Vendor due diligence for AI you buy
Send suppliers a short questionnaire, score their answers and record your decision.
As a deployer, you rely on your AI suppliers for much of the evidence. The vendor questionnaire collects it in a structured way.
Send a questionnaire
- 1Go to Compliance → Vendor risk and add the vendor, linking the AI system it supplies.
- 2Optionally enter their email to send the invitation directly.
- 3They get a link (no account needed) that works for a limited time. You can extend or revoke it.
Review the answers
When the vendor submits, AI owners are notified. The answers are scored on areas such as AI Act role and classification, documentation, data use, security, human oversight and incident handling. The vendor never sees the score.
Decide
Record Approved, Approved with conditions or Rejected. Conditions and rejections need a written note. A vendor with a critical concern can't simply be approved: approve it with conditions that resolve the concern, or reject it.
Ask for the supplier's instructions for use and technical documentation summary. As a deployer you must use the system according to them.