Key takeaways
- Since 2 August 2026 the EU AI Act's transparency rules apply, and the duty to label AI-generated images on your own channels sits with you as the publisher, not with the vendor
- Legal teams ask the same nine questions in almost every review: human oversight, model providers, data location, processor terms, training, retention, ownership, liability and likeness
- A good answer is specific and documented: a sub-processor register, a transfer assessment, a written deletion clause, an indemnity in the contract, a verification record per model face
- The red flags are vague answers: "our models are proprietary", "data may be processed globally", "the brand gets a licence to use the images"
AI vendor due diligence used to be a security questionnaire with an AI paragraph bolted on. In the last year that has flipped. In our experience, legal and procurement teams at fashion brands now send a dedicated AI questionnaire before a pilot can start, and it arrives in the first week, not after the test. The questions are consistent from one company to the next, because they come from the same two laws: the EU AI Act and the GDPR.
This article walks through the nine questions as they really arrive, what a good answer contains, and which answers should stop the conversation. It is written for e-commerce leads who have to get an AI photography vendor through legal, and for the legal teams doing the asking. It is not legal advice; your counsel decides what applies to you.
Why AI vendor due diligence changed in 2026
Two dates explain the shift. The European Commission confirms that Article 50 of the AI Act applies from 2 August 2026. From that day, providers of generative AI systems must add machine-readable marks so that AI-generated content can be detected, and deployers must inform people when they are exposed to deepfakes, a definition that, on the reading most legal teams are applying, covers AI-generated product imagery that looks like a real photograph. The Commission adopted guidelines on these obligations on 20 July 2026, and a voluntary Code of Practice on transparency of AI-generated content sits alongside them.
The second date is older. The AI Act's Article 4 on AI literacy has applied since 2 February 2025: companies that deploy AI must make sure the people operating it know enough to do so responsibly. For a brand, that means the e-commerce team cannot treat an AI vendor as a black box. Legal now expects the business owner to explain how the pictures are made.
The data — McKinsey's 2026 State of the Consumer research, a survey of 4,863 consumers in Brazil, France, Germany, the UK and the US run between 31 March and 8 April 2026, found that trust in generative AI sits below 40 percent, even though shoppers keep using it. Legal teams read that number as reputational risk, which is why disclosure questions now come first.
The nine questions, and what a good answer looks like
1. Is a human in the loop, and where exactly?
Legal wants to know who checks a picture before it reaches the product page, what they check it against, and whether a human can stop a delivery. A good answer names the review steps, says what the reviewer compares the image to (the product still, the brand book), and states what share of images get manual retouching. A vendor that claims full automation at catalogue scale should be asked to show where the check happens and who can stop a delivery.
2. Which models and providers do you use, and where does inference run?
Most AI imagery vendors orchestrate several models, some their own and some from large providers. Every external provider that touches personal data is a sub-processor under the GDPR, and the location of inference decides whether a transfer happens at all. A good answer is a published sub-processor register with a notice period and a right to object before a new one is added. "Our models are proprietary" without a register is a red flag, not a reassurance.
3. Do our data leave the EU, and on what basis?
Product stills rarely contain personal data. Reference photographs of real models, staff accounts and usage logs do. If any of that leaves the EU, the vendor must name the transfer tool. Transfers to US companies certified under the EU-US Data Privacy Framework can rely on the adequacy decision the Commission adopted on 10 July 2023. For other destinations, or for providers that are not certified, standard contractual clauses plus a transfer impact assessment along the lines of the EDPB Recommendations 01/2020 are the expected answer. A vendor that hands you its own assessment is doing you a favour.
4. Will you sign processor terms, and can you support a DPIA?
This is the GDPR core. Article 28(3) lists what the data processing agreement must say: processing only on documented instructions, confidentiality of staff, security measures, conditions for sub-processors, help with data-subject requests, assistance with security and impact assessments, deletion or return at the end, and audit rights. Where the brand decides a data protection impact assessment is needed under Article 35, the processor has to assist. A good vendor has a DPA template ready and does not argue about audit rights. A vendor that offers only its terms of service, with no processing annex, is a red flag.
5. Do you train models on our assets?
Legal asks for data protection and confidentiality reasons; brand teams ask because of competitors. The clean answer is a written statement that what the system learns from one brand's material is used for that brand only, with no cross-brand training, and that client data is segregated per tenant. "We use your data to improve our services" is a phrase to strike from the contract.
6. How long do you keep our data, and how is it deleted?
Point (g) of Article 28(3) requires deletion or return at the end of the service, at the controller's choice. The practical questions are narrower: how long are source stills, generations and rejected attempts kept, where are the backups, how long does a deletion request take, and is there a confirmation. A good answer gives numbers and a procedure. "Retained as long as necessary" is not an answer.
7. Who owns the outputs, and who indemnifies whom?
Many AI imagery contracts grant the brand a licence to use the pictures rather than ownership. Legal teams spot that quickly, because it reintroduces the usage windows and territory limits the brand was trying to leave behind. Ask three things: is each approved image assigned to the brand permanently, with no channel or time limits; does the vendor indemnify the brand if an output infringes a third party's rights; and what happens when the input was the brand's own photograph. That last case matters. If a brand uploads a picture it does not hold the rights to, the indemnity usually does not cover it, and the contract should say so plainly.
