When a company adopts an AI vendor, there's a quiet assumption that compliance travels with the contract. It doesn't. Under the EU AI Act, the deployer — that's you, the buyer — keeps obligations even when the model comes from someone else. The vendor's paperwork is your exposure.
I built VendorVet because the question "is this vendor safe?" is almost never asked before the signature, only after the audit letter.
30-second takeaway
- Buying an AI system doesn't transfer your regulatory obligation — it multiplies the things you have to track.
- The useful questions are boring: documentation, risk classification, incident reporting, transparency. Vendors hate them; buyers skip them.
- A screener turns "trust me" into a checklist you can actually send.
The contract doesn't close the loop
Most procurement processes score vendors on price, features, and a security questionnaire written before AI was the risk. None of that touches whether the vendor can produce the documentation the Act expects, or whether their classification of their own system matches yours. When those two disagree, you're the one standing in front of the regulator.
A vetting step that lives in the buying process — not the legal review three months later — is the difference between a one-line question and a six-month cleanup.
What a screen actually surfaces
Not a verdict. A structured read of what the vendor should be able to show you: their own risk classification, the documentation they ship, whether they handle incident reporting, what transparency they build in. Some of those answers are "we don't have that yet," and that answer is the most valuable output of the whole exercise.
VendorVet runs in the browser, no account, no key. Walk through the vendor and it tells you what to ask before you sign.
FAQ
What is VendorVet?
A screening tool that maps an AI vendor against the questions EU AI Act deployers are expected to answer about their suppliers. No account, no key.
Does passing mean the vendor is compliant?
No. It tells you what to ask and where the gaps are. The vendor's actual compliance is still their responsibility — and now, partly, yours.
Is this legal advice?
No. Decision-support for procurement, not a legal opinion.
Author's Process
This product was built with AI coding tools. The work was mostly turning the Act's deployer obligations into questions a buyer can actually send, instead of a PDF nobody reads.
Top comments (0)