EU enterprise due diligence and tenders: a 48-hour response mechanism

Stages (7–11 weeks, estimate)

1. 1. Stage 1 — Building the standing evidence vault and answer bank (one-off, 4–6 weeks)

   4–6 weeks

   Convert “find it again every time” material into an asset built once and refreshed quarterly: records of processing, processor contracts and the sub-processor register, the security measures description, model and data cards, the cooperation and written-agreement arrangements with upstream value-chain providers, and supply-chain security material. Group the answer bank by topic, and give every answer an evidence reference pointing at a specific document version in the vault. There is exactly one completion test: can any salesperson or pre-sales engineer, without legal involvement, assemble an 80%-complete draft within two hours?

   Obligations in this stage

   • Records of processing activities (ROPA)EU General Data Protection Regulation (GDPR) · Art. 30 · Severity High
   • Processor contracts and sub-processor managementEU General Data Protection Regulation (GDPR) · Art. 28 · Severity High
   • Security of processing and data protection by design and by defaultEU General Data Protection Regulation (GDPR) · Art. 25, Art. 32 · Severity High
   • Upstream cooperation and written agreement duties along the value chainEU Artificial Intelligence Act · Art. 25(2), Art. 25(4) · Severity High
   • Supply chain and direct supplier security managementEU NIS 2 Directive · Art. 21(2)(d), Art. 21(3) · Severity High

   Deliverables

   Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)Model Card

   Evidence to retain

   • · Evidence vault index (document × version × custodian × last update × external-release level)
   • · Answer bank (topic × question pattern × standard answer × evidence reference × validity)
   • · Records of processing and the sub-processor register, with each provider’s location and service
   • · Security measures description in both an externally shareable and a full version
   • · Model cards, data cards and the integration documentation for downstream providers
   • · Disclosure-tiering rules (what can be sent directly, what needs an NDA, what may only be reviewed in a controlled environment)

   Common blockers

   • · An answer bank written by lawyers for lawyers: the actual users are sales and pre-sales, and the wording must be directly copyable by them.
   • · A vault with no versions or validity dates: sending a stale sub-processor list damages trust more than sending nothing.
   • · Marking everything “NDA required”: it materially slows responses, so do the disclosure tiering first.

2. 2. Stage 2 — First 2 hours: triage, grading and committing to a response time

   0.1–0.2 weeks

   Four things within two hours: confirm the questionnaire type and submission deadline; determine your role in this deal; assess coverage against the Stage 1 answer bank (how many items answer directly, how many need drafting, how many cannot be answered); and send the customer an acknowledgement stating the expected response time and the clarifications you need. That acknowledgement is itself a differentiator — most vendors first respond on the deadline. Start two determinations in parallel: whether the product in this use constitutes a high-risk AI system, and whether the processing requires a DPIA.

   Obligations in this stage

   • High-risk classification assessment and registration of a not-high-risk conclusionEU Artificial Intelligence Act · Art. 6, Art. 49(2), Art. 113 · Severity Critical
   • Data protection impact assessment and prior consultationEU General Data Protection Regulation (GDPR) · Art. 35, Art. 36 · Severity High

   Deliverables

   Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)

   Evidence to retain

   • · Intake log (source, type, deadline, counterpart, internal owner)
   • · Coverage assessment (how many items answer directly / need drafting / cannot be answered)
   • · Role determination conclusion (provider / processor / subcontractor)
   • · Copy of the acknowledgement sent to the customer, with the expected response time and clarification list

   Common blockers

   • · Skipping the acknowledgement and just writing: the customer cannot tell whether you are engaged and often forms an internal preference for another vendor before the deadline.
   • · Deferring the role determination until drafting: get the role wrong and every answer in the questionnaire has to be rewritten.
   • · Silently skipping unanswerable items: they read as omissions at consolidation, so list them as open items with a handling plan from the start.

3. 3. Stage 3 — Within 24 hours: item-by-item answers and explicit gap flagging

   0.2–0.4 weeks

   Fill in everything the answer bank covers, draft what must be written, and explicitly flag what cannot be answered as “not currently in place, plus the plan and timeline”. Honest gap flagging passes review more often than hedging: EU vendor assessments broadly accept “there is a gap with a plan”, but not “the answer did not match what we later found”. Priority question types include: instructions for use and the information deployers need; AI-interaction disclosure to natural persons; the data-subject request process and its deadlines; and, for financial customers, the baseline contractual elements required by Article 30(2).

