GDPR + EU AI Act

Vendor & AI Supplier Assessment Kit: check before you sign.

Every supplier that touches your data, and every AI tool your team uses, is your responsibility under the GDPR. This kit gives you a structured way to check them before you sign, and to document that you did.

Notion template Word · Excel · PDF

Price: €29.99
Formats: Notion template or Word, Excel & PDF
Languages: EN, DE, NL, ES, HR — country editions adapted to national law
Access: Instantly after purchase, one-time payment

GDPR + EU AI Act

What's in the kit

Supplier Questionnaire — ready-to-send questions on data protection, security, sub-processors, AI, continuity and exit
Assessment Guide — how to rate answers, typical red flags and how to decide
DPA Checklist — the minimum content of a data processing agreement under Art. 28(3) GDPR
Supplier Register — every supplier with its role, data, location, contract status and next review
Assessment Log — each assessment with ratings, evidence, decision and conditions
EU rules at a glance — GDPR, international transfers, EU AI Act and NIS2 supply-chain duties

The rules it covers

Choosing processors (Art. 28)
You may only use processors that give sufficient guarantees, and you need a contract with the content Art. 28(3) GDPR requires.
Transfers outside the EU
Suppliers in third countries need a transfer basis, such as the EU–US Data Privacy Framework or standard contractual clauses.
Supply-chain security
Businesses in scope of NIS2 must manage the security of their suppliers. The kit's questionnaire covers the questions that matter for that too.

Made for

Businesses buying SaaS and AI tools
Procurement and operations teams
IT and data protection coordinators
Agencies working with subcontractors

Two editions, same price

Choose how you want to work. Content and price are the same.

Notion template Word · Excel · PDF

Questions about this kit

What has to be in a data processing agreement?

Art. 28(3) GDPR lists the minimum: processing only on your instructions, confidentiality, security measures, rules for sub-processors, help with requests and breaches, deletion or return at the end, and audits. The DPA checklist walks through each point.

Do I need to assess big providers like Google or Microsoft?

Yes, but differently. You will not get answers to a custom questionnaire, so you assess their published terms, DPA and certifications instead. The guide shows how to document that.

Does this help with AI tools?

Yes. The questionnaire asks AI-specific questions, such as whether your data is used for training, where it is processed and how outputs are checked, and the register records the AI Act risk tier.

Other kits

Templates

GDPR Compliance Kit GDPR
AI Compliance Toolkit EU AI Act + GDPR
AI Workplace Policy Pack EU AI Act + GDPR
EU Pay Transparency Kit Directive (EU) 2023/970

Need more than one kit?

This kit is part of the EU Compliance Bundle: all five kits for €69.99 instead of €149.95.

See the bundle All templates

The kits are organisational tools and a practical starting point. They do not constitute legal advice and do not guarantee compliance with the GDPR, the EU AI Act or any other law.