Questions to ask an AI vendor

V77 Trust's vendor questionnaire covers these in a structured form. Use this list for calls and contract reviews.

Role and classification

• What is the system's intended purpose, and what is it not for?
• How have you classified it under the EU AI Act, and why?
• Are you the provider? Who is your EU authorised representative, if you're outside the EU?

Documentation

• Can we have the instructions for use?
• Can you share a summary of the technical documentation, testing and known limits?
• For high-risk systems: conformity assessment status, EU declaration of conformity, registration number.

Data

• What data do you collect from us, where is it stored, and for how long?
• Do you use our data to train or improve models? Can we opt out?
• Which sub-processors and model providers do you use?

Performance and fairness

• How is accuracy measured, and what are the results for users like us?
• Have you tested for bias? On which groups? Can we see the results?

Security

• How do you protect against prompt injection, data leakage and model misuse?
• Which certifications do you hold (for example ISO/IEC 27001, SOC 2, ISO/IEC 42001)?

Oversight and logs

• What controls do we have to review, override or stop outputs?
• What is logged, and can we export the logs for at least six months?

Incidents and change

• How and how fast will you tell us about incidents and serious incidents?
• How will you tell us about model or behaviour changes before they reach us?