EU AI Act Vendor Screening · Guides
Annex III deadline 2 Dec 2027 — buyer checklist
Stand-alone Annex III high-risk rules apply from 2 December 2027 under the AI Omnibus. Deployers buying AI in 2026 still need diligence they can show later.
What changed
Following the AI Omnibus / Digital Omnibus amendments, rules for high-risk AI systems listed in Annex III of Regulation (EU) 2024/1689 apply from 2 December 2027. Annex I product-embedded high-risk systems follow on 2 August 2028.
Primary refs: AI Act Service Desk implementation timeline and Commission notes on the AI Omnibus entering into force.
Buyer checklist
1. Write the intended purpose in one plain paragraph — Article 6 starts here. 2. Ask whether the use hits an Annex III domain; do not trust vendor marketing labels alone. 3. Require evidence (contract terms, technical records), not sales slides. 4. List deployer duties you cannot contract away (human oversight, logging, incident reporting themes). 5. Export a dated diligence record before signature.
Is 2 December 2027 the only date that matters?
No. Prohibitions and several transparency rules already apply. Annex III is the high-risk cliff most procurement teams plan around — verify live timelines before board slides.
Does VendorVet certify compliance?
No. It is decision-support vendor screening for deployers — not a conformity certificate.
Decision-support only — not legal advice. Verify against EUR-Lex and current Commission guidance.