AI vendor questionnaire: what to ask an AI tool supplier
Adopted 2026-06-28 · ≈ 1 min read · 
edited by Dirk Baaijen
A ready-to-use questionnaire to vet an AI tool supplier before purchase on role (provider/deployer), data and training, security, sub-processors, AI Act status and exit. Adopt the questions into your procurement or vendor assessment.
Short answer: Before you buy an AI tool, vet the supplier. The ready-to-use questionnaire below covers the points that matter legally and operationally. Adopt them into your procurement or vendor assessment and keep the answers on file.
Questionnaire — AI tool supplier [tool/supplier]
Role & AI Act
- Are you the provider of the AI system, and what is my role (deployer/provider)?
- Does the system fall under an AI Act risk category (prohibited/high-risk/GPAI/transparency)? Substantiate.
- Do you provide the documentation and instructions for use (art. 13) I need?
Data & training
- Which data does the tool process, and where (EU/EEA)?
- Do you use our input to train models? If so, can it be turned off?
- How long do you retain data and how is it deleted?
Privacy
- Is a data processing agreement (GDPR art. 28) available?
- Which sub-processors (model, cloud, tool parties) are involved?
Security
- Which security measures and certifications (e.g. ISO 27001) do you have?
- How do you handle prompt injection, misuse and data leaks; how do you report incidents?
Continuity & exit
- Which availability and support arrangements apply?
- What is the exit strategy: data export and switching on termination?
Keep the answers with your procurement file; repeat the check on major changes.
How to use it
Send the questionnaire before selection, weigh the answers in the choice, and link them to your AI use policy and — for agents — the AI agent governance checklist.
Lees ook: Data processing agreement (GDPR art. 28).
Sources
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2024/1689 (AI Act) — provider/deployer roles and GPAI information duties. - https://eur-lex.europa.eu/eli/reg/2016/679/oj
Regulation (EU) 2016/679 (GDPR) — processor, security and sub-processors.
Read next
Data processing agreement (GDPR art. 28): needed with an AI vendor?
If an AI vendor processes personal data on your behalf, Article 28 GDPR requires a written data processing agreement with fixed minimum content. This explainer sets out what it must contain and what to watch for with AI services.
Buying HR AI: the vendor due-diligence checklist for ATS software
Procuring HR AI or ATS software means inheriting AI Act obligations. This checklist gives the questions to ask the vendor before you sign — high-risk or not, CE marking, technical documentation, bias tests, logging — plus the contractual safeguards and the oversight that follows.
The AI Act for procurement: supplier requirements and contract clauses
Whoever procures AI often becomes a deployer under the AI Act and carries their own obligations. A supplier claiming to be "AI Act compliant" is no guarantee. This guide explains what to ask up front and which clauses belong in the contract.