EU AI Act questionnaire prep for SaaS startups

What buyers usually want to clarify

• Which product features use AI, machine learning, automation, or third-party AI vendors.
• Which customer, employee, end-user, or sensitive data categories can reach those AI features.
• Whether customer data is used for model training, tuning, diagnostics, or product improvement.
• Where human review, customer controls, opt-outs, logging, escalation, and change notices exist.
• Which subprocessors, model providers, hosting providers, and internal owners support the AI workflow.

One-page worksheet fields

• AI feature name, product area, current status, and customer-facing description.
• Data categories touched, restricted data rules, retention notes, and training-use position.
• Vendor or model provider, subprocessor status, region or hosting notes, and owner.
• Human review point, fallback path, customer control, and support escalation route.
• Evidence source, last-reviewed date, unanswered question, and reviewer needed.

Wording guardrails

Use buyer-facing language that says what is true today. If the answer depends on legal classification, regulated use, customer deployment context, or contract terms, mark it for qualified review before submitting it in a buyer portal.

Fast response order

1. List every AI feature and vendor before answering policy questions.
2. Map data categories and training-use boundaries before writing customer-facing assurances.
3. Attach evidence notes only where the evidence exists and is current.
4. Route classification, regulated-use, and contract-dependent questions for review.
5. Submit a concise answer with caveats rather than a broad claim that cannot be supported.