8. Who is liable if the picture misrepresents the product, and who labels it?
These are two different questions that often arrive as one. The first is about consumer protection: a picture that shows five buttons on a coat that has four is a misdescription, whoever made it. A good vendor accepts that factual errors against the product reference are its problem to redo, and says so in the contract. The second is about the AI Act. Under Article 50, the provider of the generative system marks the output in a machine-readable way; the deployer, which is the brand publishing the picture, discloses it to the people who see it. A vendor can supply the marks and a visible label, but the duty to show it on your product page is yours. Ask which marking layers the vendor applies and whether they survive your own pipeline, since a resize or a metadata strip by a DAM or CDN can remove them.
9. Whose face is that?
If the model in the picture is synthetic, legal wants to know how the vendor makes sure it does not resemble a real person, and who carries the risk if it does. A good answer describes the process: identities built from written descriptions rather than photographs of real people, a reverse image search before an identity is approved, a record of what was checked and who signed it off, and an indemnity against likeness claims. A digital twin of a real model needs that person's consent and a separate contract. "Our models are generated, so there is no problem" is the wrong answer.
Copy this into your own vendor questionnaire
- Where exactly does a human review the pictures, and against what?
- Which AI models and providers do you use, and where does inference run?
- Do our data leave the EU? On which transfer basis, per provider?
- Will you sign a DPA with the Article 28 points and support our DPIA?
- Do you train any model on our assets, or on other clients' assets?
- How long do you keep each type of data, and how do you confirm deletion?
- Who owns the outputs, and what does your indemnity cover?
- If a picture misrepresents the product, who redoes it, and who labels it as AI?
- How do you make sure a synthetic model does not resemble a real person?
The questionnaire at a glance
| Question | What a good answer contains | Red flag |
|---|---|---|
| Human in the loop | Named review steps, what is compared, share of manual retouching | "Fully automated" at scale |
| Models and providers | Published sub-processor register with notice period and right to object | "Proprietary", no register |
| Data location | Inference location, transfer tool per provider, transfer assessment on file | "Processed globally" |
| Processor terms and DPIA | DPA with the Article 28(3) points, audit rights, DPIA assistance | Terms of service only |
| Training | Written no cross-brand training, per-tenant segregation | "Used to improve our services" |
| Retention and deletion | Retention periods per data type, deletion procedure, confirmation | "As long as necessary" |
| Ownership and indemnity | Permanent assignment, indemnity, explicit rule for brand-supplied inputs | Licence instead of ownership |
| Misrepresentation and labelling | Vendor redoes factual errors; marks applied; deployer labels on channel | Silence on who labels |
| Likeness | Text-built identities, reverse image search, dossier, indemnity | "Generated, so no problem" |
How Sartiq handles it
We publish the answers because the questionnaire arrives anyway. Data is held in the EU under GDPR-compliant hosting, with a published sub-processor register, a notice period and a right to object before any new sub-processor is added. There is no cross-brand training: what the production system learns from your brand book stays with your brand book. Every approved photograph is assigned to the brand permanently, with no usage windows, territory limits or expiry dates.
On transparency, every output carries three marking layers applied automatically: C2PA Content Credentials, EXIF and XMP metadata, and an imperceptible watermark, with a per-file disclosure receipt on every download and a visible "AI Generated" label that can be rendered onto delivered files before they reach your pipeline. This supports the producer-side obligations under Article 50; the visible label on your published page remains your duty as the publisher, and the Article 50 analysis is available to your counsel.
Key points to remember
- Expect the AI questionnaire before the pilot, and answer it with the business owner and legal together
- The nine questions map to two laws: the AI Act (literacy, marking, disclosure) and the GDPR (processors, transfers, retention)
- Ask for documents, not assurances: sub-processor register, transfer assessment, DPA, deletion procedure, identity record
- Ownership of outputs and indemnity for likeness are contract terms, not features; read them before the pilot, not after
- The visible AI label on your product page is your obligation as the publisher; the vendor's job is to make it easy to apply and hard to lose
FAQ
Does the AI Act apply to a brand that only buys AI-generated pictures? Yes, as a deployer. Since 2 August 2026, Article 50(4) requires deployers to disclose AI-generated content that qualifies as a deepfake, and Article 4 has required AI literacy for staff since February 2025. The vendor's obligations as provider do not replace yours.
Do product stills count as personal data? Usually not. Photographs of real people, employee accounts and usage logs do. Ask the vendor to list what personal data it processes and where, then apply the GDPR questions to that list rather than to the whole workflow.
Is a transfer impact assessment still needed for US providers? Not for transfers to companies certified under the EU-US Data Privacy Framework, which the Commission found adequate on 10 July 2023. For non-certified providers or other countries, standard contractual clauses plus a transfer assessment remain the expected basis. Your counsel should confirm the current position.
Who is responsible if a synthetic model looks like a real person? It depends on the contract. Ask for a described verification process and an indemnity against likeness claims. Without both, the risk sits with the publisher.