Vendor Assessment under the AI Act and GDPR: What SMEs Should Demand from AI Providers
This article was created with AI assistance
The text and images in this article were generated with the help of AI systems. Labelled in accordance with Art. 50(4) of the EU AI Act. Responsible for publication: ArkeonTech.
- EU AI Act
- GDPR
- Vendor assessment
- AI adoption
- Compliance
Key takeaway: The AI Act does not impose its own vendor assessment duty on companies that only use AI; checks on the provider are required there of importers and distributors of high-risk systems (Articles 23 and 24). The selection duty sits in Article 28(1) GDPR: anyone who has a provider process personal data on their behalf may only work with providers offering sufficient guarantees. The AI Act adds three checkpoints: your role as provider or deployer, the AI disclosure under Article 50 and the prohibitions under Article 5, such as emotion recognition aimed at employees. By January 2027 two more follow: Germany's new Product Liability Act on 9 December 2026 and the end of switching charges under the Data Act on 12 January 2027.
The term vendor assessment comes from purchasing and quality management: anyone who already rates suppliers against fixed criteria wants to know what an AI provider adds. According to Bitkom's AI study of 14 September 2026, 57 percent of German companies with 20 or more employees use AI. Among them, data protection requirements top the list of obstacles at 66 percent, and 45 percent worry that company data could fall into the wrong hands. 37 percent of all companies surveyed expect to be affected by the AI Act as users, and another 34 percent are still checking.
This guide sorts out which check is mandatory, where it comes from and which documents you should see before signing. For context: ArkeonTech is itself an AI provider and sits on the other side of the table in such assessments.
Does the AI Act require a vendor assessment?
Not explicitly. Anyone who only uses an AI system is a deployer under Article 3(4), and the regulation does not require deployers to assess their supplier. Checks on the provider are required of importers and distributors of high-risk systems: before distribution they verify the CE marking, the declaration of conformity and the instructions for use (Article 23(1), Article 24(1)).
You still cannot skip the check, for three reasons. First, your role decides whether you carry the duties of a provider or of a deployer; whoever has a system developed can be the provider. Second, chatbots and phone assistants need the AI disclosure under Article 50, and depending on your role you owe it yourself. Third, Article 5 prohibits not only offering but also using certain systems, since 2 February 2025 for example inferring emotions in the workplace.
Deployers of high-risk systems under Annex III have additional duties of their own from 2 December 2027 (Article 26): use the system according to the instructions for use, assign human oversight to people with the necessary competence, keep automatically generated logs for at least six months and inform the affected employees and their representatives before use in the workplace. In mid-sized companies this mainly concerns systems that screen applications or evaluate candidates (Annex III point 4). For high-risk systems placed on the market or put into service before 2 December 2027, the regulation, apart from the prohibitions in Article 5, applies only if their design is significantly changed afterwards (Article 111(2)).
The fines show the weighting: prohibited practices can cost up to 35 million euros or 7 percent of worldwide annual turnover, breaches of the deployer duties and of Article 50 up to 15 million euros or 3 percent. For SMEs the lower of the two amounts applies in each case (Article 99(3), (4) and (6)).
Which laws actually require the check?
The General Data Protection Regulation, for every service that processes personal data on your behalf, not just for AI. Under Article 28(1) GDPR you may only work with such a provider if it provides sufficient guarantees for appropriate technical and organisational measures. For companies covered by NIS2, the German BSI Act comes on top.
Article 28 spells out what that means in several places. The data processing agreement must state, among other things, that the provider processes only on your documented instructions, assists you with the data protection impact assessment and allows you to carry out audits (paragraph 3, points a, f and h). It may engage further processors only with your authorisation; under a general authorisation it must inform you of every intended change, and you can object (paragraph 2). Breaches of Article 28 can cost up to 10 million euros or 2 percent of worldwide annual turnover (Article 83(4)). If a provider is based in the United States, the EU-US Data Privacy Framework only covers it if it is certified on the official list; otherwise standard contractual clauses, for example, are needed (Articles 44 et seq.).
