Use case · Procurement and suppliers

Assess the supplier in the context of the AI system you intend to use.

A generic security questionnaire rarely establishes the intended purpose, regulatory role, model chain, limitations, oversight instructions and change commitments needed for AI governance. EU AI Fit connects the supplier response to the exact systems that rely on it and keeps the internal decision separate from supplier self-declaration.

Run the exposure check Discuss the use case

Product demonstration · 2 minutes 41 seconds

External AI assurance

See supplier questionnaires, buyer assurance, corrective actions and time-limited specialist review in a hypothetical workspace. All organisations, people and systems shown were created for demonstration, and no client data appears.

Read the video transcript

AI governance does not stop at the edge of the organisation. EU AI Fit connects suppliers to the systems and components that depend on them. A secure questionnaire lets a supplier respond without entering the client workspace, and the response remains pending until an authorised reviewer checks it.

The reviewer records available evidence, gaps, conditions, actions and a reassessment date. Buyer assurance has a different purpose: each answer is tied to a system, owner and evidence reference, then reviewed before a locked response pack is supplied.

Where additional judgement is needed, an independent specialist receives a frozen snapshot rather than unrestricted access. Credentials, independence, sources, decisions, limitations and attestation are retained. Material change makes the opinion visibly out of date instead of silently rewriting history.

Why this needs control

Questionnaire completion is not supplier approval.

The legal supplier, product, model, version and intended purpose can differ from what appears in a sales deck. The organisation also needs to understand downstream components, documentation availability, known limitations, incident support and what happens when the supplier changes the service.

The review should preserve missing evidence and contradictions, impose conditions where appropriate and create work for the internal owner. A completed questionnaire remains an input, not an automatic assurance score.

In this scenario

Elmbridge Claims Assistant

An operations team proposes a third-party AI service to summarise documents and recommend which claims need specialist attention.

  • The supplier answers a secure questionnaire without entering the client workspace.
  • Its classification answer does not address the client's configured recommendation use.
  • Performance evidence covers a different language and document set.
  • The service depends on a foundation-model provider and can change model versions.

The reviewer records the gaps, gives conditional approval for a limited pilot, assigns local validation and contracting actions, and fixes a reassessment trigger before broader use.

Every organisation, person and system in this scenario is hypothetical and contains no client data.

Practical workflow

From proposed use to a maintained decision.

  1. 01

    Define the relying use

    Record what the organisation will configure, who will use the output and what decision or process it may influence.

  2. 02

    Issue a scoped questionnaire

    Ask for role, value-chain, model, data, testing, limitations, transparency, oversight, incidents, security and change facts.

  3. 03

    Review evidence and gaps

    Distinguish supplied documents from assertions and record contradictions, missing evidence and questions requiring specialist input.

  4. 04

    Control the decision

    Approve, approve conditionally or decline through an authorised reviewer, then track actions and the reassessment date.

What the record should retain

Evidence follows the use case.

  • Supplier, product, model and value-chain facts
  • Secure questionnaire response and attachments
  • Evidence review and contradiction log
  • Approval decision, rationale and conditions
  • Corrective actions and accountable owners
  • Linked relying systems and reassessment triggers

Continue the review

Read the connected guidance.

Supplier assurance questionnaireSee the fact and evidence areas to cover.Read the guide Provider vs deployer rolesKeep value-chain roles system specific.Read the guide Deployer documentation packMaintain the internal record after procurement.Read the guide
Source basis: Regulation (EU) 2024/1689 . Practical information only; obtain qualified advice for your circumstances.

Next step

Start with the system and use you are actually proposing.

Run the initial exposure check, then retain the deeper assessment, responsibility and evidence work inside a controlled workspace.

Run the free check