The AI Act for procurement: supplier requirements and contract clauses

Short answer: Procurement is the gateway through which AI enters the organisation — and therefore a control point for compliance. Whoever buys an AI system usually becomes a deployer under the AI Act and acquires their own obligations. A supplier's statement "we are AI Act compliant" means little without evidence. Procurement must ask, record and make it demonstrable.

Your role changes when you buy

If you procure an AI system, you are usually not a provider but a deployer. That sounds lighter, but it carries its own duties: deploying the system according to the instructions for use, ensuring human oversight, monitoring input data and, for high-risk AI, keeping logs. Beware: if you substantially modify a procured system or place it on the market under your own brand, you can become a provider yourself, with far heavier obligations.

Due diligence before signing

A supplier must be able to demonstrate, not merely claim. Ask:

• Risk classification. Which AI Act class does the system fall into, and why?
• Conformity. Is there a conformity assessment, CE marking and EU declaration of conformity where required?
• Documentation. Will you receive technical documentation and usable instructions for use?
• Transparency and data. What data was used, and how is bias controlled?
• Security. How were accuracy and robustness tested — coordinate with the CISO.

What belongs in the contract

Pin the arrangements down firmly. See AI in contracts for the broader clause set; for procurement these core points are essential:

• Role allocation: who is provider, who is deployer, and who carries which obligation?
• Compliance warranties with the burden of proof on the supplier.
• Duty to cooperate with audits, incidents and supervisory requests.
• Update and maintenance duties for as long as the system is in use.
• Liability and indemnity — link this to the liability risk.

Cooperate, do not buy solo

Procurement can formulate requirements but cannot assess them all. Involve the DPO for personal data, the CISO for security and the board for risk appetite. Anchor this in the governance framework.

What to do

• Determine your role (provider or deployer) per procurement.
• Use a due diligence checklist for AI suppliers.
• Demand evidence, not statements: documentation, conformity, test results.
• Standardise contract clauses for AI procurement.
• Allocate liability explicitly to the right party.

Procurement is the first line of defence. What is not asked here becomes a compliance gap the organisation has to close itself later.