Vendor Evaluation3 September 2026
AI Vendor Independence: How to Prove You Are Not Locked In
Lock-in is not a feeling, it is a measurable exit cost. The seven layers where AI vendors trap buyers, and the evidence that proves independence.
EU AI regulation, operationally
The EU AI stack for regulated enterprises, compliant by design
Operational guidance on the AI Act, NIS2, GDPR/DORA and the Cyber Resilience Act for teams that have to put AI through a supplier audit. Every regulatory date we publish is checked against EUR-Lex or a Commission source, with the access date recorded.
Dates that bind, and the ones that moved
The Digital Omnibus of 27 July 2026 deferred the AI Act high-risk regime. Most published roadmaps still use the old calendar.
2 Aug 2026
AI Act Article 50 applies
11 Sep 2026
CRA Article 14 incident reporting
12 Sep 2026
Data Act: data by design
2 Dec 2026
Marking grace period ends
12 Jan 2027
Switching egress fees end
2 Dec 2027
Annex III high-risk obligations
Featured
Pillars and comparisons
EU Regulatory Stack1 September 2026
NIS2 Supply Chain Audit Checklist: 31 Questions
The 31 questions a NIS2 supply chain audit puts to an AI vendor, grouped by theme, each with the artefact that closes it and the answers that fail.
Vendor Evaluation20 August 2026
Sovereign AI TCO: On-Prem vs API Over 3 Years
A line-by-line three-year cost comparison of metered API inference, European managed hosting and owned on-premise AI capacity, with the break-even points.
Content clusters
Four clusters, one obligation map
EU Regulatory Stack
The flagship cluster: AI Act, NIS2, GDPR/DORA and the Cyber Resilience Act treated as one obligation map, with confirmed dates and primary sources.
Sovereignty Foundations
What buyers actually mean by sovereign AI, and the architecture decisions behind it: jurisdiction, isolation, retrieval and hardware.
Vendor Evaluation
Hand-written comparisons and buying tools: TCO, deployment models, exit clauses and the questions that expose compliance debt in an RFP.
Sector Playbooks
One template applied per sector: risk, use case, proof, rollout. Sectors are added on signals from search and citations, not planned in advance.
Where the reading leads
Three engagements
AI Act readiness
Map your AI system against Article 50 transparency duties and the deferred high-risk obligations, with dates verified in EUR-Lex.
DetailsNIS2 supplier audit
Supply-chain security evidence for AI vendors audited by essential and important entities under NIS2, including CRA incident timelines.
DetailsSovereign deployment
Choose between on-prem, air-gapped, network-isolated and private-cloud AI with the numbers and the audit consequences of each option.
DetailsLatest
Browse the blog
EU Regulatory Stack10 September 2026
Directive (EU) 2022/2555: Which Articles Bind an AI Vendor
NIS2 has 46 articles. Only a handful reach an AI vendor. A plain-language map of which ones bind you directly, which reach you through your customer, and what each demands.
EU Regulatory Stack8 September 2026
CRA Article 14: The 24, 72 and 14 Day Reporting Chain
From 11 September 2026, Article 14 of the Cyber Resilience Act obliges manufacturers to report actively exploited vulnerabilities and severe incidents. The three deadlines, who files where, and what an AI vendor needs ready.
Vendor Evaluation3 September 2026
AI Vendor Independence: How to Prove You Are Not Locked In
Lock-in is not a feeling, it is a measurable exit cost. The seven layers where AI vendors trap buyers, and the evidence that proves independence.
Next step
Bring us the questionnaire you cannot answer yet
Send the customer questionnaire, RFP section or audit request that is blocking a deal. We reply with the gaps we see and what closing them takes.
Request a review