AI Vendor Due Diligence: Questions Irish Employers Should Ask Before Buying

AI vendor due diligence means asking a supplier the right questions before you buy or switch on an AI product, so you understand what happens to your data and what your own obligations will be. We did not find an official AI vendor checklist on the pages we read, and the Data Protection Commission's (DPC's) AI blog sets out points to consider rather than a formal questionnaire. This guide pulls together what the DPC, the European Data Protection Board (EDPB), the European Commission and the AI Act text say, and turns it into questions you can put to a vendor. The questions themselves are our suggestion. For the DPC's own starting guidance, see our summary of DPC guidance on AI and large language models.

Start with roles: who is the controller, who is the processor?

The DPC's page on controller and processor relationships explains that whether someone is a controller or a processor is a factual question assessed case by case. A controller defines the purposes and means of processing; a processor must only process personal data on the controller's documented instructions. The page says controllers are obliged to use only processors that provide sufficient guarantees, and that a legally binding contract is required.

For an AI product this raises the first question: does the vendor act only on your instructions, or does it also use your data for its own purposes, such as improving its models? The DPC's AI blog (18 July 2024) tells organisations to establish what personal data the system uses, how, where the data goes when a third party is involved, and whether the provider retains or reuses it. Ask for the answer in writing.

What the contract needs to say

According to the DPC, Article 28 of the GDPR prescribes provisions that must be included in a data processing contract. The DPC pages list minimum content such as the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the controller's rights and obligations. They also describe terms on processing only on documented instructions, confidentiality, security measures, help with data subject requests, breach notifications and impact assessments, deletion or return of data at the end, and audits. Neither page shows a publication date.

The DPC explains that a processor needs specific or general written authorisation before engaging a sub-processor, and that the controller can object to individual sub-processors where authorisation is general. So ask:

• Which sub-processors, including model or cloud providers behind the product, will see our data?
• Where is our data stored and processed?
• How will we be told about new sub-processors, and can we object?
• What happens to our data, prompts and outputs when the contract ends?

Questions drawn from the DPC's AI guidance

The DPC blog stresses that documentation should tell you, in an understandable and accessible form, what an AI product does with personal data. It also says an organisation should consider how it would meet access and deletion requests inside the AI system, set a retention schedule, and be alert to unwanted or unanticipated processing of personal data input to, or used to train, a model. Turning that into questions:

• Can the vendor help us respond to access or deletion requests involving data in the system?
• Are our inputs used to train or improve any model? Can that be switched off?
• What retention periods apply to prompts, outputs and logs?
• What security measures protect staff inputs, bearing in mind the DPC notes that inputs can create additional security or other data protection risks?
• What does the vendor say about accuracy, bias and the risk that a model reproduces training data?

The blog also says deploying AI may require a data protection impact assessment, and that doing one where it is not required would be best practice. Ask what information the vendor can supply to support yours.

Questions drawn from the EDPB opinion

The EDPB's news item on Opinion 28/2024 (dated 18 December 2024) says whether an AI model is anonymous should be assessed case by case by data protection authorities, and that the opinion offers a non-exhaustive list of methods to demonstrate anonymity. It also says that if a model was developed with unlawfully processed personal data, this could affect the lawfulness of its deployment, unless the model has been duly anonymised. The page mentions a three-step test for legitimate interest as a legal basis.

Our suggestion is to ask the vendor:

• What legal basis does it rely on for training data, and can it explain it?
• Does it claim the model is anonymous, and on what evidence?
• Has any regulator contacted it about training data?

The DPC's AI Insights Report page (dated 24 September 2026) describes the application of legitimate interests as a legal basis for AI training as one of a number of critical areas of focus for the DPC, and says early regulatory engagement is the most effective path to sustainable, responsible innovation. A vendor that has engaged with regulators may be able to say so.

Questions drawn from the AI Act

The Commission's "Navigating the AI Act" page (last update 7 August 2026) distinguishes providers, such as the developer of a CV-screening tool, from deployers, such as a bank using it. In the Commission's example, the bank that uses the CV-screening tool is the deployer; if you buy a product to use it in your business, you are likely to be in the deployer position, but check how the Act defines the roles. For high-risk systems the page says providers must carry out a conformity assessment, implement a quality management system, register the system in a public EU database, and report serious incidents. Deployers must use the system according to the instructions of use, assign human oversight to a person in their organisation, monitor it, and inform affected employees and workers' representatives beforehand where it is used in the workplace.

The Commission's AI Act page (last update 3 August 2026) says rules for high-risk systems in areas such as employment will apply from 2 December 2027, after the Digital Omnibus, which it says entered into force on 27 July 2026. Check the current position. Questions to ask:

• Does the vendor consider the product high-risk under the Act? On what basis?
• If so, what is its plan for the provider obligations, and when?
• What instructions of use and technical information will it give us?
• What support does it offer for human oversight, logging and incident reporting?
• Does any feature infer emotions in a workplace setting? The consolidated Article 5(1)(f) prohibits using AI systems to infer emotions in workplaces and education institutions, with an exception for medical or safety reasons.

For the deployer side, see our guide to AI Act deployer obligations and human oversight.

Platform products and permissions

With assistants built into productivity suites, the risk often sits in your own settings rather than the vendor's promises. Our guide to Microsoft 365 Copilot data governance and permissions covers that angle. In due diligence terms, ask who can see which data through the assistant, and how access is controlled.

Making the answers usable

• Put the questions in a short questionnaire and keep written answers.
• Record the date and the product version you assessed.
• Reassess when the vendor changes its terms, models or sub-processors.
• Involve whoever handles data protection early.

These steps are our suggestions, not legal requirements.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is there an official AI vendor checklist?

The pages we read do not provide one. The DPC's AI blog sets out points to consider and does not include a checklist, so treat the questions here as a starting point of our own.

Do we need a data processing contract with an AI vendor?

The DPC says the GDPR requires a legally binding contract when a controller engages a processor to process personal data on its behalf. Whether a vendor is a processor depends on the facts, as the DPC explains.

Does the AI Act make the buyer responsible?

It can. Deployers have their own duties for high-risk systems, according to the Commission, including human oversight and informing affected workers. Which duties apply depends on how the system is classified.

Can a vendor's assurances replace our own assessment?

The DPC's blog says organisations should understand how personal data is protected when they use a third-party product, and suggests a DPIA may be needed. A vendor's answers inform your assessment but do not replace it.

Good due diligence is mostly about getting clear, written answers early, while you can still change your mind.