AI procurement is now a governance event. A vendor can sell software, but the buyer still needs enough durable evidence to classify the system, understand who holds which role, implement the required controls, detect when the system changes, and prove why continued use remains justified.
The AI Act assigns distinct duties to importers, distributors and deployers of high-risk AI systems, and Article 25 can shift provider obligations to another actor after rebranding, substantial modification or a changed intended purpose. GPAI providers also have documentation duties toward downstream AI-system providers.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Vendor due diligence starts with role clarity. EU AI Act duties differ across providers, deployers, importers and distributors, and contractual labels do not necessarily override the role created by the actual facts.
Article 25 can shift provider obligations to a distributor, importer, deployer or other third party that rebrands a high-risk system, makes a substantial modification, or changes its intended purpose so it becomes high-risk.
For high-risk AI, procurement should capture the documentation, instructions, conformity materials, performance limits, logging capabilities, human-oversight design, known risks, incident pathways and change information needed for lawful deployment.
A new model, subprocessor, training source, API version, intended purpose, control threshold or product release can invalidate the prior due-diligence record. Contracts and operating procedures should preserve notification and revalidation pathways.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Do not procure “AI” generically. Record the system, model dependencies, intended purpose, deployment context, seller, provider, importer, distributor, deployer and any downstream or upstream actor whose evidence matters.
Map the system’s likely obligations to specific evidence: classification basis, instructions, technical documentation, conformity information, logs, oversight controls, risk information, Article 50 disclosures where relevant, and GPAI documentation where a model sits upstream.
Preserve who must provide what evidence, who owns incident escalation, who may modify the system, what changes require notice, what support is required for audits or authority requests, and what happens if evidence becomes stale or unavailable.
Treat a major release, new use case, new jurisdiction, changed model, substantial modification, new data flow or changed intended purpose as a trigger to revisit the role, classification and evidence state.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
The Act does not create one universal procurement checklist, but its role-based obligations make vendor evidence critical. Deployers of high-risk AI must use systems in accordance with instructions, assign competent human oversight, monitor operation, and report certain risks and serious incidents; importers and distributors also have verification and cooperation duties.
Yes. Under Article 25, a deployer or other third party can become the provider if it places its name or trademark on the system, makes a substantial modification while it remains high-risk, or changes the intended purpose so the system becomes high-risk.
At minimum, buyers should request enough information to identify the system and provider, classify the intended use, understand capabilities and limitations, implement required human oversight, preserve logs and records, manage incidents, and determine what changes require revalidation. High-risk and GPAI systems can require additional documentation.
The exact duty depends on role and system type. High-risk system providers must supply instructions and other required conformity information. GPAI model providers must provide downstream AI-system providers with information and documentation sufficient to understand model capabilities and limitations and support downstream compliance.
Yes as an operational control, even where the Act does not prescribe one universal contract clause. Material model, system, intended-purpose or control changes can alter classification, performance assumptions or legal obligations, so notification and revalidation rights are important evidence-governance mechanisms.
No. TA-14 can preserve role analysis, due-diligence evidence, supplier claims, gaps, contract-control state, changes and revalidation history. It does not provide legal advice, certification, conformity assessment or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views