Enterprise AI Deployer

stable enterprise-ai-deployer · v1.1

An organisation that procures AI systems built by others and operates them under its own authority, alongside the security programme it already runs. It keeps its own identity, data, incident, continuity and personnel controls, so the security domains apply to it as they would to any organisation. Its AI duties are the ones the EU AI Act, ISO/IEC 42001 and the NIST AI RMF place on the operator: use within the provider's instructions, input data relevance, assignment of human oversight, monitoring in use, retention of the logs the system generates, AI literacy and telling the people its decisions affect. Build-side controls such as training data, verification testing and technical documentation are marked satisfied by provider: the deployer's evidence is the documentation, test summary and instructions for use it obtains from the provider under AIG-032 and AIG-034, so a questionnaire shows the evidence to collect rather than a gap. A deployer that puts its own name on a high-risk system, substantially modifies it or changes its intended purpose becomes its provider under Art.25 and moves to a provider profile. A public body, and a deployer of a system that scores creditworthiness or prices life or health insurance risk, carries the fundamental rights impact assessment and the public register entry as conditional rows here rather than in a profile of its own. Rows a cloud provider discharges for its customers are marked satisfied by provider; where the deployer runs the system on infrastructure it controls, those rows are conditional on the deployment model and the duty is its own.

Roles: Deployer
Deployment models: Cloud, multi-tenant SaaSCloud, single tenantOn premisesHybridEdgeOn deviceEmbeddedAir gapped
Risk classes: noneminimaltransparencyhigh-risk-annex-iii
Jurisdictions: EUUS-federalINT
Frameworks: EU-AI-ActISO-42001NIST-AI-RMFNIST-AI-600-1OWASP-LLMOWASP-AGENTICGDPRSOC2ISO-27001NIST-800-53CSA-CCMCSA-AICM

Applicability statement

201 controls Download CSV

required 171 controls In scope for this profile. The control has to be in place and evidenced.

GOV · Governance & Risk

GOV-001 Information Security Policy core

GOV-002 Information Security Roles and Responsibilities core

GOV-003 Management Commitment and Accountability core

GOV-004 Information Security Programme core

GOV-005 Risk Assessment core

GOV-006 Risk Management Programme core

GOV-007 Risk Treatment and Remediation Tracking core

GOV-008 Fraud Risk Assessment core

GOV-009 Segregation of Duties core

GOV-010 Legal, Regulatory and Contractual Compliance Inventory core

GOV-011 Compliance Monitoring and Internal Audit core

GOV-012 Continuous Monitoring Strategy core

GOV-013 Exception and Requirement Determination Register core

GOV-014 Asset Inventory core

GOV-015 Intellectual Property Rights Management core

GOV-016 Records and Information Governance core

GOV-018 Threat Intelligence Programme core

GOV-019 Information Security in Project Management core

GOV-020 Independent Security Review core

GOV-021 Audit and Assurance Policy core

GOV-022 Privacy Programme and Data Protection Policy core

GOV-023 Security Measures Performance Measurement core

GOV-024 Documented Operating Procedures core

IAM · Identity & Access Management

IAM-001 Access Control Policy core

IAM-002 Identity Inventory and Unique Identifiers core

IAM-003 User Account Lifecycle Management core

IAM-004 Access Review and Recertification core

IAM-005 Least Privilege and Need-to-Know Enforcement core

IAM-007 Privileged Access Management core

IAM-008 Multi-Factor Authentication core

IAM-009 Authentication Information Management core

IAM-010 Service Account and Non-Human Identity Management core

IAM-011 Remote Access Controls core

IAM-012 Session Management core

IAM-013 Logon Failure and Account Lockout core

IAM-014 Access to Source Code and Development Assets core

The deployer's own repositories and pipelines, including the prompt and configuration repositories for the AI systems it integrates.

IAM-015 Role-Based Access Control core

IAM-016 Dedicated Administration Systems core

Administrative access to the deployer's own production estate is its own duty, whoever built the AI system running on it. The administration of the provider's service reaches the deployer as a tenant administration console, which is a designated system like any other.

