Before You Buy: The AI Transparency Questions to Ask Any Vendor

← Back to Blog

Small organisations rarely build AI. They buy it — a subscription here, a new feature switched on there. But under the EU AI Act, the moment you put a bought-in AI tool to use, you usually become its deployer, and a set of duties lands on you that no supplier's marketing can take away. The cheapest protection is a short list of questions asked before you sign.

This article gives you that list — organised around the four questions that matter most, in language you can paste straight into an email to a vendor. It's written for the person choosing the tool, not for a procurement department you don't have.

Why the vendor's promises aren't enough

The AI Act splits responsibility between providers (who build or supply AI) and deployers (who use it under their own authority). Almost every charity is a deployer. And the key point is this: deployer duties are yours, not the vendor's. When you use AI to draft a decision letter, screen an application or answer a service user, the obligation to be transparent about that AI — and to keep a human meaningfully in charge — sits with your organisation, whatever the contract says about the supplier's own compliance.

That's not a reason to avoid AI. It's a reason to buy it with your eyes open. A vendor who can answer plain questions clearly is a vendor who has done the work. A vendor who can't — or won't — is telling you something too.

The deadlines moved — the questions didn't

You may have heard that some AI Act deadlines slipped. That's true: the 2025 Digital Omnibus simplification package deferred the main high-risk obligations — for stand-alone systems to 2 December 2027, and for AI embedded in regulated products to 2 August 2028. But two things are unchanged and already live: the Article 4 AI-literacy duty and the Article 5 prohibitions have applied since February 2025, and the Article 50 transparency duties still arrive on 2 August 2026. A later high-risk deadline doesn't make a tool safer to buy today — it just gives you time to buy it well.

You can outsource the software. You can't outsource being able to explain what it does to the people it affects.

The four questions to ask before you sign

These map to the four pillars Vedomia uses for transparency — Visibility, Sequence, Justification, Auditability. Ask them in writing, and keep the answers.

1. Visibility — what is the AI, and what does it actually do?

• Which parts of your product use AI, and what does each do — generate text, score, rank, match, predict, recognise?
• Will people interacting with us (service users, applicants, donors) be dealing with AI at any point? If so, where?
• Does any feature infer emotions, or categorise people using biometric data? (If yes, this needs a careful check — see our note on prohibited practices.)

2. Sequence — what data goes in, and where does it go?

• What data does the AI process, and is any of our service users' personal or sensitive data used?
• Is our data used to train your models or anyone else's? Can we opt out?
• Where is the data processed and stored — EU or elsewhere?

3. Justification — can decisions be explained, and does a human stay in charge?

• When the AI produces an output that affects a person, can you explain why in plain terms?
• Does the tool support human review before an output is acted on — and can we configure that?
• How often is the AI wrong, and how does it behave when it's unsure — does it flag, or does it guess confidently?

4. Auditability — what evidence is left behind?

• Does the system keep logs of what the AI did and when, and can we export them?
• Can you provide documentation and instructions for use we can keep on file?
• Will you tell us when the AI is materially changed or updated?

Turn the answers into one page you keep

You don't need a procurement system. One short record per AI tool — filled in from the vendor's written answers — is enough to show you looked before you bought, and to remind you later what you agreed. Keep it wherever your other governance notes live.

Four answers that should give you pause

• "It's proprietary, we can't say." Fair for the internal maths — not for what the tool does with your data or your people.
• "Compliance is fully handled on our side." A vendor can't discharge your deployer duties. Be wary of anyone who says they can.
• "There are no logs." If nothing is recorded, you can't show a human was in charge or reconstruct what happened.
• Vague answers on training data or data location. These are basic facts a serious supplier knows. Vagueness here is a signal.

How Vedomia can help

Vedomia is an Irish company focused on one thing: helping organisations make their processes and their use of AI visible, explainable and auditable. We work mainly with charities, nonprofits and publicly funded organisations.

Choosing AI well rests on the same foundation as every other AI Act duty: knowing exactly where AI sits in your organisation and what each tool really does. That's where we start.

• Transparency Self-Audit (free). Around 20 questions across four pillars — Visibility, Sequence, Justification, Auditability. It helps you surface where AI is used and where you're thin on understanding, review and evidence.
• Mapped with you (€1,450, one-off). A single 90-minute session: you describe how one key process really runs, Sandra maps it live, and you leave with a finished, official document — the process end to end, where AI enters it, the evidence to keep and a prioritised 30–90 day plan. No homework, and it begins with a free Clarity Call.

To be clear about what we do and don't do: Vedomia supports readiness, helps you document your AI use, and identifies transparency gaps. We do not certify compliance, we do not vet or approve any particular vendor, and nothing we provide guarantees legal conformity. This is not legal advice.

The best moment to understand an AI tool is before you depend on it. A short email of plain questions, answered in writing and kept on one page, is the cheapest due diligence there is — and the record you'll be glad to have.