   Obligations in this stage

   • Transparency towards deployers and instructions for useEU Artificial Intelligence Act · Art. 13 · Severity High
   • Disclosure that a natural person is interacting with an AI systemEU Artificial Intelligence Act · Art. 50(1), Art. 50(5) · Severity High
   • Data subject request handling within the one-month deadlineEU General Data Protection Regulation (GDPR) · Art. 12(3), Art. 15-22 · Severity High
   • Accept and operationalise the Article 30(2) baseline contractual elementsDORA obligations bearing on AI and ICT third-party service providers · Art. 30(1)–(2) · Severity High
   • Support the financial entity register of information on ICT service contractual arrangementsDORA obligations bearing on AI and ICT third-party service providers · Art. 28(3) · Severity Medium

   Deliverables

   Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)Model CardData Card — datasheet for a training, validation or test dataset

   Evidence to retain

   • · Item-by-item response draft, each tagged as reused / newly drafted / gap
   • · Gap list with remediation plan (owner and target date)
   • · Attachment list with the corresponding disclosure level
   • · Internal review record (technical reviewer + legal reviewer + review time)

   Common blockers

   • · Turning “planned” into “implemented” to pass review: when it surfaces during contract execution or audit, the consequence far exceeds the points lost at the time.
   • · Technical answers with no engineering review: architecture descriptions written from a salesperson’s understanding get exposed on the technical call.
   • · Attachment levels inconsistent with answers: claiming “the SOC 2 report is available” when only a summary can be shared plants a landmine.

4. 4. Stage 4 — Within 48 hours: contract terms, transfer mechanisms and annexes finalised

   0.3–0.6 weeks

   Assemble the legal annexes in one pass: the data processing agreement, the SCCs with annexes, the transfer impact assessment summary, the sub-processor list and its change-notification mechanism, and the incident-notification deadline commitments. If the customer is a financial entity or the service supports a critical or important function, also prepare the enhanced Article 30(3) terms (audit rights, exit strategy, cooperation with resilience testing). Raise the Data Act Article 32 safeguard against third-country government access proactively rather than waiting to be asked — volunteering it materially increases credibility. On the public procurement track, complete the ESPD self-declaration in parallel and check the list of certificates to be produced on award.

   Obligations in this stage

   • Transfer mechanisms and assessments for sending personal data to China and other third countriesEU General Data Protection Regulation (GDPR) · Art. 44-49 · Severity Critical
   • Processor contracts and sub-processor managementEU General Data Protection Regulation (GDPR) · Art. 28 · Severity High
   • Personal data breach notification within 72 hours and communication to data subjectsEU General Data Protection Regulation (GDPR) · Art. 33, Art. 34 · Severity Critical
   • Meet the enhanced Article 30(3) terms where the service supports a critical or important functionDORA obligations bearing on AI and ICT third-party service providers · Art. 30(3)(a)–(f)；Art. 26–27（TLPT） · Severity Critical
   • Preventing unlawful third-country governmental access to non-personal data held in the UnionEU Data Act · Art. 32 · Severity Critical
   • Staged significant-incident reporting at 24 hours, 72 hours and one monthEU NIS 2 Directive · Art. 23(1)-(4) · Severity Critical

   Deliverables

   Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual ClausesTender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)

   Evidence to retain

   • · Data processing agreement and SCC annexes, with the technical and organisational measures tailored to this deal
   • · Transfer impact assessment summary in an externally shareable version
   • · Sub-processor list and the change-notification mechanism
   • · Incident-notification commitment table (recipients and deadlines per applicable instrument)
   • · Commitment and process note for handling third-country government access requests
   • · ESPD self-declaration and the list of certificates to be produced on award (public procurement track)

   Common blockers

   • · Filling the SCC annexes from a generic template: technical and organisational measures that do not match reality are the easiest finding in a later audit.
   • · Committing to notification deadlines shorter than the statutory ones: once committed it is a contractual duty, and missing it is a breach.
   • · An ESPD self-declaration inconsistent with actual standing: false declarations in public procurement can lead to exclusion from future tenders.

5. 5. Stage 5 — Post-submission follow-up and delivering on commitments

   2–4 weeks

   Schedule every remediation commitment made in the response and track it to closure, feed the customer’s additional requirements back into the Stage 1 answer bank and evidence vault, and write the new value-chain cooperation duties created by this deal into internal process. Establish a standing notification channel with the customer for data breaches, actively exploited vulnerabilities and any material change that could affect their compliance position. Most vendors stop following up once the contract is signed — and annual re-review is precisely where that costs them.

   Obligations in this stage

   • Upstream cooperation and written agreement duties along the value chainEU Artificial Intelligence Act · Art. 25(2), Art. 25(4) · Severity High
   • Personal data breach notification within 72 hours and communication to data subjectsEU General Data Protection Regulation (GDPR) · Art. 33, Art. 34 · Severity Critical
   • Reporting actively exploited vulnerabilities at 24 hours, 72 hours and 14 daysEU Cyber Resilience Act · Art. 14(1)-(2), Art. 16 · Severity Critical
   • Supply chain and direct supplier security managementEU NIS 2 Directive · Art. 21(2)(d), Art. 21(3) · Severity High

   Deliverables

   AI incident and serious incident reporting record (register plus report drafts)Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

   Evidence to retain

   • · Gap remediation tracker (commitment × target date × actual completion × customer acknowledgement)
   • · Update log for this round’s changes to the answer bank and evidence vault
   • · Agreed notification channel with the customer (recipients, channel, deadlines)
   • · Release record for the internal processes newly created by this deal

   Common blockers

   • · Nobody owning the committed remediation: at annual re-review the customer checks last year’s commitments item by item, and open items directly affect renewal.
   • · Not feeding answers back into the bank: the next customer asks the same questions and everything is written again from scratch.