Ask about the service you will actually use.
Identify the product, relevant features, supplier entity and any model or API dependencies disclosed by the supplier. Explain your intended purpose, users and data categories before sending a questionnaire. The answer to a broad security question may be insufficient for a sensitive use case.
Keep product facts distinct from promises in a proposal. Where a capability depends on a particular plan, region or configuration, record that limitation in the review.
Request evidence that supports specific decisions.
Useful questions address the system's limitations, evaluation context, data handling, access arrangements, incident communications and change notices. Ask what information is available, who produced it and when it was last reviewed. Avoid treating an unsupported compliance claim as a complete assurance response.
- Intended use, limitations and required human review.
- Treatment of inputs, outputs and customer information.
- Relevant security and service documentation.
- Subcontracting, support access and change notification.
Document gaps and contractual dependencies.
Some unanswered questions are commercial, some technical and some require legal interpretation. Assign each to an appropriate reviewer and record whether it prevents approval. If the supplier will not provide a document, consider whether alternative evidence answers the same question rather than repeatedly requesting a generic pack.
The final decision should state the approved use, conditions, outstanding actions and review date. Contractual commitments should be checked against the actual agreement, not inferred from a website.
Review the supplier when the dependency changes.
A new model version, changed data terms or altered service ownership can affect a previously accepted position. Define the notices you expect, how they reach the system owner and which events reopen review. Link one supplier change to all affected use cases where appropriate.
An EUAIC scope can include the review structure, evidence index and ownership process. The organisation remains responsible for its procurement decision and for confirming that the evidence fits its own deployment.