Third-party AI compliance is assessed by evaluating AI systems using a structured questionnaire, determining the risk class under the EU AI Act, and securing the results contractually. Companies that use AI tools from external providers share responsibility for their compliant operation and can themselves be held liable for violations. The following sections show what specific risks arise, what the EU AI Act requires, and what a systematic review looks like in practice.<\/p>\n\n\n\n
Third-party AI primarily poses risks in the areas of data protection, data security, discrimination, misinformation, and regulatory liability. Anyone who integrates external AI systems into their own processes effectively takes on a share of responsibility for their behaviour, without having internal control over training data, model architecture, or decision logic.<\/p>\n\n\n\n
Specifically, the risks can be divided into several categories:<\/p>\n\n\n\n
Particularly problematic is the fact that these risks often only become visible once damage has already occurred. A proactive review before introducing a third-party AI system is therefore not a formality, but a genuine protective instrument.<\/p>\n\n\n\n
The EU AI Act obliges companies as operators of AI systems to ensure that the systems they use comply with the legal requirements, even if those systems come from a third-party provider. Responsibility does not rest solely with the provider, but is shared between provider and operator.<\/p>\n\n\n\n
For operators of high-risk AI systems, the EU AI Act stipulates, among other things, the following obligations:<\/p>\n\n\n\n
In addition, the EU AI Act requires all operators, regardless of risk class, to ensure AI competence within the organisation (Art. 4 AI Act). This means: anyone deploying a third-party AI tool must possess the internal capability to understand, monitor, and critically scrutinise that tool. Structured AI training<\/a> is therefore not an optional extra, but a fundamental regulatory requirement.<\/p>\n\n\n\n A systematic assessment of a provider’s AI compliance takes place in four steps: risk classification of the system, document review, technical security assessment, and contractual safeguarding. This process should begin before the contract is signed and be repeated regularly.<\/p>\n\n\n\n Before assessing a provider, you need to understand which risk class their AI system falls into. The EU AI Act distinguishes between prohibited systems, high-risk AI, limited-risk systems, and minimal-risk systems. The higher the risk class, the stricter the requirements on the provider \u2014 and the more thorough the review must be.<\/p>\n\n\n\n Reputable AI providers supply technical documentation, risk assessments, and conformity evidence. If these documents are missing or incomplete, that is a serious warning sign. For high-risk systems, complete technical documentation is mandatory under the EU AI Act. Also check whether the provider publishes transparency reports and cooperates with national authorities, as required of platform providers under the Digital Services Act, for example.<\/p>\n\n\n\n AI tools should be updated regularly and sourced only from trustworthy providers. Check whether the provider implements state-of-the-art measures, secures the service against unauthorised access, and provides source references for AI-generated content. Automated decisions should in principle only be adopted after human review.<\/p>\n\n\n\n The compliance review must be reflected in the contract design. This includes clear provisions on data processing, allocation of liability, incident reporting obligations, and audit rights. Without a contractual basis, the compliance review remains ineffective.<\/p>\n\n\n\n An AI compliance questionnaire for suppliers should include questions on risk classification, technical documentation, data protection, security measures, human oversight, and certifications. The questionnaire serves as a structured tool for assessing a provider’s statements objectively and comparably.<\/p>\n\n\n\n The following question categories are specifically recommended:<\/p>\n\n\n\n A provider who answers these questions not at all or only evasively should be regarded with particular caution. The answers also form the basis for the contractual allocation of risk.<\/p>\n\n\n\n The depth and scope of the compliance review are directly determined by the risk class of the AI system in use. For high-risk AI, a comprehensive review including technical documentation, conformity evidence, and audit rights is required, whereas a basic review suffices for minimal-risk AI.<\/p>\n\n\n\n This is where the review is most extensive. Complete technical documentation, a functioning quality management system, evidence of datasets and training procedures, and CE marking must be demanded from the provider. As an operator, you must additionally implement your own measures: human oversight, log file retention, a data protection impact assessment, and information obligations towards affected individuals. An ISO\/IEC 42001 audit<\/a> can help identify gaps in your own AI management system before a high-risk system is introduced.<\/p>\n\n\n\n For these systems, transparency obligations are the primary focus. Users must know that they are interacting with an AI \u2014 for example, in the case of chatbots or AI-generated content. The review focuses on whether the provider fulfils these transparency obligations and has implemented corresponding labelling mechanisms.<\/p>\n\n\n\n For this category, the EU AI Act imposes no mandatory additional requirements. A basic review of data protection compliance and general security standards is nonetheless advisable. Providers can voluntarily establish a code of conduct, which can be regarded as a positive signal of reliability.<\/p>\n\n\n\n Responsibility for the third-party AI review typically lies with the AI compliance officer, in collaboration with IT management, the data protection officer, and procurement. In practice, this is a cross-functional task that involves several departments and requires a clear internal allocation of responsibilities.<\/p>\n\n\n\n Depending on company size and the AI systems in use, the following division of tasks is recommended:<\/p>\n\n\n\n What is crucial is that the review is not understood as a one-off event. AI systems continue to evolve, providers update their models, and regulatory requirements change. Regular review \u2014 at least once a year or whenever significant changes are made to the system \u2014 is therefore essential. Companies that have not yet defined clear responsibility for AI governance should address this as a first step before introducing further third-party AI systems.<\/p>\n\n\n\n Reviewing third-party AI requires in-depth knowledge of the EU AI Act, ISO\/IEC 42001, and practical assessment methods. This is precisely where mITSM comes in. As a specialised education provider with over 20 years of experience in IT training, we offer concrete support on several levels:<\/p>\n\n\n\nHow do you systematically assess a provider’s AI compliance?<\/h2>\n\n\n\n
Step 1: Determine the risk class<\/h3>\n\n\n\n
Step 2: Review documentation and transparency<\/h3>\n\n\n\n
Step 3: Assess technical security<\/h3>\n\n\n\n
Step 4: Clarify contracts and liability<\/h3>\n\n\n\n
What questions should an AI compliance questionnaire for suppliers contain?<\/h2>\n\n\n\n
\n
How does the compliance review differ depending on the AI risk class?<\/h2>\n\n\n\n
High-risk AI systems<\/h3>\n\n\n\n
Limited-risk AI systems<\/h3>\n\n\n\n
Minimal-risk AI systems<\/h3>\n\n\n\n
Who in the organisation is responsible for reviewing third-party AI?<\/h2>\n\n\n\n
\n
How mITSM supports you with third-party AI compliance<\/h2>\n\n\n\n