AI Vendor Due Diligence Questionnaire: What to Ask

In this article

1. What Is an AI Vendor Due Diligence Questionnaire?
2. Why Is AI Vendor Due Diligence Important Under the EU AI Act?
3. AI Vendor Due Diligence Questionnaire: 35 Questions to Ask
4. 1. AI System and Vendor Background
5. 2. EU AI Act Compliance and Risk Classification
6. 3. Data Protection and GDPR Responsibilities
7. 4. AI Model Security and Technical Controls
8. 5. Training Data, Model Transparency and Human Oversight
9. 6. Incident Management and Continuous Monitoring
10. 7. Contracts, Documentation and Supplier Governance
11. How Should Organisations Evaluate AI Vendor Questionnaire Responses?
12. How Can AI Compliance Software Simplify Vendor Due Diligence?
13. Build a Structured AI Vendor Risk Management Process With AnnexOps
14. Author: Nitin Grover

AI vendors are becoming an essential part of modern business operations. Organisations use external AI models, APIs, automated decision-making tools and AI-powered SaaS applications to improve productivity and develop new services. However, every AI integration introduces questions about regulatory responsibilities, data protection, security and operational risks.

Choosing an AI supplier therefore requires more than comparing features, pricing and technical capabilities. Organisations need to understand how a vendor develops, deploys, maintains and monitors its AI systems.

An AI vendor due diligence questionnaire provides a structured way to collect this information before entering into a supplier relationship. It helps procurement, legal, IT security and compliance teams evaluate whether an AI vendor’s practices align with their operational and regulatory requirements.

In Europe, this assessment should consider Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, and Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), where applicable.

This guide explains what an AI vendor due diligence questionnaire should include, which questions organisations should ask, and how to maintain vendor compliance evidence throughout the supplier relationship.

What Is an AI Vendor Due Diligence Questionnaire?

An AI vendor due diligence questionnaire is a structured assessment used to evaluate an external AI provider before purchasing, integrating or relying on its technology.

It collects information about the vendor’s:

• AI systems, models and intended purposes.
• Regulatory roles and compliance responsibilities.
• Training data and data processing practices.
• Information security measures.
• AI risk management and human oversight.
• Technical documentation and monitoring.
• Incident management and contractual commitments.

Unlike a general supplier questionnaire, an AI-specific assessment examines risks associated with AI development and deployment.

For example, an organisation purchasing an AI recruitment tool needs to understand its intended purpose, potential high-risk classification, human oversight arrangements and data processing activities.

The questionnaire should reflect the actual AI use case rather than treating every AI supplier as having identical regulatory obligations.

Why Is AI Vendor Due Diligence Important Under the EU AI Act?

The EU AI Act establishes obligations for different actors across the AI value chain. These responsibilities depend on an organisation’s role, the AI system involved and its intended use.

Under Article 3, a provider develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority in a professional activity.

Article 25 also identifies circumstances in which a distributor, importer, deployer or other third party may be considered a provider of a high-risk AI system.

This means purchasing an external AI solution does not automatically remove the customer’s regulatory responsibilities.

An effective AI vendor risk assessment helps organisations:

• Identify their roles in the AI value chain.
• Understand whether an AI system falls within a regulated category.
• Obtain relevant technical documentation.
• Assess data protection and cybersecurity risks.
• Establish contractual responsibilities.
• Maintain evidence for ongoing governance.

The regulatory timeline also matters. Prohibited AI practices and AI literacy obligations have applied since 2 February 2025. General-purpose AI model obligations have applied since 2 August 2025. The amended application dates for high-risk AI systems are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.

Organisations should prepare their vendor governance processes according to the obligations applicable to their activities.

AI Vendor Due Diligence Questionnaire: 35 Questions to Ask

A comprehensive AI supplier assessment checklist should cover seven important areas.

1. AI System and Vendor Background

Start by understanding what the vendor provides and how its AI technology is used.

