Your Vendor's AI Is Your Problem Too

Here's a comforting fiction: we bought the AI, so compliance is the vendor's problem.

The EU AI Act disagrees. If you're a deployer, someone using a high-risk AI system in your work, you carry your own duties. Use the system according to the instructions. Keep the logs. Make sure a human with real authority is overseeing it. Monitor it for problems and report the serious ones.

Think of it like buying a company car. The manufacturer built it safely, but you're still responsible for how it's driven, who's behind the wheel, and whether the brakes get checked.

Vendor selection matters enormously here. Ask for the documentation before you sign. Ask how the system was tested and on what data. A vendor who can't show their work is telling you everything you need to know.

I explain frameworks; I don't give legal counsel.