Platform / Supplier assurance
Understand the AI behind the service you buy.
Buying AI does not remove responsibility for how it is selected, configured and used. Teams need a proportionate way to ask suppliers for the facts and evidence their own governance depends on.
Product demonstration · 2 minutes 41 seconds
External AI assurance
See supplier questionnaires, buyer assurance, corrective actions and time-limited specialist review in a hypothetical workspace. All organisations, people and systems shown were created for demonstration, and no client data appears.
Read the video transcript
AI governance does not stop at the edge of the organisation. EU AI Fit connects suppliers to the systems and components that depend on them. A secure questionnaire lets a supplier respond without entering the client workspace, and the response remains pending until an authorised reviewer checks it.
The reviewer records available evidence, gaps, conditions, actions and a reassessment date. Buyer assurance has a different purpose: each answer is tied to a system, owner and evidence reference, then reviewed before a locked response pack is supplied.
Where additional judgement is needed, an independent specialist receives a frozen snapshot rather than unrestricted access. Credentials, independence, sources, decisions, limitations and attestation are retained. Material change makes the opinion visibly out of date instead of silently rewriting history.
Why this matters
A vendor questionnaire becomes obsolete as soon as the product changes.
AI suppliers, products, models and sub-processors change at different speeds. An answer stored only in email is difficult to connect to the systems that rely on it or to revisit when the supplier announces a material update.
EU AI Fit keeps the supplier response, evidence and reviewer decision linked to affected systems, including conditional approval and follow-up actions.
Who it is for
The teams responsible for selecting, operating and challenging third-party AI.
- Procurement and supplier-management teams
- System owners relying on third-party AI
- Security, privacy and compliance reviewers
- Suppliers responding without needing a workspace account
How the work moves
Connect supplier facts to a controlled use decision.
- 01
Map the dependency
Connect the supplier, product, model/version and relevant sub-services to every affected AI system.
- 02
Request the right facts
Issue a secure, time-limited questionnaire scoped to the use and evidence required.
- 03
Review the response
Evaluate answers and supporting material, record limitations and open targeted remediation.
- 04
Approve with control
Approve, approve conditionally or decline, then set a review date and material-change triggers.
In this scenario
A supplier changes the foundation model behind a customer feature
The commercial product name stays the same while the underlying model and data-handling terms change.
The product and model are separately linked, so the change can trigger reassessment for each relying system.
The supplier is asked only for the new facts and evidence. Existing accepted material remains in the history rather than being overwritten.
The team can explain the basis and conditions of continued use without restarting an unrelated generic questionnaire.
What is retained
A supplier decision with conditions that can be revisited.
The supplier-assurance workflow connects each answer and condition to the systems that depend on it.
- Supplier, product and model register
- Dated questions, responses and evidence
- Reviewer findings and limitations
- Approval or conditional-approval decision
- Remediation actions and reassessment triggers
Source basis
The official material behind the workflow.
Source review updated 31 August 2026. Read our editorial and regulatory review policy, check the current source and obtain qualified advice for your circumstances.
- Regulation (EU) 2024/1689
The official consolidated legal text, including the 2026 amendments, and starting point for every assessment.
- Article 25 — AI value chain
Responsibilities and cooperation along the AI value chain.
- Article 13 — information for deployers
Transparency and instructions required for high-risk AI systems.
Next step
Connect vendor assurance to the systems that rely on it.
Replace a static questionnaire archive with controlled decisions, conditions and reassessment.
Discuss supplier assurance