AI Act Makes Vendor Contracts the Front Line of Compliance

The EU Artificial Intelligence Act treats companies that deploy AI systems as regulated parties in their own right. That is a significant shift for legal teams accustomed to viewing AI procurement as a commercial negotiation about price, service levels and data protection. Under the Act, a deployer’s ability to meet its obligations depends heavily on information, cooperation and evidence supplied by the provider. As the Act’s high-risk obligations phase in, the contract is becoming the instrument through which compliance is either secured or lost.

Policies and internal guidance remain necessary, but they cannot substitute for enforceable vendor commitments. A deployer that cannot obtain technical documentation, instructions for use, conformity details or incident information from its provider may be unable to demonstrate compliance to a regulator, a customer or a court. Procurement therefore needs to be treated as a regulatory exercise, not merely a purchasing decision.

Why deployer duties depend on vendor information

The Act distinguishes between providers, which develop or place AI systems on the market, and deployers, which use AI systems under their own authority. For high-risk systems, deployer duties include using the system in accordance with its instructions, assigning human oversight, monitoring operation, keeping logs where they are under the deployer’s control and reporting serious incidents. Each of those duties depends on information the provider holds.

Contracts should make the relevant materials deliverable and current. That includes technical documentation, instructions for use, information on conformity assessment and CE marking where applicable, version histories and notices of material changes. A one-off data room at signature is not enough. The deployer needs a contractual right to receive updated documentation when the system changes, and a clear route to ask questions when the instructions are ambiguous.

If a provider supplies only generic marketing material or refuses to share conformity evidence, the deployer may be left unable to show that it used the system correctly. The contract should specify what must be delivered, in what format, by when and with what consequences for non-delivery. It should also require the provider to cooperate with the deployer’s own regulatory responses, subject to appropriate confidentiality protections.

Allocating roles and controlling scope

Role allocation is central to AI contract design. The contract should map provider and deployer responsibilities for the intended purpose, human oversight, monitoring, data protection and, where applicable, fundamental rights impact assessments. It should also state clearly which party is responsible for regulatory engagement and for maintaining evidence of compliance.

Contracts should address prohibited uses and repurposing. A system may be supplied for one purpose but used in a way that engages prohibited practices or brings it within a higher-risk category not covered by the provider’s conformity assessment. The contract should prohibit such uses, require notice before any material change in purpose and allocate responsibility if the system’s risk classification changes. If a deployer substantially modifies a system, it may assume provider obligations; the contract should make that consequence explicit and require cooperation before modifications are made.

Scope control also matters for subsidiaries, affiliates and contractors. The contract should identify who may use the system, for what purposes and under what conditions. Without that discipline, a deployer may find that a business unit has repurposed a tool in a way that undermines the compliance position of the whole group.

Audit, logs and incident cooperation

Deployers need proportionate rights to test, audit and access logs. High-risk systems must be monitored in operation, and the deployer cannot monitor what it cannot see. Contracts should grant log access, testing rights and audit rights, with clear limits on frequency, scope and confidentiality. They should also require notification of model updates, performance changes and serious incidents that may affect the deployer’s compliance.

Incident-response clauses should go beyond a general duty to notify. They should cover root-cause analysis, corrective action, suspension rights and liability allocation. The provider should be required to inform the deployer of incidents or updates that could affect the system’s compliance, and the deployer should have a clear route to notify the provider of problems it discovers. Timelines, contact points and the content of notifications should be specified.

Without those provisions, a deployer may learn of a failure only after harm has occurred. The contract should allow the deployer to suspend use, demand remediation and, where necessary, exit the arrangement without being locked into a non-compliant system.

Procurement as a governance gate

Procurement can become the point at which AI governance is enforced. No AI system should enter the estate without review of its risk classification, data flows, documentation, contract terms and exit options. An AI inventory tied to contract renewals helps legal teams track obligations, version changes and evidence over the vendor lifecycle. Exit provisions should cover data portability, deletion, transition assistance and continued access to logs for regulatory purposes.

A practical checklist for legal teams includes:

• Define the intended purpose and prohibited uses, and require notice of material changes.
• List the technical documentation, instructions for use, conformity evidence and update obligations the provider must supply.
• Allocate provider and deployer duties, including human oversight, monitoring, incident reporting and regulator cooperation.
• Grant proportionate audit, testing and log-access rights, with clear update and incident notification timelines.
• Include root-cause analysis, corrective action, suspension, termination and liability terms.
• Link the contract to the AI inventory and renewal cycle, and require exit assistance and data portability.

The Act’s compliance model is relational. A deployer cannot meet its duties alone, because the evidence and cooperation it needs sit with the provider. Contracts are where that evidence, cooperation and risk allocation are secured. Legal teams that treat AI procurement as regulatory design will be better placed than those that rely on policies alone.