The EU AI Act isn’t just another compliance checkbox—it’s rewriting how companies buy and sell AI tools starting this year. Procurement teams now face new liability clauses, audit requirements, and documentation demands that weren’t in play before 2025.
Risk Allocation Shifts to the Buyer
Under the Act, if you deploy a high-risk AI system—like hiring software or credit-scoring tools—you assume legal responsibility for its outputs, even if the vendor built it. This means contracts must now include explicit warranties about training data quality, bias testing logs, and human oversight protocols. Vendors who refuse to share these details aren’t just being difficult; they’re exposing you to fines up to 7% of global turnover. Start by adding a mandatory AI impact assessment annex to every new software agreement, signed off by your legal and ethics teams before procurement signs.
Documentation Isn’t Optional Anymore
The Act requires a “technical documentation package” for high-risk systems, and buyers must retain it for 10 years. This isn’t a PDF the vendor emails you—it’s a living record of model versions, data provenance, and post-deployment monitoring reports. If your current vendor portal only gives you access logs and uptime stats, you’re already non-compliant. Push for API access to their model cards and validation datasets, or budget for third-party audits to verify what they claim. Ignoring this doesn’t just risk penalties; it voids your insurance coverage when things go wrong.
Real-Time Monitoring Becomes a Contractual Duty
You can’t set and forget AI tools under the new rules. The Act mandates continuous logging of inputs, outputs, and corrective actions for high-risk applications, with breach notifications due within 72 hours. Your contracts must now specify who monitors what, how alerts are escalated, and where logs are stored—ideally in an immutable, EU-located repository. If your vendor’s SLA only covers response time for downtime, renegotiate it to include AI-specific performance metrics like drift detection latency or false positive rates. Without this, you’re not just buying software; you’re inheriting a regulatory time bomb. [this guide]
If you're weighing your options, this guide.
Top comments (0)