Ask these questions:

1. What AI systems, models or AI-powered services does your organisation provide?
2. What is the intended purpose of each AI system?
3. Are you the original provider, distributor, importer or reseller of the AI solution?
4. Do you integrate third-party general-purpose AI models or external APIs?
5. Can you identify the organisations involved in developing and supplying the AI system?

Why these questions matter: Understanding the AI supply chain helps organisations identify dependencies and determine which regulatory roles may apply. It also establishes whether additional information must be obtained from upstream suppliers.

2. EU AI Act Compliance and Risk Classification

The next step is to understand how the vendor approaches AI regulatory requirements.

6. Has the AI system been assessed under Regulation (EU) 2024/1689?
7. What is the system’s intended purpose, and has its potential high-risk classification been assessed?
8. Does the system involve any practices prohibited under Article 5?
9. If the system qualifies as high-risk, how do you address applicable requirements concerning risk management, data governance and human oversight?
10. What documentation can you provide to demonstrate your assessment and applicable compliance measures?

Why these questions matter: Article 9 addresses risk management for high-risk AI systems, while Articles 10–15 cover data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity.

A vendor’s general statement that its product is EU AI Act compliant is not sufficient evidence of how the relevant requirements apply to a particular deployment.

3. Data Protection and GDPR Responsibilities

AI vendors may process personal data when providing model hosting, analytics, customer support or automated services.

The questionnaire should establish the vendor’s data protection responsibilities.

11. What categories of personal data does the AI system collect or process?
12. For what purposes is personal data processed?
13. Does the vendor act as a data processor, independent controller or another relevant party?
14. Is a Data Processing Agreement (DPA) available where processing is carried out on behalf of the customer?
15. Are personal data transferred outside the European Economic Area, and what transfer mechanism is relied upon where required?

Why these questions matter: GDPR Article 28 requires controllers to use processors providing sufficient guarantees of appropriate technical and organisational measures. It also establishes requirements for processor contracts and the engagement of subprocessors.

Articles 32 and 35 address security of processing and Data Protection Impact Assessments (DPIAs), respectively.

A vendor questionnaire should therefore examine data processing arrangements, security safeguards and whether the organisation needs to conduct a DPIA.

4. AI Model Security and Technical Controls

An AI vendor’s security assessment should examine how the system is protected throughout its lifecycle.

16. What technical and organisational security measures protect the AI system?
17. Is sensitive information encrypted during transmission and storage?
18. How are user permissions, authentication and administrative access managed?
19. How do you protect AI systems against unauthorised access, data leakage and manipulation?
20. How frequently are security controls tested and reviewed?

Why these questions matter: GDPR Article 32 requires appropriate technical and organisational measures based on risk. For high-risk AI systems, Article 15 also establishes requirements concerning accuracy, robustness and cybersecurity.

Organisations should request supporting evidence rather than relying exclusively on vendor statements.

5. Training Data, Model Transparency and Human Oversight

Understanding how an AI system operates is important when evaluating its suitability for business use.

21. What information can you provide about the data used to train or develop the AI system?
22. How do you evaluate data quality, relevance and potential bias?
23. Can users understand the system’s capabilities, limitations and intended purpose?
24. What human oversight mechanisms are available?
25. How do you communicate material changes to the model, its functionality or its intended use?

Why these questions matter: Articles 10, 13 and 14 of the EU AI Act establish relevant requirements for high-risk AI systems concerning data governance, transparency and human oversight.

For general-purpose AI models, Article 53 also establishes specific provider obligations, including technical documentation and information for downstream providers.

A vendor assessment should identify what information is available and whether it is sufficient for the customer’s intended deployment.

6. Incident Management and Continuous Monitoring

Vendor due diligence should continue after procurement. AI systems can change through model updates, new integrations, changes in training data or modifications to their intended purpose.

Ask:

26. Do you maintain a documented incident management process?
27. How are customers informed about security incidents and AI-related failures?
28. Do you monitor system performance, accuracy and relevant operational risks?
29. How are significant model updates and system modifications communicated?
30. What procedures are available for reporting, investigating and resolving identified issues?

