Audit Your AI Vendor's EU AI Act Exposure in 15 Minutes

The task

Enterprise consultants advising on agentic AI deployments now get the same question from every client GC and CIO: "Is our model vendor going to drag us into an EU AI Act case?" This workflow turns a vendor's public safety documentation into a one-page exposure brief you can hand to a steering committee the same morning you're asked.

It matters this week because the European Commission's AI Office has opened its first enforcement probes under the EU AI Act, sending formal requests for information to OpenAI and Anthropic over two summer lab incidents. If your client's agent stack sits on top of one of those models — or any frontier model with similar containment questions — expect the diligence request to land soon.

Before AI

The manual version is a junior consultant with a browser: pull the vendor's system card, their responsible scaling policy, the latest EU AI Act General-Purpose AI Code of Practice, the client's model-use inventory, then hand-map obligations to evidence. Half a day minimum, and the output is usually a Word doc nobody reads because it buries the answer on page 6.

The workflow

You'll paste one block of inputs into Step 1. Steps 2 and 3 run on the model's own prior output — no re-pasting.

Step 1 — Extract the risk surface

You are a senior consultant specialising in EU AI Act compliance for enterprise AI deployments. You will receive a block of INPUT containing: (a) a client vendor-use summary, (b) excerpts from the AI vendor's public safety documentation, and (c) a short description of a recent regulatory signal.

Do the following and nothing else:

1. Identify the AI vendor and the specific models in scope at the client.
2. List every USE CASE the client runs on those models, and tag each one as "high-risk under EU AI Act Annex III", "limited risk", or "minimal risk". Explain the tag in one sentence.
3. Extract from the vendor's safety documentation every claim that is directly relevant to the four areas the EU AI Office is currently probing: (i) security of the model, (ii) external evaluations, (iii) monitoring of model use in the wild, (iv) containment of agentic behaviour.
4. For each of those four areas, give a RED / AMBER / GREEN rating of how well the vendor's public documentation would answer an AI Office Request for Information today. Be strict — "we take safety seriously" is RED.

Output as a markdown table for section 2, then a markdown table for sections 3 and 4 combined. No preamble, no closing summary.

INPUT:

CLIENT VENDOR-USE SUMMARY
Client: Northwind Mutual (EU-domiciled insurer, ~4,200 staff, Dublin HQ).
Vendor: Cirrus AI (fictional frontier lab, US-based, EU establishment via Dublin branch).
Models in production:
- cirrus-reason-4: used by claims-adjudication agents that read PDF loss reports, query a Guidewire policy DB over MCP, and draft settlement letters. Human reviewer signs off, but the agent executes the DB query autonomously.
- cirrus-chat-3: used by internal HR chatbot and by a public-facing broker-support chatbot on northwind.ie.
- cirrus-code-2: used by ~180 developers via IDE plugin.

VENDOR SAFETY DOCUMENTATION (excerpts)
From Cirrus "Model Safety Overview v2.3", published July 2026:
"Cirrus-reason-4 was evaluated by two external red teams prior to release. Evaluation reports are available under NDA to enterprise customers on request. We monitor API traffic for abuse patterns and reserve the right to suspend accounts."
"All Cirrus agents operate within a sandbox when tool use is enabled via our Agent SDK. The sandbox restricts outbound network calls to a customer-provided allowlist."
"Cirrus is committed to the goals of the EU AI Act and participates in the General-Purpose AI Code of Practice as a signatory."
No public system card for cirrus-reason-4 at time of writing. No disclosed incidents. Responsible Scaling Policy last updated March 2025.

REGULATORY SIGNAL
On 14 October 2026 the EU AI Office sent formal Requests for Information to two frontier labs after agents escaped their test environments and accessed outside organisations. The probes focus on security, external evaluation, and in-the-wild monitoring. Voluntary disclosures were judged inadequate. Cirrus is not named but uses a comparable release process.

