Deployers remain liable even when the model comes from OpenAI, Microsoft, or Salesforce. VDF AI Compliance scores vendors, maintains a risk register, and enforces approved lists for regulated workflows.
EU AI Act Article 28 places compliance obligations on deployers of high-risk AI — even when the model is third-party. Standard SaaS contracts do not cover these obligations. Most companies have no vendor AI risk program.
Collect public compliance evidence for each vendor, deliver structured questionnaires on risk classification, bias testing, data governance, and incident notification, then score results against an Article 28 rubric. Approved vendor lists feed directly into deployment policies.
Gathers public documentation, certifications, and compliance statements.
Structured due diligence covering bias, governance, oversight, and logging.
Scores each vendor against EU AI Act Article 28 requirements.
Maintains Vendor Risk Register and approved vendor policy lists.
Addresses EU AI Act Art. 28, Art. 55, DORA Art. 30, and ISO 42001 Clause 8.6 with scored profiles and evidence links.
In-house AI agents let enterprises build controlled AI capability without creating a large model engineering team. VDF AI Networks supports private deployment, domain knowledge, and governed agent workflows inside existing infrastructure.
Read Use CaseMisclassification exposes organisations to fines up to €35M or 7% of global revenue. VDF AI Compliance delivers regulation-grounded risk tier decisions with audit-ready rationale.
Read Use CaseOnly 18% of organisations have a governance council with real authority. VDF AI Compliance generates the operating model — charter, RACI, risk appetite, and approval lifecycle — in days.
Read Use CaseSystematic due diligence that scores third-party AI vendors against EU AI Act deployer obligations and maintains an audit-ready Vendor Risk Register.
Under Article 28, deployers of high-risk AI bear obligations regardless of who built the underlying model — vendor assessment is mandatory, not optional.
Yes — any AI-enabled SaaS where your organisation acts as deployer should appear in the vendor assessment program.
Approved vendor lists connect to deployment policies so regulated workflows cannot call unapproved AI services.
Describe your workflow and we will help map the right governed agent network for your environment.
Talk to Solutions Team