Why these questions matter: For high-risk AI systems, Articles 72 and 73 address post-market monitoring and reporting of serious incidents and malfunctions.

Contractual notification periods and operational escalation arrangements should also be established according to applicable legal requirements and the organisation’s risk exposure.

7. Contracts, Documentation and Supplier Governance

The final section examines whether the vendor can support an accountable and sustainable supplier relationship.

31. Can you provide relevant technical documentation and instructions for use?
32. Are responsibilities for AI governance, security and data protection defined in the contract?
33. Do you maintain an updated list of subprocessors and relevant external AI service providers?
34. What support do you provide for customer audits, regulatory enquiries and compliance assessments?
35. What happens to customer data when the contract ends, and how is data deletion or return handled?

Why these questions matter: GDPR Article 28 establishes specific processor-contract requirements where applicable. Article 25(4) of the EU AI Act also addresses written agreements and cooperation between certain parties in the high-risk AI system value chain.

Organisations should document relevant responsibilities, access to information, cooperation arrangements and exit procedures.

How Should Organisations Evaluate AI Vendor Questionnaire Responses?

Collecting answers is only the first stage of AI vendor due diligence. Organisations must assess the quality of the responses and determine whether the vendor presents an acceptable level of risk.

A practical assessment process includes:

1. Verify supporting evidence: Request relevant policies, technical documentation, security assessments, data processing agreements and other supporting records.

2. Identify unanswered questions: Mark missing, unclear or unsupported responses for further investigation.

3. Assess regulatory relevance: Determine which EU AI Act and GDPR provisions apply to the specific supplier relationship.

4. Assign risk priorities: Evaluate the potential impact of security failures, inappropriate data processing, regulatory exposure and service disruption.

5. Record approval decisions: Document findings, outstanding actions, responsible owners and approval status.

6. Schedule reassessments: Review the supplier when significant changes occur and at intervals appropriate to the assessed risk.

A completed questionnaire should not automatically mean that a vendor is approved. Procurement and compliance teams should make decisions based on the evidence and the organisation’s risk acceptance criteria.

How Can AI Compliance Software Simplify Vendor Due Diligence?

Managing AI vendors through spreadsheets and separate documents can make it difficult to maintain consistent assessments across multiple departments.

An AI compliance software solution can centralise AI inventories, supplier assessments, regulatory obligations and supporting evidence.

With AnnexOps, organisations can support their AI vendor governance workflows through:

• AI inventory: Maintain visibility into AI systems and their associated suppliers.
• Risk classification: Assess AI systems against relevant EU AI Act categories and regulatory roles.
• Obligation mapping: Connect identified AI systems with applicable regulatory requirements.
• Document management: Organise technical documentation, DPIAs and supporting compliance records.
• Evidence tracking: Maintain structured records of assessments, approvals and outstanding actions.
• Continuous monitoring: Track relevant changes, compliance activities and identified gaps.

AnnexOps brings AI governance, EU AI Act and GDPR compliance operations together in one software environment. This helps AI product teams, developers and compliance professionals manage supplier-related information without maintaining disconnected compliance records.

Explore AI vendor and third-party risk management under the EU AI Act or discover AnnexOps AI compliance software.

Conclusion

An effective AI vendor due diligence questionnaire helps organisations look beyond supplier claims and examine how AI systems are developed, supplied, secured and maintained.

For European organisations, the assessment should connect AI supplier governance with applicable EU AI Act and GDPR responsibilities. Asking the right questions, verifying supporting evidence and reviewing vendors throughout the relationship creates a more structured approach to AI third-party risk management.

With centralised AI inventories, obligation mapping and evidence tracking, AnnexOps supports organisations in managing AI vendor governance and their wider AI compliance operations.

Build a more structured AI vendor risk management process with AnnexOps. Check Your AI Exposure or Book a Demo.

Author: Nitin Grover

Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.