EU AI Act readiness: evidence questions for suppliers

The EU AI Act creates a risk-based legal framework for AI in the European Union. Obligations vary according to the system, role and context. That makes broad claims such as “EU AI Act compliant” a poor basis for selecting a governance platform.

A better procurement approach begins with the work the organisation must perform: identify relevant AI, establish its role, classify and document it, assess applicable obligations, implement controls, monitor changes and retain evidence. The supplier should then demonstrate where its product supports that work.

1. Can the product establish scope and role?

Readiness begins by knowing which systems are in use and how the organisation relates to them. A company may develop, provide, deploy, import or distribute an AI system, and the applicable duties can differ. Product records should therefore capture more than the name of a model.

Ask whether the platform can record intended purpose, owner, provider, deployment context, affected users, geography and lifecycle state. Also ask how it deals with AI discovered outside the formal intake process.

2. Can it support classification without hiding judgement?

Classification workflows can improve consistency, but the result should remain explainable. Buyers should be able to see the questions, evidence, decision owner, legal or policy basis and any uncertainty or exception.

3. Can it connect obligations, controls and evidence?

A mapping table is useful only when it stays connected to actual controls and current evidence. Ask how the product links a requirement to a responsible owner, control, test, evidence item, review date and remediation task.

Evidence should be versioned and attributable. If a policy, model, dataset, intended use or permission changes, the organisation should be able to determine whether the existing assessment remains valid.

4. Can it govern change across the lifecycle?

AI systems are not static. Models are updated, prompts change, tools are added and business use expands. A useful governance platform should detect or record material changes and route them for review. It should also support suspension, retirement, owner changes and periodic reassessment.

For agentic systems, this includes changes in effective permissions and connected tools. A seemingly small connector change may materially alter what an agent can do.

5. What can it monitor after deployment?

Post-deployment governance may require monitoring performance, incidents, drift, human oversight, access and control effectiveness. The right scope depends on the use case and risk. Ask which signals are collected natively, which arrive through integrations and which remain manual attestations.

It is also important to separate alerting from enforcement. A platform may identify a problem but rely on an identity, security, data or workflow system to restrict activity.

6. Can it produce a coherent decision record?

The strongest evidence connects the system, role, classification, assessment, obligations, controls, approvals, changes, incidents and remediation. Buyers should request a demonstration of that chain for one realistic system rather than relying on screenshots of separate dashboards.

A practical demonstration scenario

1. A previously unknown AI agent is discovered.
2. An owner and intended purpose are assigned.
3. The agent’s data, tools and permissions are mapped.
4. Applicable policy and regulatory questions are completed.
5. A control gap creates a remediation decision.
6. The corrective action is implemented and verified.
7. The final evidence package shows the complete history.

This scenario tests whether the product supports an end-to-end governance process. It also reveals where integrations, manual work or separate specialist tools are required.