AI System Intake Form

Name of the AI system

Name of supplier / developer

Country of supplier

Version number of the system

Intended purpose / use case in government

Contact person supplier (name, email, phone)

Type of AI technology (rule-based / machine learning / deep learning / LLM / other)

Describe how the system generates decisions/output

What data was the model trained on? Describe the training data.

What are the measured performance indicators? (accuracy, precision, recall, etc.)

Is the model further trained after implementation (continuous learning)?

Where does the system run? (on-premise / cloud / hybrid)

If cloud: which cloud provider and in which region are the servers located?

What data does the system receive as input?

Are personal data processed? If so, which categories?

Are special categories of personal data processed? (health, ethnicity, religion, etc.)

How long is data retained?

Is data shared with third parties? If so, with whom?

Is a DPIA (Data Protection Impact Assessment) available?

How is data security guaranteed? (encryption, access control)

Have bias tests been conducted on the model? If so, describe the results.

Which protected characteristics were tested? (age, gender, ethnicity, etc.)

What measures have been taken to mitigate bias?

Is the system monitored for discriminatory outcomes after implementation?

Can the system explain why a particular output was generated?

How is explanation provided? (feature importance, decision path, etc.)

Is the explanation understandable for non-technical end users?

Is documentation available about the operation of the model?

Can users override the system output?

Is there a "kill switch" to immediately disable the system?

How are deviating decisions by human operators logged?

Which roles/functions have access to the system?

What is the availability guarantee (SLA)?

How often are updates/patches rolled out?

How is the client informed about changes?

Is 24/7 support available? If not, what are the support hours?

What is the process for failures or incidents?

What is the supplier's role under the AI Act (provider, importer or distributor), and does the system fall under Annex III? Explain the classification.

What certifications does the supplier have? (ISO 27001, SOC 2, etc.)

For a high-risk system: are the EU declaration of conformity (Article 47), the instructions for use (Article 13) and the registration in the EU database (Article 49) available? The Annex III obligations apply from 2 December 2027.

How does the supplier inform you about changes to the system and to the law, and does it provide what you need as a deployer for Article 26 and, for a public body, the fundamental rights impact assessment under Article 27?

Is technical documentation (model card / system card) available?

Is a data sheet about the training data available?

Is audit documentation available?

What additional documentation can be provided?