Two points are specific to AI services. In its guidance of 6 May 2024, Germany's data protection conference (DSK) advises checking whether inputs and outputs are used for training and whether this can be excluded; if it cannot and personal data is involved, that purpose requires a legal basis of its own (margin number 24). And customer support by means of AI is on its mandatory list for data protection impact assessments (number 11). Because you need information on how the system works for that, the guidance says to make sure at the selection stage that the provider supplies it (margin number 40).
Companies covered by NIS2 have had a second basis since 6 December 2025. Essential and important entities, the latter including companies in the sectors of Annexes 1 and 2 of the BSI Act with at least 50 employees or more than 10 million euros in both annual turnover and balance sheet total, must include supply chain security in their risk management and document the implementation (section 28(2), section 30(1) and (2) no. 4 BSIG). For professionals bound by secrecy, section 203 of the German Criminal Code applies on top; which routes to language models then hold up is covered in the article on LLM hosting under section 203 StGB.
When do you become the provider yourself?
When you have an AI system developed and put it into service under your name or trademark (Article 3(3)). Anyone who uses a finished product unchanged remains a deployer. For high-risk systems, putting your name on someone else's system or making a substantial modification is enough. And whoever changes the intended purpose of a system not classified as high-risk so that it becomes a high-risk system, for example by turning a standard chatbot into a tool for pre-selecting applicants, also becomes the provider (Article 25(1)).
| Situation | Your role | What follows |
|---|---|---|
| You use a finished product unchanged, such as a chatbot service or a company account for ChatGPT | Deployer | The provider must build in the AI disclosure (Art. 50(1)); you check that it has |
| A service provider develops the chatbot for you and it runs under your name | Provider | The AI disclosure is your duty; the model provider must supply you with the documentation of the built-in language model, except for open-source models (Art. 53(1)(b) and (2)) |
| You put your name on someone else's high-risk system or modify it substantially | Provider (Art. 25(1)) | All provider duties under Art. 16; written agreement with the suppliers (Art. 25(4)) |
The second row is the case many underestimate: whoever has a chatbot built and runs it under their own name does not just buy a service but takes on the provider's duties. Details on the AI disclosure are in the guide to the disclosure duty under Article 50.
If your system builds in a language model, you are also a downstream provider (Article 3(68)): the model provider has had to give you information on the model's capabilities and limitations since 2 August 2025 (Article 53(1)(b), Annex XII), for models already on the market before that date from 2 August 2027 (Article 111(3)). Models released under a free and open-source licence whose weights, architecture and usage information are public are exempt, unless they pose a systemic risk (Article 53(2)). If a model provider does not comply, you can lodge a complaint as a downstream provider; supervision of model providers lies with the Commission's AI Office (Articles 88(1) and 89(2)). The Commission's list names 22 signatories of the code of practice for such models, including OpenAI, Anthropic, Google, Microsoft and Mistral AI (as of 7 October 2026); xAI has signed only the safety chapter. In the transparency chapter the signatories commit to answering additional questions from downstream providers within 14 days at the latest, save for exceptional circumstances. To deployers using a finished product, the model provider does not owe this information.
Which evidence should you request from an AI provider?
The ten points follow from the AI Act, the GDPR, the Data Act and product liability. The order matters: first the role, because it determines who carries which duty, then the AI disclosure and data protection, and finally switching and liability. Get every point in writing; a verbal promise will not help you in an audit by the authorities.
