October 4, 2026
Responsible AI vendor in the EU: how to pick one
Responsible AI vendor in the EU: how to pick one
"Responsible AI" is easy to claim and hard to verify. These questions separate a vendor with a real commitment from one with a marketing page. The red flags tell you when to walk away.
Questions to ask
- Where does the data go? A responsible EU vendor tells you, in one sentence, where your data is processed and whether it leaves the EU. "Trust us" is not an answer.
- Do they disclose their own AI use? A vendor selling AI compliance or responsible AI should have an AI-use statement on its own site. If it does not, ask why. That statement is now a legal obligation, not a nice-to-have.
- What happens to your data? Is it used to train their models? Do they delete it? Can you get it back? A responsible vendor answers all of that without being asked.
- Is their output auditable? If the AI makes a decision that affects you, can you see why? "The model said so" tells you enough.
Red flags
- No privacy policy, or one that does not mention AI or automated decision-making.
- Pricing or data flow that makes sense only if your data is being resold.
- No human point of contact for a request to correct or delete your data.
- A compliance claim with no date, no named regulation, and no way to check it.
Why this is self-interested
Under the AI Act, a business that deploys a third-party AI still carries the transparency obligations that sit with the deployer. A vendor that handles its side badly leaves you answering for it.
Our own practice
We publish a plain-English statement of how we use AI. Our privacy policy names AI and automated decision-making. The private-AI services (Private AI Stack, Private AI Install) exist for businesses that want the AI on their own infrastructure. If that is you, start there.
This page is general information, not legal advice.