DAT · Data Protection

DAT-001 Data Classification Scheme core

DAT-002 Information Labelling core

DAT-003 Encryption at Rest core

DAT-004 Encryption in Transit core

DAT-005 Cryptographic Key Management core

DAT-006 Data Inventory and Records of Processing core

DAT-007 Data Minimisation and Purpose Limitation core

DAT-008 Data Retention and Deletion core

DAT-009 Privacy Notice and Transparency core

DAT-010 Consent Management core

DAT-011 Data Subject Rights Fulfilment core

DAT-012 Data Protection by Design and Default core

DAT-013 Data Protection Impact Assessment core

The deployer uses the information the provider supplies to complete its assessment (Art.26.8), obtained through AIG-034.

DAT-015 Data Transfer Controls core

DAT-016 Data Masking and Pseudonymisation core

DAT-017 Data Leakage Prevention core

DAT-018 Data Protection Officer core

DAT-019 Lawful Basis for Processing core

DAT-020 Accuracy of Personal Data core

DAT-024 Special Category and Criminal Conviction Data core

DAT-025 Automated Decision-Making and Profiling Rights core

The deployer taking a decision on the system's output is the controller for Art.22.

APP · Application Security

APP-001 Secure Development Lifecycle Policy core

Applies to the deployer's own development, including the integrations, prompts and agents it builds on procured models. The provider's lifecycle for the product is evidenced through AIG-032.

APP-002 Security Requirements in Design core

APP-003 Secure Coding Standards core

APP-004 Security Testing in the Development Pipeline core

APP-005 Penetration Testing core

The deployer's own estate and integrations. The provider's test reports for the product are reviewed under VND-006.

APP-007 Software Supply Chain and Dependency Management core

The deployer's own builds. The product's bill of materials is the provider's, obtained under VND-002 where contracted.

APP-008 Secrets Management core

APP-009 Change Management core

APP-010 Environment Separation core

APP-011 API Security core

APP-012 Software Integrity Verification core

The deployer's own pipeline. Integrity of the product's releases is the provider's.

APP-013 Secure System Architecture and Design Principles core

APP-015 Processing Integrity core

The processing specification covers the input pipelines the deployer controls, which is where Art.26.3 input data relevance is tested.

APP-016 Sandboxed Execution of Untrusted Code core

Applies where the deployer executes model-generated or third-party code. Where the sandbox is a provider feature the deployer holds the provider's description of its limits.

INF · Infrastructure & Cloud Security

INF-002 Configuration Baseline and Hardening core

The deployer's own systems. For the hosted tier the provider's baseline is inherited and evidenced under VND-004.

INF-003 System Component Inventory core

INF-004 Network Segmentation core

The tenant separation clause is the provider's. Segmentation of the deployer's own estate is its own.

INF-005 Secure Network Architecture and Defence core

INF-007 Vulnerability Management core

INF-008 Patch Management core

INF-009 Malware and Endpoint Protection core

INF-012 Capacity and Performance Management core

INF-013 Infrastructure Redundancy core

The deployer's own infrastructure. The provider's availability architecture is evidenced under VND-006 and BCM-010.

INF-014 Clock Synchronisation core

INF-016 Domain, DNS and Routing Security core

INF-017 Managed Endpoint Baseline core

INF-018 Physical Access and Environmental Protection core

MON · Monitoring & Logging

MON-001 Audit Log Scope and Generation core

MON-002 Log Integrity and Protection core

MON-003 Log Retention core

Includes the Art.26.5 minimum of six months for the automatically generated logs of a high-risk system under the deployer's control (AIG-020).

MON-004 Centralised Log Management core

MON-005 Security Monitoring and Alerting core

MON-008 Detection Content Lifecycle core

MON-009 Log Access Control and Sensitive Data in Logs core

VND · Vendor & Third-Party Risk

VND-001 Vendor Risk Assessment and Due Diligence core

VND-002 Security Requirements in Vendor Contracts core

VND-003 Sub-Processor Management satisfied by provider

The deployer is the controller: it obtains the provider's sub-processor register and objection route under VND-002. Where the deployer is itself a processor for its own customers, the register is its own.

VND-004 Cloud Service Provider Security Management core

The control through which the deployer evidences every hosted-tier control inherited from a cloud provider.

VND-006 Vendor Monitoring and Performance Review core

VND-007 Vendor Access Controls core

VND-008 Vendor Offboarding core

VND-010 Third-Party Data Disclosure Controls core

INC · Incident Response

INC-001 Incident Response Plan core

INC-002 Incident Detection and Triage core

INC-003 Incident Classification and Escalation core

INC-004 Incident Containment and Eradication core

INC-005 Incident Reporting and Regulatory Notification core

Includes informing the provider of a risk or incident found in use (Art.26.4).