| Checkpoint | Legal basis | What to have shown to you |
|---|---|---|
| Role | Art. 3(3) and (4), Art. 25 AI Act | Contract clause: who is the provider, under whose name does the system run? |
| AI disclosure | Art. 50(1) AI Act | Wording of the chat greeting or the phone announcement before the first answer |
| Marking of generated content | Art. 50(2) AI Act | Method of machine-readable marking for text, image, audio and video generators |
| No prohibited function | Art. 5 AI Act | List of functions, in particular no emotion recognition aimed at employees |
| Data processing agreement | Art. 28(3) and (9) GDPR | Concluded agreement (in writing, which may be electronic) with the technical and organisational measures |
| Sub-processors and third countries | Art. 28(2) and (4), Art. 44 et seq. GDPR | List with seat and processing location, including for the language model; for the US, certification under the Data Privacy Framework or standard contractual clauses |
| No training on your data | Art. 28(3)(a) GDPR, DSK guidance | Contract clause or default setting that excludes training |
| Documents for the impact assessment | Art. 35 and Art. 28(3)(f) GDPR | Description of how it works, data flows and risks |
| Switching and data export | Art. 25 and 29 Data Act | Export format, notice period for switching of at most two months, switching charge, early termination penalties |
| Liability and recourse | German Product Liability Act from 9 December 2026 | Liability clause and proof of liability insurance |
With phone assistants the list of functions deserves a close look. The Commission's guidelines on prohibited practices (C(2025) 5052) give the example of a call centre that uses webcams and voice recognition to track its employees' emotions, such as anger: prohibited (paragraph 254). The same analysis applied to callers does not fall under this prohibition. It is, however, emotion recognition: as the deployer, you have had to inform the callers about it since 2 August 2026 (Article 50(3)), and it is listed in Annex III point 1(c) among the high-risk systems with duties applying from 2 December 2027. Germany's data protection conference names exactly this case, a call centre that automatically analyses callers' mood, as an example that requires an impact assessment. Sentiment analysis that only evaluates the content of written text, by contrast, is not based on biometric data and is not emotion recognition within the meaning of the regulation (paragraph 251, Article 3(39)).
What deadlines are coming up before the end of 2027?
Four dates shift the checklist. On 2 December 2026 new prohibitions and a marking deadline under the AI Act take effect, on 9 December Germany's new Product Liability Act, on 12 January 2027 the end of switching charges under the Data Act. On 2 December 2027 the deployer duties for high-risk systems follow.
| Date | What changes | What to check with the provider |
|---|---|---|
| 2 December 2026 | Also prohibited from then on: systems that generate intimate deepfakes of real people without their consent or child sexual abuse material, where that is their purpose or they can foreseeably do so without effective safeguards; deployers are only prohibited from using them for that purpose (Art. 5(1)(ba) and (bb), (1a)); providers of generative systems placed on the market before 2 August 2026 must mark their outputs in machine-readable form (Art. 111(4)) | For generative systems (text, image, audio, video) the machine-readable marking; for image and video generators also the safeguards |
| 9 December 2026 | New German Product Liability Act: software and AI systems are products, manufacturers are liable without fault; it applies to products placed on the market or put into service from that day (section 23) | Liability clause, recourse and insurance |
| 12 January 2027 | No more switching charges for cloud and software services (Art. 29 Data Act) | Switching charges in existing contracts |
| 2 December 2027 | Duties for high-risk systems under Annex III, for deployers Art. 26 | Instructions for use, logs and oversight for candidate selection and emotion recognition |
The Data Act has applied to data processing services since 12 September 2025 and expressly covers software as a service (recital 81). Contracts must govern switching: a notice period of at most two months for initiating the switch, then a transition period of at most 30 calendar days with assistance, the export of all exportable data and a retrieval period of at least 30 days (Article 25(2)). Until 12 January 2027 the provider may charge at most the costs directly incurred by the switch, after that nothing (Article 29). Fixed contract terms remain permitted, as do proportionate penalties for early termination; they do not count as switching charges, but the provider must disclose them before the contract is concluded (Article 2(36), Article 29(4), recital 89). For services whose main features are mostly custom-built for a single customer and which are not offered at broad commercial scale via the provider's service catalogue, the ban on charges does not apply, but the contract clauses remain (Article 31(1)); trial versions are exempt altogether (Article 31(2)).
Product liability also turns on whose name a system runs under: a manufacturer is also whoever has a product designed or manufactured or presents themselves as the manufacturer by putting their name or trademark on the product (section 3). What this means for users and potential manufacturers is covered in the article on the new product liability from December 2026.
