. Does it profile natural persons?

C. Classification hypothesis

9. Annex III category candidates (if any)
10. Art. 6(3) facts you rely on (if claiming not high-risk)
11. Effective dates you are planning to: Art. 50 2 August 2026; Annex III 2 December 2027

D. Transparency (Art. 50)

12. How are users informed they interact with AI?
13. How is AI-generated content labelled (if applicable)?
14. Link or screenshot of in-product disclosure

E. Human oversight & logging

15. Describe human review / override path
16. What is logged (input ref, model version, output, human decision)?
17. Is logging treated as legal (high-risk) or recommended practice?

F. Models & subprocessors

18. Model providers and versions
19. Personal data sent to each vendor
20. DPA / training opt-out / region of processing
21. Subprocessor list and change notice process

G. Documentation pack

22. System card available? (Y/N + attach)
23. Human oversight SOP available?
24. Vendor inventory available?
25. Open legal questions remaining?

H. Incidents & changes

26. Material change notification SLA
27. Incident contact and last review date

How sellers should answer without overclaiming

• Prefer “hypothesis pending legal confirmation” over “we are compliant”
• Attach artefacts, do not invent classifications
• Separate legal requirements from readiness practice
• Point buyers to dated obligations (Omnibus: Council 29 June 2026)

Ready artefacts

• AI vendor inventory template
• AI system card template
• Due diligence checklist for enterprise buyers
• Documentation requirements for SaaS providers

Close the gaps before the RFP

Get a free readiness brief for your product — then answer the questionnaire with sources, confidence, and missing facts instead of marketing language.

Not legal advice. Questionnaire answers are diligence inputs; classification remains fact- and counsel-specific.