In short: customers that use your AI become deployers under the EU AI Act, with their own duties. To meet them, they need evidence from you: how your AI is classified, what it is for, how risk, data, oversight and changes are governed. SMEs that keep this evidence ready close deals faster.
Why customers ask about your AI
When an enterprise buys an AI system, the EU AI Act usually makes it a deployer. If the system is high-risk, the deployer must use it according to the provider's instructions, assign people with the competence to oversee it, monitor how it works, keep the logs it controls and inform workers when AI is used at work (Article 26). Some deployers, including those using AI to assess creditworthiness or to price life and health insurance, must also carry out a fundamental rights impact assessment before first use (Article 27).
None of this is possible without information from the supplier. So the questions travel down the supply chain, into vendor questionnaires, security reviews and contract annexes. Other rules add to the list: GDPR for personal data, and for banks and insurers, rules on ICT third-party risk such as DORA.
The result is commercial before it is legal. The high-risk date is 2 December 2027, but a supplier that cannot answer today waits longer in procurement, or loses the deal.
The questions customers ask, and how to answer them
Every customer phrases it differently, but most questionnaires about AI come back to the same eleven questions:
| What the customer asks | What answers it | EU AI Act reference |
|---|---|---|
| Is your AI system high-risk under the EU AI Act? | Risk classification record with reasoning | Article 6, Annex III |
| Are you the provider, and what are we as the deployer? | Role map per AI system | Articles 3, 25, 26 |
| What is the system for, and what are its limits? | Intended purpose and instructions for use | Article 13 |
| How do you identify and manage risk? | Risk management record and risk register | Article 9 |
| What data was it trained on, and how is bias examined? | Data governance record | Article 10 |
| Where do humans stay in control? | Human oversight design | Article 14 |
| What do you log, and for how long? | Record-keeping and log policy | Articles 12, 19 |
| How accurate and robust is it? | Accuracy, robustness and cybersecurity results | Article 15 |
| What happens when the model or the rules change? | Change log and reassessment process | Articles 43, 72 |
| How are serious incidents handled? | Incident and reporting procedure | Article 73 |
| Who is accountable for AI in your company? | Governance policy, quality management, AI literacy | Articles 4, 17 |
Not every question applies to every system. A minimal-risk tool needs far less than a high-risk one, which is why the risk classification comes first.
HR software: what customers focus on
AI that recruits or selects people, filters applications, evaluates candidates, or makes decisions on promotion, termination, task allocation or performance monitoring is high-risk under Annex III point 4. HR customers focus on bias examination and data quality (Article 10), meaningful human review of decisions (Article 14), and how candidates and workers are informed. In the Netherlands, works councils often have a say over systems that monitor or assess staff, so customers may also ask for material they can share internally. See the full EU AI Act guide for HR AI.
Finance software: what customers focus on
AI that evaluates the creditworthiness of people or sets their credit score is high-risk under Annex III point 5(b). So is AI used for risk assessment and pricing in life and health insurance, under point 5(c). AI used only to detect financial fraud is excluded from point 5(b). Banks and insurers buying these systems ask about explainability of individual decisions, model change control and how the supplier fits their ICT third-party risk framework. See the EU AI Act guide for fintech.
Start with what applies. Many suppliers over-document low-risk tools and under-document the one system that is high-risk. A clear risk classification per system is the fastest way to give customers the right answer.
How Aurora Trust helps
Aurora Trust is self-serve AI governance for SMEs. On the live platform you can:
- Identify which AI requirements apply to each system, and whether you are the provider, the deployer or both.
- Assess the risk of each system and see which evidence is missing.
- Document with structured technical documentation and documents you can share with customers.
Coming next: monitoring and reassessment, so your evidence stays current as rules and your AI change. Plans start at €49 per month. See pricing.
Frequently asked questions
What do customers mean by AI governance?
AI governance evidence is the set of records that shows how a company understands and controls the risk of an AI system: a risk classification, a map of the requirements that apply, technical documentation, data governance and bias examination records, human oversight design, logs and a process for changes and incidents. Enterprise customers ask for it during procurement to check that an AI supplier is governed.
Why do customers ask suppliers about the EU AI Act?
Because customers carry their own duties. A company that uses a high-risk AI system is a deployer under the EU AI Act and must use it according to the provider's instructions, assign human oversight, monitor it and keep logs (Article 26). Some deployers, such as those using AI for credit scoring or life and health insurance pricing, must also assess the impact on fundamental rights (Article 27). They need information from the supplier to do this.
Is an AI questionnaire a legal requirement?
No law prescribes one standard questionnaire. Customers design their own, usually alongside security and privacy due diligence. The questions are shaped by the EU AI Act, GDPR and, for financial institutions, rules on ICT third-party risk such as DORA.
When do EU AI Act high-risk obligations apply?
Annex III high-risk obligations, which cover most HR and credit AI, apply from 2 December 2027 under the EU Digital Omnibus (Regulation (EU) 2026/1744). Transparency obligations under Article 50 have applied since 2 August 2026. Many enterprise customers already ask for governance evidence now, ahead of the legal date.
Can software answer a customer's AI questionnaire for us?
Software can do the repeatable part: classify each system, map the requirements, keep structured records and show where evidence is missing. It should not make legal judgements. Aurora Trust supports the repeatable governance work; questions that need legal judgement belong with qualified legal counsel.
This guide is general information, not legal advice. Last reviewed 27 October 2026.