The EU AI Act for companies that buy AI: what to ask your vendors

Provider or deployer: which one are you?

Under the AI Act (Regulation (EU) 2024/1689), the provider is whoever develops an AI system and puts it on the market, usually your vendor. The deployer is the organization using it under its own authority, usually you. Providers carry most of the heavy obligations. But deployers aren't off the hook, and in some cases, such as when you substantially modify a system or put your own name on it, you can end up with provider obligations yourself.

What applies to you as a buyer

• AI literacy (already applies). Since February 2025, organizations using AI systems must take measures to ensure their staff have a sufficient level of AI literacy for how they use them (Article 4). If your teams use AI tools, you need to be able to show they know how to use them responsibly.

• Prohibited practices (already apply). Some uses of AI are banned outright, such as emotion recognition in the workplace, with narrow exceptions. Make sure nothing you buy falls into these categories.

• High-risk systems. If you use AI in areas the Act treats as high-risk, such as recruitment, employee management, creditworthiness, or access to essential services, deployers must use the system according to the provider's instructions, assign human oversight to competent people, monitor it, keep logs, and in some cases inform affected people (Article 26). In the EU, these requirements were pushed to December 2027 and August 2028. (European Commission)

• Transparency. When AI interacts with people or generates content, the Act adds transparency duties, for example making clear to people that they're dealing with an AI system in certain situations.

Questions to ask your AI vendors

You can only meet your obligations if your vendor gives you what you need. Before approving an AI tool, get written answers to these:

• What does the AI do, and what doesn't it do? Ask for documentation of intended use, known limitations and accuracy, and instructions for use. For high-risk systems, providers are required to supply these.

• Is it high-risk under the AI Act? Ask how the vendor classifies the system and why. Their answer tells you which obligations land on you.

• How do we keep a human in the loop? What can a person review, override or switch off? Who at your company will do it, and do they have the training?

• What does it log, and can we get the logs? Deployers of high-risk systems need to keep the logs the system generates. Make sure you can actually access them.

• Is our data used to train your models? This is as much a GDPR and confidentiality question as an AI Act one. Get the answer in the contract, not just in a sales call.

• For agents: what can it access, and what can it do on its own? List the systems, data and actions an agent can take without a human. Agents' permissions tend to grow quietly with every product update, so plan to re-check them.

Make it part of vendor intake, not a separate project

The simplest way to stay on top of this is to ask these questions every time a team wants a new tool, not as a one-off audit. Add an "uses AI?" question to your vendor intake, route AI tools to the right reviewers, and record the answers. Our free vendor due diligence checklist includes the AI Act points alongside NIS2, GDPR and DORA.

Granur builds this into the evaluation itself: AI vendors pick up compliance screening for frameworks like the EU AI Act, agents get a permission registry so you can see what each one can access and do, and shadow-AI discovery surfaces tools teams adopted without asking. Nothing is approved without leaving a record.