AI Vendor Due Diligence
Review of your AI vendors and your obligations as a deployer under the EU AI Act. From €900.
Companies that buy and use ready-made AI tools (rather than building them) also have obligations under the AI Act — in the role of deployer. You must vet the vendor, document how you actually use the tool, and monitor whether the purchased system doesn't unexpectedly fall into a high-risk category based on how you use it.
We review the documentation and stated characteristics of the AI vendors you work with, and tell you where there's a gap between what they claim and what you're actually responsible for as their customer.
Many companies wrongly assume that because a tool is third-party, responsibility automatically stays entirely with the vendor. The regulation sees it differently — and this wrong assumption is one of the most common causes of unintentional breach.
Frequently asked questions
Isn't responsibility entirely on the AI tool vendor?
Not entirely. The AI Act distributes obligations between both the provider and the deployer — the company that actually uses the tool in its business process. Certain obligations (e.g. informing affected individuals, human oversight) remain your responsibility even when the tool itself is third-party.
How many vendors are typically reviewed at once?
It depends on the number of AI tools integrated into your business — from 1-2 (e.g. just a customer chatbot) to more in a complex technology stack. Pricing adjusts to scope.