EU AI Act Vendor Screening
Methodology: AI draft · human review · auditable record
VendorVet is a deployer-side EU AI Act vendor-screening assistant. It is decision-support — not legal advice and not a conformity certificate.
1. What the rules engine owns
Classification against Annex III / prohibited practices, question selection, evidence-weighted scoring, hard stops, contract-gap flags, and non-transferable deployer duties (Articles 26–27 themes) are produced by deterministic rules with cited refs. These steps run without a live LLM key.
2. What optional AI may do
When a platform or BYOK key is configured, the model may polish a short procurement narrative that summarises the engine output. It must not invent certifications, audit results, or a pass/fail legal determination.
3. What the human must do
- Resolve unsupported answers and hard stops.
- Decide accept / conditional / reject.
- Have counsel review contract inserts before signature.
This matches the Act’s expectation of meaningful human oversight and our R83 honesty red line: we never silently present demo output as live AI.
4. What we deliberately do not do
- Broad TPRM across NIST CSF / SOC 2 / ISO 27001 / DORA / NIS2 / HIPAA / PCI DSS.
- Company-registry, sanctions, or litigation OSINT.
- Continuous security ratings or trust-center hosting.
5. Deadlines we cite
Stand-alone Annex III high-risk obligations apply from 2 December 2027 under the AI Omnibus / Digital Omnibus amendments; Annex I product-embedded high-risk from 2 August 2028. Primary refs: AI Act Service Desk timeline and Commission Digital Strategy updates.