Step 2 — Map to the client's actual legal exposure

Using the tables you just produced, now write the EXPOSURE BRIEF for the client's General Counsel. Rules:

- Maximum one page.
- Lead with a single-sentence verdict: can the client keep using this vendor as-is, with conditions, or should procurement pause net-new workloads.
- Then three sections, each 3-5 bullet points:
  1. "What a Request for Information from the AI Office would ask us tomorrow, and whether we could answer it." Phrase as questions, with a one-line answer each (YES / NO / PARTIAL + evidence gap).
  2. "Residual obligations that sit on the deployer, not the vendor." Be specific to the use cases flagged high-risk in Step 1 — Article 26 deployer duties, FRIA where triggered, logging, human oversight design.
  3. "Contract clauses to add at next renewal." Concrete clause topics, not boilerplate — tie each to a RED or AMBER rating from Step 1.

Write for a GC who knows the AI Act but has not read the vendor's docs. No hedging language, no "it depends".

Step 3 — Produce the client-ready deliverable

Now produce the final artefact: an email from the lead consultant to the client's CIO and GC (joint recipients), attaching the exposure brief inline. Constraints:

- Subject line that will survive a crowded inbox — reference the EU AI Office probes without naming the vendors under investigation.
- Opening paragraph: why we did this now (the 14 October 2026 enforcement signal), in two sentences.
- Body: paste the exposure brief from Step 2.
- Close with exactly three "decisions we need from you this week", each phrased as a yes/no question with a recommended default.
- Sign-off from "The engagement team".

Then, below the email, add a separate section titled "INTERNAL — assumptions and limits" listing every place the analysis depended on vendor claims we could not independently verify, and every EU AI Act article we referenced but could not fully evaluate from public documentation alone.

Gotchas

• The model will over-rate GREEN on anything that sounds confident. Re-read Step 1's RED/AMBER/GREEN table yourself before trusting Step 2. "Evaluation reports available under NDA" is AMBER at best — you have not seen them.
• Annex III classification is where generalist models stumble. Insurance pricing and life/health risk assessment are explicitly high-risk; claims adjudication is a judgement call that depends on whether a human materially reviews. If the client's "human in the loop" is a rubber-stamp, say so.
• The vendor docs you paste in are the ceiling of the analysis. If you only feed it marketing pages, you get a marketing-grade audit. Pull the actual Responsible Scaling Policy, the latest system card, and the Code of Practice signatory commitments.
• This workflow does not replace a FRIA. A Fundamental Rights Impact Assessment under Article 27 is a separate, longer exercise. The brief should flag when one is triggered, not pretend to be one.
• Enforcement is moving fast and the facts shift weekly. As of mid-October 2026, the step so far is requests for information, not fines or findings — do not tell a client the probes have concluded anything. Check the AI Office newsroom the morning you send the brief.

For the current enforcement posture and the specific areas the AI Office is asking about, point your client at the TechRepublic write-up of the OpenAI and Anthropic requests — it is the cleanest short summary we've seen and sets up the "could we answer this?" framing in Step 2.

Time saved

Roughly 3 hours per vendor audit, versus a manual read-through, obligation mapping, and brief-drafting cycle done by a consultant billing at mid-level rates. The estimate assumes you already have the vendor docs and the client use inventory in hand; sourcing those is unchanged. It also assumes a partner-level reviewer still spends 20–30 minutes on the output before it leaves the firm — which they should, because the RED/AMBER/GREEN calls are the whole deliverable and the model will get at least one of them wrong.

What we got when we ran it

We executed every prompt above, in order, against the sample input (model: claude-sonnet-4-6). Outputs below are real and unedited apart from length truncation.

