AI vendors: what to ask and what to put in the contract before buying

First: what is your role?

It is like hiring a haulage company: even if they drive, you answer for what you send, to whom and under what conditions. Under the AI Act, whoever uses an AI system under their authority is a “deployer” and has their own obligations (for example, use in line with the instructions and human oversight for high-risk systems). If the system processes personal data, GDPR roles also apply.

Twelve questions before buying

1. What is the system designed for, and what is it not for?
2. Do they classify it as high-risk or another AI Act category? On what basis?
3. What documentation and instructions for use do they provide?
4. Where is data processed and stored?
5. Do they use my data to train their models? Can it be turned off?
6. Which sub-processors are involved?
7. Which security certifications do they hold, and with what scope?
8. How and how fast do they report incidents?
9. Can I audit or receive audit reports?
10. What usage logs do they provide?
11. How do they announce major model changes?
12. What happens to my data at the end: return and deletion?

What to put in writing

• Permitted purpose and use of data (including whether training is prohibited).
• A data processing agreement if personal data is involved.
• Incident notification and cooperation during inspections.
• Exit: portability and verifiable deletion.

After signing

• Add it to your inventory of AI systems with an internal owner.
• Review yearly certifications, sub-processors and model changes.

Frequently asked questions

Am I responsible if I use a vendor’s AI?

Partly: the AI Act and the GDPR split obligations between both.

Can they use my data to train their models?

It must be written down whether they do, how to disable it and what happens at the end.

Informational content, not legal advice. Have the clauses reviewed by a professional.