What should you do when the provider switches models?
Assess again, because a model switch usually changes more than the quality of the answers. If the provider sources the new model from another model provider, that is usually a new sub-processor. Under a general authorisation it must inform you in advance and you can object; under a specific authorisation it needs your approval (Article 28(2) GDPR).
Processing location and retention period often change with the model, and with them the basis of your impact assessment. And because a different model answers differently, a test with your most frequent requests belongs before the switch, for a phone assistant including the AI disclosure at the start of the call. If you are the provider yourself, you also need the documentation from the new model provider.
None of the laws sets a fixed interval for reassessment. Fixed triggers therefore make sense: a new sub-processor, changed terms of use on training, a security incident at the provider, a new function such as sentiment analysis and a date before every contract renewal.
Are there templates for the assessment?
Yes, three public and free ones. The guidance of Germany's data protection conference of 6 May 2024 devotes its first chapter to selecting AI applications. The EU model contractual clauses for procuring AI come in a version for high-risk systems and a light version. For built-in language models, the code of practice published by the Commission contains a model documentation form.
The model contractual clauses (MCC-AI) come from the Commission-supported community of practice on public procurement of AI. They are written for public buyers and, according to their commentary, are a living working document (version of 12 February 2025). According to the commentary they are not suitable for other organisations, although parts of them can be used if each clause is checked for fit. Even for systems without risk, the commentary recommends agreements on risk management, data, technical documentation and instructions for use, and on the rights to the datasets; according to the commentary, the latter can reduce the risk of dependence on the supplier. The model documentation form belongs to the code of practice and only concerns you if you are the provider yourself.
Which questions to ask an agency before the first meeting is in the checklist for hiring an AI agency, the duties per type of use in the guide to the EU AI Act for SMEs.
Frequently asked questions
Does an SME have to carry out a vendor assessment under the AI Act?
Not as a duty of its own, as long as it only uses AI. The duty to choose carefully follows from Article 28(1) GDPR as soon as the provider processes personal data on your behalf. The AI Act supplies the checkpoints: your role, the AI disclosure under Article 50 and the prohibited practices under Article 5.
Am I the provider if an agency develops the chatbot for me?
Yes, if the chatbot is put into service under your name or trademark: under Article 3(3) a provider is also whoever has an AI system developed. You then owe the AI disclosure under Article 50(1) yourself. Set out in the contract who implements which duty technically.
May the AI provider use our inputs for training?
Where personal data is involved, that requires a legal basis of its own. Germany's data protection conference advises checking whether inputs and outputs are used for training and whether this can be excluded; it calls applications without such training preferable under data protection law. Have the exclusion confirmed in writing.
What changes for our AI contracts on 12 January 2027?
From then on, providers of cloud and software services may no longer charge for switching to another provider (Article 29 Data Act). Since 12 September 2025 contracts already have to govern switching, with a notice period of at most two months for initiating the switch and the export of your data. Fixed terms and proportionate early termination penalties remain permitted. Services built essentially for a single customer and not sold from the provider's catalogue are exempt from the ban on charges.
Is sentiment analysis allowed in a phone assistant?
Not for employees: inferring emotions in the workplace has been prohibited since 2 February 2025, except for medical or safety reasons (Article 5(1)(f)). For callers the ban does not apply. If the sentiment analysis evaluates the callers' voices, that is emotion recognition: you must inform the callers (Article 50(3)), and from 2 December 2027 the duties for high-risk systems apply. Germany's data protection conference requires a data protection impact assessment for exactly this case.
Does NIS2 also apply to choosing AI providers?
Only if your company itself falls under NIS2, as an important entity for example with at least 50 employees in one of the sectors listed in Annexes 1 and 2 of the German BSI Act. Then supply chain security has been one of the mandatory risk management measures since 6 December 2025 (section 30(2) no. 4 BSIG), and implementation must be documented.
Which rules apply to chatbots, phone assistants and WhatsApp bots in detail is shown in the legal tables on the pages for the AI chatbot, the AI phone assistant and WhatsApp AI. This is not legal advice; for reviewing a specific contract a specialist lawyer remains the right contact.
