Why the questions are arriving
The EU AI Act (Regulation (EU) 2024/1689) entered into force in August 2024 and applies in stages. The banned practices and AI literacy came first, in February 2025. The rules for general-purpose AI models followed in August 2025, and the transparency duties in August 2026. AI systems that were already on the market by then have until December 2026 to mark the content they generate in a machine-readable way.
The Digital Omnibus, the amendment that came into force in July 2026, changed three things a vendor will be asked about. It moved the high-risk obligations to December 2027 for the listed high-risk uses and to August 2028 for AI built into regulated products. It softened the AI literacy duty: providers and deployers must take measures that support their staff's AI literacy, rather than ensure a sufficient level for each person. And it added two prohibited practices from December 2026: AI that generates intimate images of a real person without consent, and AI that generates child sexual abuse material.
Most of your customers are deployers under the Act: they use an AI system in their own work, and they must know enough about it to use it within the rules. Their procurement and security teams have added an AI section to the vendor questionnaire to find that out, and it reaches every vendor whose product drafts, scores, summarises or recommends anything.
What an AI Act questionnaire asks
The questions vary by customer, but the same topics come back:
- Which features use AI, what each one does, and whether a customer can switch it off.
- Your role: whether you are the provider of the AI system, and which general-purpose model providers you build on.
- The risk class: whether any use is a prohibited practice or falls under the high-risk list, and how you reached that conclusion.
- Transparency: whether users are told they are working with AI, and whether generated content is marked as such.
- Customer data: whether prompts, documents or outputs are used to train any model, where they are processed and how long they are kept.
- Human oversight: whether a person reviews the output before it is used, and whether they can correct or override it.
- Accuracy and testing: how you evaluate the output, how you handle known failure modes, and what you log.
- Governance: who is accountable for AI in your company, whether you have an AI policy or follow ISO 42001, and what you do for your own staff's AI literacy.
Answering as a vendor
Start with an inventory, one entry per AI feature: what it does, which model and provider it calls, what data is sent, whether anything is retained or used for training, who reviews the output, and its risk class with the reasoning in a sentence. Five features fit on one page, and every row in the AI section is answered from it.
Two answers need a decision rather than a fact. The first is your role statement: what you provide, what the customer decides, and where the customer's own duties as a deployer begin. The second is the risk classification. "Not high-risk" is a complete answer only when it names the use and the reason, for example "drafts answers for review by the customer's staff; not a use listed in Annex III". Agree both with whoever signs your contracts, so the questionnaire and the contract say the same thing.
The AI section overlaps with two you already answer. Training on customer data, processing locations and sub-processors are GDPR questions asked again for the AI providers, and logging, access and incident handling are the security answers you already have. Answer from the same text in both places.
The answers, and your own AI
The AI Act answers live in the knowledge base like any other approved answer, with the inventory and your AI policy attached as evidence with review dates, and each questionnaire is drafted from them in the customer's words. Responsemate is itself an AI product, so its own answers are a working example: every draft shows its sources and a confidence score and waits for a person to approve it, the AI provider and model are the customer's choice, and no customer content trains a model. The AI usage report shows the sources used. Responsemate's own AI and data handling.
Questions people ask
Does the EU AI Act apply to a SaaS vendor outside the EU?
Yes, when the AI system is placed on the EU market or its output is used in the EU. A vendor in the US or the UK selling to EU customers is in scope for the systems those customers use.
Is our product high-risk under the AI Act?
Probably not. High-risk is a defined list of uses, such as recruitment, credit scoring, access to education or essential public services, and safety components of regulated products. Drafting text, summarising documents or searching a knowledge base is not on it. Say which category you are in and why, in one or two sentences.
The high-risk deadline moved to 2027. Can we wait to answer?
No. The delay applies to the high-risk obligations, and most B2B software is not high-risk anyway. The prohibited practices, the transparency duties and the rules for general-purpose AI models already apply, and your customers are collecting vendor answers now, for contracts that will run well past 2027.
Do we need ISO 42001 to answer an AI Act questionnaire?
No. ISO/IEC 42001 is a voluntary standard for an AI management system, and a certificate is useful evidence, but the questionnaire can be answered without it. Customers ask whether you have it the way they ask about ISO 27001.