Verification required. This is a working template, not a regulator-approved form. Where it cites an article or a date, the citation comes from secondary sources or from memory of the legal text and is a pointer to check. This is not legal advice.
How to use: This is a blank form. Copy it and fill in the empty cells and blanks for your system. To copy it, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source.
Wiki control: AI-CTRL-014. Add these questions to the standard third-party questionnaire for AI suppliers. The value-chain rule (Art. 25) is [Recalled], and the DORA and NIS2 supply-chain themes are [Recalled] and [Reported].
Supplier: __ Product: _ Date: Reviewer: ___
Answer Yes, No or Partial, and attach evidence. A Partial answer needs a dated plan.
A. Identity, role, certification
#
Question
Answer
Evidence
A1
Legal entity, country, parent, EU establishment or authorised representative
A2
AI Act role for this product (provider, deployer, importer, GPAI provider)
A3
AI Act risk classification and reasoning
A4
Information security certification (name, scope, expiry)
A5
AI management certification, if claimed
B. Conformity documentation (high-risk or relevant)
#
Question
Answer
Evidence
B1
Instructions for use and intended purpose
B2
Technical documentation available to us on request
B3
Conformity assessment route, declaration of conformity, CE marking where applicable
B4
EU database registration reference
B5
Quality management system
B6
Post-market monitoring and incident reporting to authorities
B7
Standards followed (cited or draft)
C. Data and transfers
#
Question
Answer
Evidence
C1
Countries of processing, storage, logs, backups, support access
C2
Sub-processors and model suppliers (name, country, role)
C3
Transfer mechanism for non-EU flows
C4
Use of our data to train or improve models
C5
Retention and deletion
C6
Encryption and key control
C7
Training data provenance, copyright position, opt-out handling