Skip to main content
Praxikon

Free template · Word · English and Dutch

AI vendor questionnaire template with an AI annex to the data processing agreement

An AI vendor questionnaire is the set of questions a buyer sends an AI supplier before signing. The answers establish who is provider and deployer under the EU AI Act and who is controller and processor under the GDPR. The buyer then records the terms on training, sub-processors, transfers, logs, model changes and incidents.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:ai-vendor-questionnaire
Legal basis
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR)

Who is this template for?

  • Procurement and contract managers buying an AI service or an AI feature in existing softwareTerms with the supplier; for a high-risk system the written agreement in the AI value chain (Article 25(4) AI Act)
  • Privacy lead or data protection officer, on behalf of the controllerData processing agreement (Article 28(3) GDPR), transfers outside the EEA (Chapter V GDPR) and the DPIA (Article 35 GDPR)
  • Business owner deploying the AI service, as deployerUse in line with the instructions for use, human oversight, monitoring and logs (Article 26 AI Act, for Annex III from 2 December 2027)
  • IT and product teams building their own application on a general-purpose AI modelInformation from the model provider (Article 53(1)(b) and Annex XII) and your own duties as provider (Article 50(1) and (2))
  • Public buyersAlongside the European model contractual clauses (MCC-AI); registration of high-risk use (Articles 26(8) and 49) and the fundamental rights impact assessment (Article 27, from 2 December 2027)
  • Works council or other employee representativesConsultation or consent under national law when the AI service processes staff data or can monitor staff (in the Netherlands Article 27(1)(k) and (l) of the Works Councils Act)

What is inside

  • Why to arrange this now and a 'What applies when' table, naming the role that carries each obligation (introduction)
  • Four procurement situations with your role and the supplier's under the AI Act and the GDPR, plus a worked fictional example of three purchases (chapter 1)
  • Questionnaire for the supplier: 62 questions in eleven modules, from role and intended purpose to general-purpose AI models, Article 50, training, sub-processors, logs and the end of the agreement, with the article for each question (chapter 2)
  • Internal assessment guide with, for each topic, a strong answer, the red flag and the next step, plus a stop box for prohibited practices (chapter 3)
  • AI annex to the data processing agreement: fifteen clauses to paste into your contract, each with a drafting note (chapter 4)
  • Annex A per AI service, with a table for sub-processors, processing locations and the transfer mechanism (chapter 4)
  • Checklist before signing and a record of the decision (chapter 5)

How to use the template

  1. Use chapter 1 to determine the situation and the roles. That tells you which modules to send.
  2. Send chapter 2 to the supplier before award or before signing, and remove the modules that do not apply.
  3. Assess the answers with the assessment guide in chapter 3. That chapter is for internal use only.
  4. Include the AI annex from chapter 4 alongside the data processing agreement and complete annex A for each AI service.
  5. Record the decision with chapter 5 and keep the answers with your AI register and, where one is needed, with the DPIA.

Common mistakes

  • Treating the supplier as a processor while its terms allow training on your data. For that own use it is a controller in its own right (Article 28(10) GDPR) and you need your own lawful basis.
  • Settling for an opt-out in the admin console. The supplier can change that setting; the training prohibition belongs in the contract without reservation.
  • Leaving the provider of the underlying AI model off the sub-processor list, while the model often runs outside the EEA.
  • Assuming you are always the deployer. If you build your own chat on an AI model you are the provider of that system (Article 3(3)), with the duties of Article 50(1) and (2), and if you use a general-purpose AI system for an Annex III purpose you may become the provider of a high-risk system (Article 25(1)(c)).
  • Parking the high-risk requirements because they apply only from 2 December 2027. Your contract often runs beyond that date, and for a system already on the market they apply only after a significant change in its design (Article 111(2)).

When do you need legal advice?

  • The supplier wants to use your data for training or product improvement. For that processing the supplier is then a controller in its own right, and outside your instructions it even infringes the GDPR (Article 28(10) GDPR). As controller you need your own lawful basis and must assess whether the new purpose is compatible (Article 6(4) GDPR).
  • You modify the system, put your name on it or use it for an Annex III purpose. You may then become the provider of a high-risk AI system yourself (Article 25(1)), with the obligations of Article 16 and a written agreement with your own suppliers (Article 25(4)). Your supplier is then no longer the only party with obligations.
  • Data leaves the EEA or the supplier is subject to foreign government access powers. As controller you need a transfer mechanism under Chapter V GDPR and often a transfer impact assessment. That also applies when only the model or the support runs outside the EEA.

Frequently asked questions

Does the EU AI Act require a vendor questionnaire?

No, there is no prescribed questionnaire. You do need the information to meet your own obligations, such as those of the deployer (Article 26) and the GDPR duties of the controller. The provider must supply part of it (Article 13 for high-risk systems, Article 53 for general-purpose AI models). The questionnaire makes that concrete.

Is the supplier or my organisation responsible under the AI Act?

That depends on the role. If you buy a ready-made AI service, the supplier is usually the provider and your organisation the deployer. If you build an application on an AI model yourself, or put a system into service under your own name, you are the provider yourself (Article 3(3) and Article 25).

Why is the training prohibition so central?

If the supplier uses your data for its own purposes, such as training models, it is a controller in its own right for that processing (Article 28(10) GDPR if it goes beyond your instructions). You then need your own lawful basis and a compatibility assessment (Article 6(4) GDPR). The AI annex rules that out, including for anonymised data.

Do the high-risk requirements already apply to my contract?

Not as of 6 October 2026. For Annex III systems they apply from 2 December 2027, for Annex I from 2 August 2028. A system already on the market before that date falls under the high-risk rules only after a significant change in its design; for systems intended for use by public authorities the deadline is 2 August 2030 (Article 111(2)). Clause 4.3 therefore secures the requirements in the contract.

What must the provider of a general-purpose AI model give me?

If you build on the model, the model provider must give you documentation with at least the elements of Annex XII (Article 53(1)(b)). That obligation has applied since 2 August 2025; since 2 August 2026 the Commission can enforce it and impose fines (Article 101). For models placed on the market before 2 August 2025 the deadline is 2 August 2027 (Article 111(3)).

May I adapt the template and share it within my organisation?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, AI vendor questionnaire template with an AI annex to the data processing agreement, version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/ai-vendor-questionnaire

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597