Sources
- EUR-Lex: Regulation (EU) 2024/1689 on artificial intelligence, consolidated version of 27 July 2026 - including the amendments by Regulation (EU) 2026/1744; definitions (Art. 3), prohibitions (Art. 5), importers, distributors, value chain and deployers (Art. 23 to 26), transparency (Art. 50), model providers (Art. 53, Annex XII), supervision and complaints (Art. 88, 89), transition and application (Art. 111, 113), fines (Art. 99), high-risk areas (Annex III)
- EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation - processors (Art. 28), impact assessment (Art. 35), third-country transfers (Art. 44 et seq.), fines (Art. 83)
- EUR-Lex: Regulation (EU) 2023/2854, Data Act - definition of switching charges (Art. 2(36)), switching between data processing services (Art. 23 to 31), application from 12 September 2025 (Art. 50), software as a service and fixed terms (recitals 81 and 89)
- Bundesrat: Act passed by the Bundestag to modernise product liability law, printed paper 584/26 of 9 October 2026 - definition of manufacturer (section 3), transitional provision (section 23), entry into force 9 December 2026
- Gesetze im Internet: Section 30 BSI Act, risk management measures and section 28 BSI Act, essential and important entities - supply chain security, thresholds; in force since 6 December 2025
- European Commission: Guidelines on prohibited AI practices, C(2025) 5052 - emotion recognition in the workplace and in call centres (paragraphs 251 and 254)
- European Commission: Code of practice for general-purpose AI models - list of signatories (as of 7 October 2026), transparency chapter with model documentation form and 14-day commitment (measure 1.2)
- Datenschutzkonferenz: Guidance on artificial intelligence and data protection (German) of 6 May 2024 - selecting AI applications, training (margin number 24), information for the impact assessment (margin number 40)
- Datenschutzkonferenz: List of processing operations requiring a DPIA, version 1.1 (German) - no. 11, customer support by means of AI and mood analysis in call centres
- Public Buyers Community: Updated EU AI model contractual clauses (MCC-AI) - version for high-risk systems, light version and commentary of 12 February 2025
- Data Privacy Framework: List of certified organisations - check whether a US provider is covered by the adequacy decision
- Bitkom: Erstmals nutzt die Mehrheit der Unternehmen KI (German) of 14 September 2026 - 603 companies with 20 or more employees, AI use, obstacles and exposure to the AI Act
About the author
Michael Kaiser
Founder and owner of ArkeonTech, Aalen
Business informatics graduate (DHBW Heidenheim) with a bachelor's degree in Business Analytics from Aalen University, previously several years as an ERP consultant for mid-sized companies in Baden-Württemberg. He has run ArkeonTech in Aalen since September 2025.
Free tools on this topic
- AI Policy Generator AI policy in two minutes: approved systems, prohibited data, training, duties under GDPR, trade-secret law and the AI Act. As a Word file, free.
- AI Act Risk Checker Which risk class does your AI system fall into under the EU AI Act? Free compliance check with the concrete obligations per result - no signup.
Matching ArkeonTech service
AI process automation with a legal framework
One bounded process first, with a data processing agreement, EU hosting and the technical documentation the works council and the data protection officer want to see.
More Articles
-
Who Is Liable When AI Makes a Mistake? New Product Liability from December 2026
From 9 December 2026, manufacturers of AI software are strictly liable - Germany's new Product Liability Act, passed by the Bundestag on 8 October 2026, counts software and therefore AI systems as products. For users, less changes than the headlines promise: business damage remains a matter of contract. The real novelty is the manufacturer definition - anyone who offers AI under their own name or substantially modifies it becomes liable like a producer.
-
EU AI Act for AI Agents in Mid-Sized Companies: Which Duty Applies to Which Use?
Since 2 August 2026 the transparency duties of the EU AI Act apply. One table maps ten typical use cases in mid-sized companies to risk class, duty, deadline and responsible role.