INC-006 Customer Incident and Cyber Threat Notification satisfied by provider

The deployer is the customer notified. The provider's commitment is contracted under VND-002 and the deployer's own duties to data subjects and authorities run through INC-005. Where the deployer processes personal data for its own customers, the row is its own.

INC-007 Evidence Collection and Preservation core

INC-008 Post-Incident Review core

INC-009 Incident Response Training and Testing core

INC-010 External Contact and Communication Points core

BCM · Business Continuity

BCM-001 Business Continuity Plan core

BCM-002 Disaster Recovery Plan core

BCM-003 RTO and RPO Definitions core

BCM-004 Backup Policy and Implementation core

BCM-005 Backup Restoration Testing core

BCM-006 BCM and DR Testing core

BCM-007 Alternate Processing and Communications core

BCM-008 Business Impact Analysis core

BCM-009 Backup Immutability and Isolation core

BCM-010 Third-Party and AI Provider Service Continuity core

The continuity control for every AI system the deployer does not host.

AIG · AI Governance

AIG-001 AI Policy core

AIG-002 AI Roles and Responsibilities core

AIG-003 AI System Inventory core

The inventory, the risk class recorded for each system and the Art.25 check on the deployer's own modifications are the deployer's. The provider's classification and registration references are taken from the documentation it releases (AIG-034). Registration of use by a public authority (EU-AI-Art.49.2 in the extract, Art.49(3) in the Regulation) belongs to public-body-deployer-eu.

AIG-005 AI Risk Management Process core

AIG-006 AI Impact Assessment core

The impact assessment before use is the deployer's under ISO 42001 A.5. The Art.27 fundamental rights impact assessment is an addition that binds a public body, or a private body providing a public service, deploying a high-risk system. public-body-deployer-eu owns it.

AIG-007 AI System Requirements and Design Documentation satisfied by provider

Obtain the intended purpose, deployment context and design documentation from the provider (AIG-015 documentation, AIG-034 instructions for use). The deployer's own statement of purpose and context for each use is the AIG-039 use register.

AIG-008 AI System Verification, Validation and Testing satisfied by provider

Obtain the provider's verification and validation summary (AIG-034). The deployer's acceptance checks in its own context are the pre-deployment checks in AIG-009 and, where the system scores people, the in-production evaluation in AIG-025.

AIG-009 AI System Deployment and Change Management core

The deployment plan and the substantial-modification definition are the deployer's. The same definition is the Art.25 test: a substantial modification makes the deployer the provider.

AIG-011 AI System Decommissioning core

AIG-012 Training Data Management and Quality satisfied by provider

Obtain the provider's training data summary (AIG-015, released under AIG-034). Where the deployer fine-tunes or evaluates a model on its own data, the practices apply to that data and the row is its own.

AIG-013 Training Data Provenance satisfied by provider

Obtain the provider's provenance statement for the training data (AIG-015). Provenance of data the deployer fine-tunes or evaluates on is its own.

AIG-014 Special Category Data in Training and Evaluation Datasets satisfied by provider

Screening of the provider's training and evaluation sets is the provider's. Evaluation sets the deployer builds from its own data carry the DAT-024 screening result.

AIG-015 AI System Technical Documentation satisfied by provider

The documentation is the provider's. The deployer's evidence is the released version, held against the inventory entry and matching the deployed version.

AIG-016 AI Interaction and Output Disclosure role duty

Notifying affected persons (Art.26.7) and the Art.86 explanation route are the deployer's at high risk. Deep fake and public-interest text disclosure (Art.50.4) is the deployer's where it publishes the content. Interaction disclosure and machine-readable marking are built by the provider; the deployer confirms they are active in its configuration. Worker notification before workplace use (EU-AI-Art.26.6) is dispositioned to this profile and has no canonical control yet.

AIG-017 AI Model Explainability satisfied by provider

Obtain the explainability documentation from the provider (AIG-015). The deployer uses it in the AIG-022 oversight design and the AIG-016 explanation route.

AIG-018 AI System Operational Monitoring role duty

Monitoring in operation and informing the provider of risks are the deployer's (Art.26.4). The post-market monitoring plan and the analysis of data reported by deployers (Art.72) are the provider's.

AIG-019 AI Model Performance and Drift Detection core

Performance on the deployer's own population and input distribution is measured by the deployer. Retraining is the provider's escalation, reached through the AIG-032 change notification terms.

