Step 4
By the end you will have a file for each vendor with what you asked for, what you received, on which date and what is still open.
Every system in your inventory has someone behind it who develops or markets it. This step is about asking each of them, in writing, for the information you need to use their system with sound judgement, and about keeping whatever they send in a way you can still find in a year’s time.
What to ask is covered elsewhere: the ten questions of a proper due diligence have their own article, linked at the end. This chapter does not repeat them. It deals with the procedure: who receives the questionnaire, at what point, what gets filed, how it fits with the data processing agreement and what you do when the vendor does not answer.
You work vendor by vendor, not system by system. If three tools come from the same maker, that is one questionnaire and one file, with the three systems linked to it. And you start from the list Step 1 left you: the vendor column of the inventory is your mailing list.
The obligations that Regulation (EU) 2024/1689 places on the provider remain the provider’s. For high-risk systems, the quality management system (Art. 17), the keeping of documentation (Art. 18), post-market monitoring (Art. 72) and the technical documentation in Annex IV are theirs; and providers of general-purpose AI models have obligations of their own (Arts. 53 to 55). Asking for documentation does not move those obligations onto your organisation, nor does it make you their supervisor.
Recording each vendor and what it has given you is an internal methodological control, not a legal obligation: diligence of your own. If the provider offers a general-purpose AI model, filing the documentation it publishes is internal documentary diligence for you. Its value is practical: the vendor’s documentation is the raw material for the classification in Step 3, the policy in Step 5 and the oversight of each system.
One part is a legal obligation with an explicit mandate: where the vendor processes personal data on behalf of your organisation, Article 28 of the GDPR requires you to use only processors providing sufficient assurances to implement appropriate technical and organisational measures, and to govern that processing by a contract or other legal act with the content set out in its paragraph 3. The questionnaire and the data processing agreement are two separate pieces of the same file: the first informs your judgement, the second binds the vendor to you.
The controls in the Alethexis catalogue that correspond to this step, each with its nature: legal obligation, good practice or internal control.
Collect and file the documentation the GPAI model provider publishes in support of Articles 53 to 55 (model card, copyright policy, training-data summary, DPA). For the deployer this is internal documentary due diligence; it is not a substantive obligation arising from Articles 53 to 55.
Legal basis
No direct basis in law.
For each system, identify whether it uses or embeds a general-purpose AI model (ChatGPT, Claude, Gemini, Llama, Mistral and the like) and record the provider and the model version. This enables GPAI documentary due diligence for the deployer and the assessment of downstream obligations.
Legal basis
No direct basis in law.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.
Sort the list by what each vendor handles: those dealing with personal or customer data first, then the rest. Send each one the same questionnaire, to a named contact person, and note the date you sent it and the deadline you give; two weeks is reasonable. Many large vendors publish their DPA and their documentation on their trust portals: download them and record them instead of waiting for someone to send them.
For each vendor keep the answer to the questionnaire, the instructions for use, the technical sheet or model card if there is one, the data processing agreement with its date and, if the system relies on a general-purpose AI model, the documentation its provider publishes. Each item with the date you received it and the system it belongs to. A link to a portal changes without warning; a dated copy does not.
Compare what you received with what you asked for. Whatever is missing is requested once more, in writing, with a new date. If the vendor still does not reply, note it in the file: what you asked for, when, what they said and what you decide, whether to keep using the system within limits, look for an alternative or escalate it to whoever decides in your organisation. A record of what was requested and is still pending is also evidence of diligence.
Treating the step as done when the first answer arrives.
A sales answer is not documentation. “We have a whitepaper” or “don’t worry about that” will not help you classify a system or decide how to oversee it. The questionnaire is closed when every answer has a document or a written commitment behind it, and whatever lacks one is marked as open, with a date. The opposite mistake is common too: not recording the large vendors because everyone assumes they have it all. They are recorded all the same, at least those behind the systems in your inventory; their documentation is usually published and you only need to file it.
A completed sample AI vendor questionnaire, with fictitious data: the one a dental clinic sends to the vendor of its diagnostic imaging system, with the answers and what remains open. It shows what a closed file looks like before you open yours.
AI vendor questionnaire, completedOne calendar week, mostly spent waiting, between days 13 and 22. Your own work is two or three hours to send the questionnaires and about as much again to file what comes back and chase what is missing.
A dated file for each vendor: the questionnaire sent and its answer, the documentation received, the data processing agreement where personal data is involved and the list of what is still open, with the date of each reminder.
In Alethexis, each vendor has a record in three blocks —identification, nature and documentation, with the data processing agreement, its date and what you have received—, and from the inventory you link each system to its vendor, so you can see which vendor stands behind which system and what is still to be requested.
The platform calculates a diligence score from 0 to 100 with a line-by-line breakdown, which is not a legal compliance rating but a tool to decide which vendor to chase for documentation first; the optional 12-question qualitative questionnaire informs, but does not change the score.