Questions to ask before you adopt an AI tool

Start by working out whether the Act applies at all, and if it does, which tier your intended use sits in. That single answer shapes everything else, because a minimal-risk use needs almost nothing while a high-risk one needs a great deal.

Be specific about the use you actually have in mind, not the tool's full range of features. A vendor's marketing may list a dozen capabilities; what matters is the one or two you will switch on.

Ask for the instructions for use, and for a high-risk system, the CE marking and the EU declaration of conformity. These show the provider has done the build-side work the Act requires.

A vendor who cannot produce these for a high-risk product is telling you something. At best it means more of the burden lands on you; at worst it means the product is not ready for the use you have in mind.

Ask which regions process the data, whether a data processing agreement is on offer, and whether your inputs are used to train the vendor's models. This is the GDPR side, and for most businesses it matters as much as the AI Act side.

The answers also tell you what your team can safely put into the tool, which feeds straight into your AI policy.

Find out what human-oversight features exist, how the system explains its output, and whether you can export the logs if you ever need to show what happened. For a high-risk use, these are not nice-to-haves; they are what let you meet your own duties.

A tool that produces decisions you cannot see into, or override, is a poor fit for anything high-risk, however good the results look in a demo.

Capture the tool, the use, and these answers in your inventory, so the decision is on record and easy to revisit when the tool or the rules change. A short note now saves a scramble later.

It also means the next person to ask "are we okay to use this?" has an answer, rather than starting the diligence over.