AIG-020 AI System Event Logging role duty

The log design is the provider's. The deployer retains the automatically generated logs under its control for the Art.26.5 period of at least six months and controls read access to them.

AIG-021 AI Incident Response and Error Communication core

The deployer detects incidents in its use, informs the provider and, where the provider cannot be reached, the market surveillance authority (Art.26.4). The serious incident report under Art.73 is the provider's.

AIG-022 Human Oversight of AI Outputs role duty

Assignment of oversight to competent, trained persons and the record of oversight activity are the deployer's (Art.26.2). The oversight measures available are designed by the provider (Art.14) and described in the instructions for use.

AIG-023 AI System Override and Safe-State Mechanisms core

The mechanism is built by the provider. Naming who may invoke it, exercising it at intervals and recording whether the supplier was needed are the deployer's.

AIG-024 Prohibited AI Practices core

Art.5 binds use as well as placing on the market. The acquisition-record check is the deployer's main artefact.

AIG-025 AI Fairness and Bias Controls core

Pre-deployment bias evaluation is the provider's, obtained through AIG-034. Evaluation in production on the deployer's own population is the deployer's.

AIG-026 AI Security and Adversarial Robustness satisfied by provider

Obtain the provider's AI security evaluation summary (AIG-034). Testing of what the deployer builds on top is APP-005 and AIG-029.

AIG-027 AI Output Validation and Confidence Controls satisfied by provider

Threshold calibration and validation logic are the provider's. The deployer sets the fallback in its own workflow, in the AIG-022 oversight design, using the thresholds the instructions for use give.

AIG-028 Hallucination and Factual Accuracy Controls core

The use cases, the acceptable rate and the measured rate on the deployer's own data are the deployer's. The grounding mechanism may be a provider feature or the deployer's own retrieval layer.

AIG-029 Prompt Injection Protection core

The row is the deployer's for every integration that places its own or external content into a prompt. Where the provider's interface is used as shipped, the testing is the provider's (AIG-034 test summary).

AIG-031 AI Misuse, Jailbreak and Abuse Detection core

Runtime detection and response on systems the deployer exposes to users are its own. The assessment of prohibited generation outcomes for each model placed on the market is the provider's.

AIG-032 Third-Party AI Risk Management core

The procurement control for every AI system the deployer adopts and the agreement the satisfied-by-provider rows rest on.

AIG-034 Customer and Deployer Obligations Communication satisfied by provider

The deployer is the customer this control addresses. Its evidence is the instructions for use, limitations, oversight guidance and update notices the provider issues, held against the inventory entry. The agreement allocating regulatory responsibility is the AIG-032 agreement. This is the route the other satisfied-by-provider rows name.

AIG-038 AI Feedback and Adverse Impact Reporting Channel core

The channel for the people the deployer's use affects is the deployer's. The provider's channel serves its own users.

AIG-039 Responsible and Intended Use of AI Systems role duty

Use in accordance with the instructions (Art.26.1) and input data relevance (Art.26.3) are the deployer's central duties. The row binds every deployer through ISO 42001 A.9 and becomes a legal duty at high risk.

AIG-040 Customer Data Use in Model Training satisfied by provider

The deployer is the customer. It obtains the provider's statement on whether its inputs are used for training, exercises the opt-out and records the answer in the AIG-032 assessment.

AIG-042 Agentic Tool Permissions and Action Authorisation core

Permission sets, approval of consequential actions and invocation logs for agents the deployer runs against its own systems are its own. Where the agent runtime is the provider's, enforcement is a provider feature and the deployer configures and records the grants.

AIG-055 Training Pipeline Security core

The pipeline the deployer fine-tunes or evaluates on is its own. The providers training pipeline is evidenced through the providers documentation (AIG-034).

AIG-056 Agent Memory and Context Integrity core

The memory policy, the review of its own entries and the response to a suspected poisoning are the deployer's for agents it runs against its own systems and data. Where the agent runtime and its memory store are the provider's, the scope enforcement, the validation before commit and the version history are provider features and the deployer configures them and records that it has (AIG-034 instructions for use).

AIG-057 Inbound Synthetic Media Detection core

Required, as the library states every control whose trigger is a feature set rather than a facet (DAT-018, AIG-014, AIG-042, AIG-056): the documented assessment the control opens with is the first artefact. It bites where a system relies on user-supplied or external audio, image or video as evidence of a person's identity, of the provenance of an artefact or of a real-world event, which is a live case for identity verification, onboarding, claims and content-moderation features. An organisation whose assessment finds no such intake point records that finding and the detection limb has nothing to attach to. Restated from recommended on the S13 benchmark (ADR-049 amendment, 2026-09-16). A deployer that runs an identity, claims or evidence intake on a provider's product relies on the provider's detection step and records its rates from the provider's evaluation.

