AI Vendor Due Diligence Checklist + DPA
For when you buy an AI tool instead of building one — deployer obligations + DPA checklist.
For compliance, legal, IT teams, or AI Governance Officers at companies that use or develop AI systems, in any EU country or operating in the European market.
What changes with this document
At the «Roles & human oversight» stage of the path
The system decides on its own, and if something goes wrong, you find out after the fact.
An escalation protocol, plus due diligence before hiring an AI vendor.
Preview
Real screenshots of the file you receive. The full document includes much more content.
How buying works
- 1You pay on the secure Lemon Squeezy checkout.
- 2You get an email with a ZIP of the files (PDF, Excel or Word depending on the product).
- 3You adapt it to your organisation and share it with your team.
What's included
- Editable Word checklist
- Instructions PDF guide
- Legal Notice
Why this document exists
Buying AI from a vendor doesn't remove your deployer obligations (Arts. 26-29) or your controller responsibility if the vendor processes personal data (GDPR Art. 28). This checklist covers vendor assessment, AI Act due diligence, data protection due diligence, and an essential DPA clauses checklist.
Frequently asked questions
Who is AI Vendor Due Diligence Checklist + DPA for?
For compliance, legal, IT teams, or AI Governance Officers at companies that use or develop AI systems, in any EU country or operating in the European market.
Does this replace legal advice?
No. It's a working template that organizes and speeds up the compliance process, but it does not constitute legal advice or guarantee compliance with Regulation (EU) 2024/1689 — see the included Legal Notice.
What format is it delivered in?
Instant download after purchase, in the formats listed under “What's included”, plus the instructions guide in PDF and the Legal Notice.

