AI vendor due diligence: what to ask every SaaS vendor before 2 August 2026

Most companies don’t build chatbots or image generators — they buy them. Here is the uncomfortable part: when you plug a vendor’s AI into your product or workflow, you typically become the deployer under Article 3(4) of Regulation (EU) 2024/1689, and several Article 50 dutiesland on you, not the vendor. Vendor due diligence is how you avoid inheriting someone else’s compliance gap.

Why your vendor’s gap becomes your fine

• Deep fakes & published AI text — Article 50(4): the disclosure duty sits on the deployer. If your marketing team publishes synthetic media from a vendor tool without labels, that’s your breach.
• Chatbots — Article 50(1):the design duty is the provider’s, but if you white-label a bot under your own name you can become the provider — and either way it is your customer relationship and your brand in front of the user.
• Emotion recognition — Article 50(3): deployers must inform exposed persons — relevant if you buy call-centre analytics.

Fines for getting it wrong reach €15M or 3% of worldwide turnover (calculate your exposure).

The questions that actually matter

1. Scoping: Which features are AI systems under Article 3(1)? Which models sit underneath (own / third-party)? Has anything been assessed against the prohibited or high-risk tiers?
2. Disclosure defaults: Does the chat/voice product show an AI notice out of the box, in which languages, and can customers disable it? (A disable switch without a warning is a red flag.)
3. Marking: Are generated images/audio/video marked machine-readably (e.g. C2PA)? Does the marking survive resize and re-encoding?
4. Deep-fake safeguards: consent checks and automatic labels for content resembling real people.
5. Evidence & change control: will the vendor provide validation reports on request and notify you before changing AI functionality or disclosure defaults?

Contract clauses worth insisting on

• A compliance warranty referencing Regulation (EU) 2024/1689 Article 50 for the functionality supplied.
• A cooperation duty: evidence within a fixed number of days when a market surveillance authority asks you questions.
• Change notification (30 days) for AI functionality, models and disclosure defaults.
• Indemnity or termination rights if the vendor removes marking or disclosure features you rely on.

Red flags

• “The AI Act doesn’t apply to us, we’re US-based” — wrong; output used in the EU is in scope.
• No answer on marking standards, or “we plan to add it later” with no date.
• Human-sounding bot personas with no disclosure and no way to add one.
• Refusal to put any of it in the contract.

Do it systematically

Send every AI vendor the same questionnaire, score the answers, and keep them in your vendor file — that record is itself compliance evidence. The $49 template pack includes a ready-to-send 23-question Vendor AI Transparency Questionnaire (DOCX/ PDF) with a vendor declaration and reviewer scoring section, plus the internal checklist that ties vendor answers into your own transparency policy. Start by checking your own obligations with the free 3-minute gap check.