HRS · Human Resources Security

HRS-001 Personnel Security Policy core

HRS-002 Pre-Employment Background Screening core

HRS-003 Employment Agreements and Security Obligations core

HRS-004 Security Awareness Training core

HRS-005 Role-Based Security Training core

HRS-006 Disciplinary Process for Security Violations core

HRS-007 Termination and Access Revocation core

HRS-008 Remote Working Security core

HRS-009 Security Event Reporting Channel core

HRS-010 Personnel Roles and Security Responsibilities core

HRS-011 Acceptable Use of Information Assets core

HRS-012 Insider Threat Programme core

HRS-013 AI Literacy and Role-Based AI Training role duty

Art.4 binds deployers directly. The oversight-role content is the deployer's for the persons it assigns under AIG-022.

conditional 12 controls In scope when the stated condition holds. Read the condition before deciding.

DAT · Data Protection

DAT-021 Customer-Managed Encryption Keys deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, key ownership and the behaviour on withdrawal are its own. Under cloud-saas or cloud-single-tenant the row is satisfied by the provider and the deployer obtains the key ownership statement and the withdrawal test result under VND-004.

DAT-022 Data Residency and Location Transparency deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, the location record for that system is its own and is enforced by its own configuration. Under cloud-saas or cloud-single-tenant the row is satisfied by the provider: the deployer obtains the provider's location record under VND-004 and reflects it in DAT-006 and DAT-015.

DAT-023 Customer Data Export and Portability deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, the export interface and the retrieval window belong to the service it operates. Under cloud-saas or cloud-single-tenant the row is satisfied by the provider: the export interface and the post-termination retrieval terms are obtained under VND-004 and BCM-010 so the exit plan can be exercised.

INF · Infrastructure & Cloud Security

INF-015 Multi-Tenant and Workload Isolation deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, isolation between its own tenants, environments and workloads is its own and INF-004 covers the boundary. Under cloud-saas or cloud-single-tenant the row is satisfied by the provider: the isolation statement and the cross-tenant test summary are obtained under VND-004.

MON · Monitoring & Logging

MON-010 Availability and SLO Monitoring with Status Communication deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, the availability objective and the status channel for that service are its own. Under cloud-saas or cloud-single-tenant the row is satisfied by the provider: the deployer holds the provider's service level objective and status channel and reviews them under VND-006.

VND · Vendor & Third-Party Risk

VND-011 Shared Responsibility Model and Customer Security Communication deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, it owns the responsibility split it publishes to whoever consumes that service. Under cloud-saas or cloud-single-tenant the row is satisfied by the provider: the deployer receives the matrix under VND-004 and reads it against this profile so each inherited control has a named owner.

VND-012 Government and Law Enforcement Data Request Handling deployment duty

Condition: deployment_model in on-prem, hybrid, edge, on-device, embedded, air-gapped

Where the deployer runs the AI system on infrastructure it controls, the data a request could compel is in its own custody and its procedure covers receipt, legal review, narrowing, approval and the record end to end. Under cloud-saas or cloud-single-tenant the deployer is the customer the provider notifies, it obtains the provider's request-handling terms under VND-004, and its own procedure still covers the personal data it controls directly.

AIG · AI Governance

AIG-037 AI Regulatory Conformity Assessment and Declaration satisfied by provider

Condition: ai_risk_class in high-risk-annex-iii

Conformity assessment is the provider's. For a high-risk system the deployer obtains the EU declaration of conformity and confirms the CE marking before putting the system into service, recording both in the AIG-032 assessment.

AIG-043 AI Non-Conformity Corrective Action and Authority Cooperation satisfied by provider

Condition: ai_risk_class in high-risk-annex-iii

Corrective action and the authority request register are the provider's (Art.20, 21). The deployer reports non-conformity to the provider (Art.26.4), acts on a withdrawal, disablement or recall notice and produces the logs it holds to a competent authority on request.

