Is a customer asking what you do with AI?
Supplier questionnaires now have a section on artificial intelligence: which tools, which data, which providers. This guide explains why you are asked, what you will be asked, and what the EU AI Act already requires.
Why your customer asks
Your customer answers for its data under the GDPR, and for its own use of AI under the AI Act. When you process its data with an AI tool, that tool becomes a link in its chain: it needs to know which one, where, and with what safeguards. The questionnaire is how it checks.
What you will be asked
Questions vary from one customer to the next, but they almost always come down to these eight. For each one, here is what answers it.
Which AI tools do you use, and for what?
The list of tools (writing, coding, support assistants…) and what each one is used for.
What data do you send them?
The categories of data that may go into each tool, and those you exclude, especially your customers’ data.
Is our data used to train a model?
For each tool, what the contract or settings provide: training turned off, how long prompts are kept.
Where is our data processed?
The processing region of each AI provider, and whether data leaves the EU.
Are your AI providers listed as subprocessors?
Your current subprocessor list, including the AI providers that process personal data.
Who reviews what the AI produces?
The steps where a person checks the output before it goes to a customer or feeds a decision.
How is your staff trained?
The measures you take so your teams know how to use AI and know its limits: internal rules, training, resources.
Do you tell your users when AI is involved?
If your customers talk to an automated assistant or receive generated content, how you tell them.
The declaration template follows these eight points, one section each. Start from the declaration template
Answer once, not for every customer
These questions will come back with every new customer. Publish an AI usage declaration on your trust center and add your AI providers to your subprocessor list: you send a link, and every version stays dated as your tools change.
What the AI Act requires, and when
Regulation (EU) 2024/1689 applies in stages. These are the dates that matter for a company that uses AI tools, as amended by Regulation (EU) 2026/1744, which postponed part of it.
2 February 2025
Prohibited AI practices (Article 5), and the duty to take measures supporting your staff’s AI literacy (Article 4).
2 August 2026
Transparency obligations (Article 50): telling people they are interacting with AI, disclosing deep fakes.
2 December 2027
Rules for high-risk systems in Annex III, such as recruitment or credit scoring. Postponed: they were due on 2 August 2026.
2 August 2028
Rules for AI built into products that are already regulated (Annex I). Postponed as well.
Whether a given use is high-risk, or whether you are a provider rather than a deployer of a system, takes a case-by-case analysis. This page does not do it: the text and the Commission’s guidance are the sources to check.
The AI Act on EUR-Lex (opens in a new tab)Frequently asked questions
- Does using ChatGPT or Copilot make me a “provider” under the AI Act?
- Usually not: you are then a “deployer”, a professional user of a system someone else provides. You become a provider when you develop an AI system, or have one developed, and place it on the market or put it into service under your own name.
- Do I need a certification?
- For everyday use of AI tools, the AI Act does not require one. Conformity assessments concern high-risk systems, from December 2027. A customer may still ask for a standard such as ISO/IEC 42001.
- Does my declaration have to be public?
- No. You can publish the list of tools and keep the details of settings and contracts for the customers you grant access to.