EU AI Act Vendor Procurement Scorecard

Score any time-tracking or productivity-monitoring vendor against AI Act high-risk-system criteria in 14 questions. Live total + verdict band updates as you click. Designed for CISOs, procurement leads, and counsel preparing for August 2, 2026 enforcement.

The EU AI Act Vendor Scorecard is a free interactive 14-question evaluator that grades any workplace AI or productivity-monitoring vendor against EU AI Act high-risk-system criteria. Each question is weighted 0/1/3/5 across four blocks — transparency and documentation, human oversight, risk management, and surveillance footprint — for a maximum score of 70. The tool produces an instant verdict band (AI-Act-ready, gaps to close, switch needed) and a downloadable PDF. Designed for CISOs, DPOs, procurement leads, and counsel preparing for August 2, 2026 enforcement.

Questions14 weighted (4 blocks)

Max score70 points

Audit time15 minutes

OutputVerdict band + downloadable PDF

How to use this

Click one score per question (0 = Fail, 1 = Partial, 3 = Mostly, 5 = Full). Total + verdict band update automatically. The gStride posture column on each question is a worked reference example of what a 5-of-5 answer reads like — it is not an answer for the vendor you are scoring. Any Q13 or Q14 score of 0 is grounds to halt procurement regardless of total.

✓

Printable PDF
cover, rubric, verdict bands, signature page

✓

Interactive scorer
live total + verdict as you click

✓

Verdict band
AI-Act-ready / gaps to close / switch needed

EU AI Act Vendor Scorecard — 14 questions

The interactive scorecard above requires JavaScript. The 14 questions are reproduced below grouped into 4 blocks (A: Transparency & Documentation, B: Human Oversight & Decision Logic, C: Risk Management & Data Handling, D: Surveillance Footprint & Prohibited Categories). Score each on 0/1/3/5; Q13 or Q14 score of 0 is grounds to halt procurement.

Block A — Transparency & Documentation

Q1. Does the vendor list every AI inference the product produces — scoring, classification, ranking, idle inference, allocation, anomaly detection — in written form?

Q2. Will the vendor classify each inference in writing as prohibited (Article 5), high-risk (Annex III), limited-risk transparency, or minimal?

Q3. Does the vendor ship technical documentation of training data sources, inference behaviour, and known limitations (Annex IV-equivalent)?

Q4. Is there a written, dated AI Act readiness statement naming conformity-assessment route + EU database registration plan (or date)?

Block B — Human Oversight & Decision Logic

Q5. Are AI outputs framed as recommendations to a named human reviewer with full override authority, never as autonomous decisions?

Q6. Is there a documented human-oversight workflow — named reviewer role, review cadence, training requirement, audit trail?

Q7. Can the reviewer dismiss any AI recommendation without consequence (no audit flag, no manager notification, no metric impact)?

Q8. Does the platform refuse to auto-feed AI outputs into performance-improvement plans, promotions, or terminations?

Block C — Risk Management & Data Handling

Q9. Is there a documented risk-management system covering known failure modes, mitigation, residual risk, and review cadence?

Q10. Does the system log AI decisions with sufficient granularity to investigate incidents, detect drift, and reconstruct a sequence later?

Q11. Is there a post-market monitoring plan with named drift triggers, escalation path, and customer notification SLA?

Q12. Does the deployer kit include transparency notice templates, logging policy, retention windows, and works-council briefing material?

Block D — Surveillance Footprint & Prohibited Categories (halt on score of 0)

Q13. Are emotion, mood, stress, engagement, and wellbeing inferences from keystroke, mouse, webcam, or microphone fully excluded — not just toggled off?

Q14. Are screenshot capture, keystroke logging, and continuous mouse capture configurable per-feature with default OFF and linked worker notice?

Your score 0 / 70

Not yet scored

Click a score on each question — the verdict band appears once you have answered all 14.

Next step — get the printable PDF + book a readiness audit

Download the full 14-question scorecard as a printable PDF (cover, rubric, verdict bands, signature page), or book a 30-minute readiness audit and walk through your scores with the gStride team.

Book a 30-min readiness audit