AIG-044 Workplace AI Deployment Notification to Workers risk class duty

Condition: ai_risk_class in high-risk-annex-iii and the system is used at a workplace

Art.26(7) binds a deployer that is an employer, before the system is put into use at the workplace. The audience is the recognised representatives and the workers within the system's reach, through the information and consultation route the organisation's own agreements or the applicable employment rules set. Where the description of the system in the notice comes from the provider it is obtained under AIG-032 and AIG-034.

AIG-045 Deployer Registration in a Public AI Register risk class duty

Condition: ai_risk_class in high-risk-annex-iii and the deployer is a public authority, an agency or another body governed by public law, or acts on behalf of one

Art.49(3) binds a public authority, an EU institution or a person acting on their behalf, before the system is put into service or used. The Annex III point 2 carve-out applies. The provider-side arm of Art.49 sits on AIG-003 and stays with the provider, so a deployer holds two references against one system.

AIG-046 Fundamental Rights Impact Assessment risk class duty

Condition: ai_risk_class in high-risk-annex-iii and the deployer is a body governed by public law or a private entity providing a public service, or the system is used to assess creditworthiness or to price and assess risk in life or health insurance

Art.27 binds public-law bodies, private entities providing public services and deployers of the Annex III point 5(b) and (c) systems, excluding the point 2 area. The assessment is due before first use and its result is notified to the market surveillance authority. Where the deployer holds a data protection impact assessment covering an element, Art.27(4) lets it cross-reference that section, so DAT-013 supplies part of the artefact. The provider's instructions for use, its risk description and its oversight measures are obtained under AIG-032 and AIG-034.

recommended 3 controls Good practice for this profile, not a duty it carries.

GOV · Governance & Risk

GOV-028 Regulatory Cooperation and Supervisory Access satisfied by provider

A deployer is the customer in this relationship, so the supervisory access it needs is its provider's: contracted under VND-002, obtained with the service under VND-004 and reviewed under VND-006. Where the deployer supplies a service of its own to a regulated customer, the row is its own and reads as it does on saas-ai-provider.

APP · Application Security

APP-014 Vulnerability Disclosure Programme satisfied by provider

The disclosure programme for the product is the provider's and is reviewed under VND-006. A deployer with internet-facing services of its own benefits from one; no framework in the profile requires it of a deployer.

AIG · AI Governance

AIG-010 AI Model Registry and Versioning satisfied by provider

The registry is the provider's. The deployer records the model versions in production against the AIG-003 inventory entry and the BCM-010 continuity entry and takes version and change notices under the AIG-032 agreement.

not-applicable 15 controls Out of scope for this profile. It is stated rather than omitted so the exclusion is auditable.

DAT · Data Protection

DAT-026 Customer Transition and Switching Execution out of scope

The deployer is the party switching, not the party executing the switch. BCM-010 and VND-008 hold its side: the exit plan over the services it buys and the offboarding of a departing supplier.

DAT-027 Switching Interfaces and Functional Equivalence Support out of scope

The deployer calls the retrieval interfaces rather than publishing them. Whether the provider's interfaces reach it on equal terms is a question it asks under VND-001 and VND-004.

VND · Vendor & Third-Party Risk

VND-013 Regulatory and Exit Terms in Customer Agreements out of scope

Exit and regulatory terms are what a provider owes the customers of a service it sells. An enterprise operating AI systems for its own business is the customer in that relationship, and the terms it reads are covered by VND-002 and VND-004. Where the deployer also supplies a service to external customers it holds the provider seat for that service and reads the row on saas-ai-provider.

VND-014 Customer and Regulator Audit and Inspection Rights out of scope

The deployer exercises audit rights rather than granting them; VND-006 is where it reviews the suppliers it buys from. Where it supplies a service to external customers it holds the provider seat for that service.

VND-015 Subcontractor Disclosure and Change Approval out of scope

The deployer reads the provider's subcontractor disclosure and objects through it under VND-002 and VND-003 rather than publishing one. Where it supplies a service to external customers, the disclosure and the hold on a change are its own and it reads the row on saas-ai-provider.

AIG · AI Governance

AIG-036 AI Quality Management System out of scope

Art.17 binds providers of high-risk systems. A deployer that triggers Art.25 becomes the provider and moves to high-risk-provider-eu.

AIG-041 Regulatory Authorised Representative out of scope

Art.22 and Art.54 bind providers established outside the Union. Where a non-EU provider has appointed a representative, the deployer records the contact details from the provider's documentation in its AIG-032 assessment.

AIG-047 General-Purpose Model Documentation and Downstream Information out of scope