AI vendor due diligence

The vendor's AI system reads incoming customer complaints, sorts them by topic and urgency, and drafts a reply that our staff review before anything is sent. We use it under our own name and do not change the model.

• Our role under the AI Act: deployer, meaning a body "using an AI system under its authority" (AI Act Art 3(4), checked against held text). The vendor is the provider (Art 3(3)).
• Why DORA applies: DORA covers payment institutions (DORA Art 2(1)(d), checked). A SaaS subscription is an ICT service, "digital and data services provided through ICT systems" (Art 3(21), checked). So this contract is an ICT third-party arrangement under Arts 28-30.

"Not shown" means you didn't mention the clause, so I have treated it as missing until the draft shows it.

Art 28(3) requires the register. I checked that requirement, but the implementing template with the official field list is not in Rekvira's held text, so the fields below come from Arts 28(3) and 30(2).

The Civil Code (CK, VIII-1864) is in force; the current consolidated version has applied since 2026-04-01. These points bite only if Lithuanian law governs, or as Lithuanian mandatory rules (see the choice-of-law row).

1. Exit and data return: add access, recovery and return of data in an accessible format on insolvency or termination, deletion or return at our choice, and a transition period if the function is critical or important (DORA Art 30(2)(d), 30(3)(f); GDPR Art 28(3)(g)). Owner: Legal / Procurement.
2. Our termination rights: add them for each Art 28(7) ground, with minimum notice periods (Art 30(2)(h)). Limit the vendor's termination for convenience to a long notice period plus transition support (compare CK 6.721(2)). Owner: Legal.
3. Sub-processors: require prior written authorisation with a right to object (GDPR Art 28(2)), subcontracting conditions (DORA Art 30(2)(a)), and data locations with advance notice of changes (Art 30(2)(b)). Owner: DPO.
4. Rest of the Art 30(2) list: data security (c), SLAs (e), incident assistance cost (f), cooperation with the Bank of Lithuania and resolution authorities (g), training participation (i), all in one written document (Art 30(1)). Owner: Legal / ICT risk.
5. Critical-or-important assessment (Art 28(4)(a)). If yes, add the Art 30(3) clauses (audit and access, TLPT, business continuity plans, reporting), notify the competent authority (Art 28(3)), and write an exit plan (Art 28(8)). Owner: Compliance.
6. Liability cap: carve out intent and gross negligence (CK 6.252(1); Supreme Court e3K-3-18-469/2026, para 76). Consider carve-outs for data breaches and regulatory fines. Owner: Legal / Commercial.
7. Governing law: negotiate Lithuanian law, or get Irish-law advice on the cap and the termination clause. Owner: Legal.
8. Vendor AI answers (all OPEN): intended purpose and high-risk assessment; Art 50(1)/(2) position; underlying model and Art 53 documentation; the meaning of "own name" (Art 25(1)(a)). Owner: vendor, collected by Compliance.
9. Data processing agreement with all the Art 28(3)(a), (h) terms. Owner: DPO.
10. Internal: AI literacy measures for complaint-handling staff (AI Act Art 4(1)) and a documented human-review step before any reply is sent. Owner: Operations.

• Rome I Regulation (EC) 593/2008: Avokata's corpus returned only references to it, not its text. So it is unverified whether EU choice-of-law rules displace CK 1.37 here, and whether CK 6.252 overrides an Irish choice of law.
• Irish law: not held by either service. What the cap and termination clauses mean under Irish law is unknown.
• DORA implementing and technical standards (register template, subcontracting RTS, contractual-policy RTS): not held by Rekvira. Nor is any Bank of Lithuania guidance.
• Other Annex III points: only Annex III(5) was read in full, so the high-risk answer depends on the vendor's stated intended purpose.
• AI Act Art 53(1): seen only as a search excerpt, not read in full.
• GDPR Art 35 (DPIA): not checked in this run.
• Whether a payment institution counts as a "financial institution" for the Art 26(5)/(6) relief: not checked.
• Is the SaaS a "services contract" under CK 6.716 ff.? Not verified, so whether CK 6.721 applies is open.
• Supreme Court practice: the two Supreme Court paragraphs on CK 6.186 and 6.217(5) were parties' arguments, not holdings. I found no Supreme Court holding on 6.721 or 1.37 in the top citations. Citation counts show engagement with an article, not agreement.
• Avokata daily allowances limited the depth of the citation walks: only 2 of 10 walks are left today, and the allowance resets 2026-09-26 07:00 UTC.