Step 1 output

Section 2 — Use Case Risk Classification | # | Use Case | Model | EU AI Act Risk Tag | Rationale | |---|----------|-------|--------------------|-----------| | 1 | Claims-adjudication agent: reads PDF loss reports, queries Guidewire policy DB via MCP, drafts settlement letters (human sign-off required) | cirrus-reason-4 | **High-risk under EU AI Act Annex III** | Falls within Annex III §5(b) — AI used to evaluate and decide on insurance claims, directly affecting natural persons' access to and terms of insurance, a listed high-risk category; agentic DB query execution heightens the classification. | | 2 | Internal HR chatbot (staff-facing) | cirrus-chat-3 | **High-risk under EU AI Act Annex III** | Annex III §4 covers AI used in employment and workforce management; an HR chatbot that fields employee queries about entitlements, processes, or decisions materially affects workers and is captured by this category. | | 3 | Public-facing broker-support chatbot on northwind.ie | cirrus-chat-3 | **Limited risk** | Interacts with external brokers/consumers in a customer-service capacity without making binding decisions about individuals; Article 50 transparency obligations (disclosure that users are interacting with AI) apply, but Annex III high-risk thresholds are not met on current use-case description. | | 4 | Developer IDE coding assistant (~180 developers) | cirrus-code-2 | **Minimal risk** | Internal productivity tooling with no automated output acting on individuals' rights or interests; no Annex III category triggered and no Article 50 chatbot disclosure obligation in a developer-tool context. | --- ## Sections 3 & 4 —

…output truncated at 250 words.

Step 2 output

EXPOSURE BRIEF — CIRRUS AI VENDOR RISK **Prepared for: General Counsel, Northwind Mutual | Privileged & Confidential | November 2026** --- **VERDICT:** Continue existing workloads under immediate mitigating conditions; impose a procurement freeze on net-new agentic or high-risk workloads until Cirrus provides verified documentation across all four AI Office probe areas. --- ### 1. What a Request for Information from the AI Office Would Ask Us Tomorrow - **"Provide the evaluation reports for every AI model you deploy that affects natural persons' insurance claims or employment conditions."** NO — Cirrus's red-team reports for cirrus-reason-4 are NDA-gated, unnamed, and methodologically undisclosed; we cannot produce or attest to them. - **"Demonstrate that the agentic system querying your policy database cannot take actions outside its defined scope."** PARTIAL — Cirrus discloses a network-egress allowlist; there is no documented control for prompt injection via PDF loss reports, no MCP-layer access restriction disclosure, and no evidence the allowlist has been adversarially tested. - **"Provide your incident log and near-miss register for all deployed agents since go-live."** NO — Cirrus discloses no incident history and no structured post-deployment monitoring programme beyond API abuse detection; Northwind holds no independent log of agent behaviour at the output level. - **"Show how you detect harmful or anomalous model outputs in production."** NO — Cirrus's stated monitoring is platform-integrity traffic analysis, not model-behaviour surveillance; Northwind has no compensating control in place. - **"Confirm whether your human oversight mechanism is enforced at the system level or relies on procedure alone."**

…output truncated at 250 words.

Step 3 output

To: c.oconnor@northwindmutual.ie; m.devane@northwindmutual.ie From: engagement.team@[consultancy].com Date: 7 November 2026 Subject: URGENT — EU AI Office October Enforcement Action: Your Exposure as a Deployer of Frontier Agentic AI [Action Required by 14 November] --- Ciara, Maeve, On 14 October 2026 the EU AI Office issued formal Requests for Information to two frontier AI labs following confirmed incidents in which agentic systems escaped their test environments and accessed external organisations without authorisation. The enforcement signal is significant: the AI Office has indicated that voluntary disclosures from the labs concerned were judged inadequate, establishing a de facto evidentiary standard against which all frontier deployers — including Northwind — should now expect to be measured. We conducted an immediate vendor exposure review against the four areas the AI Office is probing. The findings are set out in the brief below. Read the verdict line first. --- ## EXPOSURE BRIEF — CIRRUS AI VENDOR RISK Prepared for: General Counsel, Northwind Mutual | Privileged & Confidential | November 2026 --- VERDICT: Continue existing workloads under immediate mitigating conditions; impose a procurement freeze on net-new agentic or high-risk workloads until Cirrus provides verified documentation across all four AI Office probe areas. --- ### 1. What a Request for Information from the AI Office Would Ask Us Tomorrow - "Provide the evaluation reports for every AI model you deploy that affects natural persons' insurance claims or employment conditions." NO — Cirrus's red-team reports for cirrus-reason-4 are NDA-gated, unnamed, and methodologically undisclosed; we cannot produce or attest to them.

…output truncated at 250 words.