I almost signed an AI vendor without checking the EU AI Act. So I built the checklist I wished I had.

Every procurement thread in 2026 ends the same way: a vendor shows up with "we're AI-powered," a slide deck, and a SOC 2 badge, and someone asks me to sign. What nobody on that thread asked — and what I didn't know to ask — was whether the EU AI Act puts any of that risk on us, the deployer, rather than on them.

I read the Act to find out. The short version stung: a lot of the duties land on the deployer, and several of them can't be signed away in a contract. So vetting the vendor is necessary but not sufficient, and I had no consistent way to do the vetting.

The case against the model, for this job

Annex III of the AI Act is a written list. It tells you, in prose, which use cases count as high-risk. Classifying a vendor's product against that list is a matching problem, not a judgement problem — and matching against written text is exactly where a rules-based check beats a model's gut read.

A model asked "is this vendor AI Act-compliant?" will confidently invent reassurance. The Act doesn't define "compliant vendor" as a single boolean; it defines deployer duties, Annex III categories, and the evidence you're supposed to hold. VendorVet keeps the logic on that written structure: it classifies the use case under Annex III, scores the vendor on evidence they actually provide (an evidence-weighted score, not a vibe), flags gaps in the contract terms, and surfaces the deployer duties that stay with you no matter what the vendor signs.

The evidence-weighted score is the part I trust most, because it refuses to score what isn't shown. If the vendor hasn't given you the documentation, that dimension comes back empty rather than assumed-green.

What it deliberately does not do

• It is not legal advice. It structures the due-diligence questions; a lawyer closes them.
• It does not certify the vendor. The score reflects evidence you supplied, not a regulatory ruling.
• Contract gap flags point, they don't fix. It tells you a clause looks missing; it won't rewrite or negotiate your contract.
• It can't transfer your duties. The non-transferable deployer obligations are flagged precisely because no checkbox makes them go away.

If you're about to sign an AI vendor and the only "compliance" input is the vendor's own PDF, VendorVet is $29/mo and gives you the deployer-side questions to ask first. The gaps it finds are yours to act on — that's the point.