Third-party AI
EU AI Act supplier assurance questionnaire
A useful supplier questionnaire asks for facts and evidence relevant to the system your organisation will actually use. It should not reward long generic answers or treat supplier self-declaration as verification.
Prepared by EU AI Fit editorial team · Published 24 August 2026 · Source review 31 August 2026 · Page updated 26 September 2026
Download the AI supplier questionnaire
Send 12 scoped questions to your supplier, then record the responses, evidence, reviewer findings and follow-up actions. Includes a request scope and an internal decision record.
No email or account required. Adapt the template to your organisation and review it before use. It is a working aid, not an official form or proof of compliance.
Discuss a readiness sprintProduct, role and value chain
Identify the legal supplier, product, model and version; who places the system on the market; intended purpose; contractual responsibilities; downstream information; and any authorised representative or distributor relationship.
Risk, data and technical controls
Ask for the supplier's classification rationale, prohibited-practice screening, data-governance approach, testing, known limitations, accuracy claims, cybersecurity controls, logging and human-oversight instructions.
- Evidence supporting performance claims
- Known failure modes and affected groups
- Personal-data and retention facts
- Security and incident processes
- Technical documentation available to the customer
Transparency, support and change
Establish required disclosures, content marking, customer instructions, complaint routes, monitoring support, incident notification, subcontractors and how model or product changes will be communicated.
Review the response, not just completion
Record missing evidence, contradictions, conditions of use, corrective actions and a reassessment date. Approve, approve conditionally or decline through an authorised reviewer, keeping the response connected to every relying AI system.
Send a scoped request, not a vendor-wide certificate request
Name the service, version, integration and intended use in the covering request. Ask the supplier to distinguish evidence they can share, evidence available under confidentiality and assertions that cannot be verified. Give them a route to explain a genuine limitation. A missing answer stays open; it is not a pass or a reason to fabricate assurance.
In this scenario: a supplier changes the model behind a support assistant
Ashford Services plans to use Larch Assist to draft replies, with staff approving each message. The supplier supplies a generic security certificate but no evaluation of the proposed language or customer group. Procurement records the security document separately from the unanswered performance question. The technical owner requests representative test results and an agreed change-notice route before the reviewer decides whether a bounded pilot is acceptable.
- Restrict the pilot to reviewed drafts; do not infer permission for automatic sending.
- Record the missing test, its owner and the consequence if it is not supplied.
- Reopen the decision if the supplier changes the model or the organisation changes the purpose.
AI supplier questionnaire — questions to send and review
Download the working CSV and complete the response, evidence, reviewer and action columns. These are suggested procurement questions, not a claim that every supplier has identical legal duties. Tailor them to the agreed use and applicable operator roles.
Download editable worksheet (CSV)No email or account required. Includes response, evidence, owner, review and follow-up columns for your team. This is a working aid, not an official form or proof of compliance.
On smaller screens, scroll the table horizontally or download the worksheet.
| Question to supplier | Evidence to request | Review prompt |
|---|---|---|
| Which legal entity supplies this product, and which system/model versions are included? | Contract schedule, product description, version identifier | Does this match the purchased service and integration? |
| What intended purposes and uses are supported or excluded? | Instructions and limitations for this version | Is our proposed use inside the supported boundary? |
| What operator roles do you and other parties hold for this system? | Value-chain diagram and reasoned role statement | Does the contractual label match the actual responsibilities? |
| What classification has been assessed and what facts support it? | Dated rationale, scope, sources and unresolved assumptions | Is the assessment for our use, or only the base model? |
| How was performance evaluated for our users, languages and operating conditions? | Test method, sample coverage, results and known failures | What remains untested, and who will test it? |
| What data is received, retained or reused, and by which subprocessors? | Data-flow map, retention settings and contractual controls | Refer personal-data questions to the privacy lead; do not assume AI assurance replaces privacy review. |
| How can an operator verify, override, stop or escalate an output? | Operating instructions and demonstration of controls | Can our staff actually use the controls within the workflow? |
| What logs and audit information can the customer access? | Log schema, access arrangements and retention options | Can we reconstruct a disputed output without unnecessary personal data? |
| How are security weaknesses and incidents reported to customers? | Notification process, contacts, support terms and test evidence | Are escalation routes usable outside normal hours? |
| How are material model or feature changes communicated? | Change notice, release notes and version policy | Can we reassess before relying on changed behaviour? |
| Which disclosure or content-marking functions are provided? | Interface examples and technical documentation | Separate the supplier's functions from disclosures we must implement. |
| What happens when the contract ends or the service is withdrawn? | Export, deletion and transition arrangements | Can the organisation retain necessary governance records and stop safely? |
Recommended next step
Tailor the questionnaire to one real system and decision, then retain the supplier response, reviewer findings, conditions and reassessment trigger together.
Run the free exposure checkRelated practical guides
Put the guidance into practice