Vendors switch AI on through an update, a new licence tier or a price letter. We make sure your requirements are on the table before their terms are: at selection, at renewal and at the next price letter.
Most organisations don't buy AI; they get it thrown in. Microsoft 365, Salesforce, your HR system, the helpdesk tool: every quarter AI features are added, often switched on by default and sometimes at an extra price. The contract you signed says nothing about it. AI procurement is the craft of arranging that after all, at the three moments when you still have a say.
The only moment when requirements cost nothing extra. Whoever fails to pin down data use, model training, liability and the option to switch AI features off here negotiates from nothing later.
An update, a new licence (the 'Copilot' tier), a changed data processing agreement. This is the moment for an AI addendum: short, targeted, without reopening the whole contract.
The last chance with leverage. Every renewal in your register is a decision moment to put AI terms, price and usage in order in one go.
Which AI features are switched on in which applications, who uses them for what, and which EU AI Act risk class that falls into. From that follows, per system, what you may demand from the vendor and what you must arrange yourself.
A set of requirements with AI questions a vendor must answer concretely, with weighting. Usable in a European tender and in a private request for proposal.
Data use, model training, transparency about new features, liability for AI output, location of processing and exit, as clauses in a new contract or as an addendum to an existing one.
The AI your vendor itself buys from third parties (model providers, sub-processors): insight, approval rights on changes and flow-down of your requirements to those parties.
A vendor who answers these questions readily is usually also the vendor willing to put them in the contract. One who talks around them has given you your first finding.
The regulation places the heaviest duties on the provider of an AI system, but the organisation using it has obligations of its own: knowing which AI you deploy, following the provider's instructions, arranging human oversight where required, and for high-risk uses being able to show that you do. The obligations take effect in stages; which date counts for you depends on the use.
In practice that means: an inventory that is correct, contracts that hold the provider to its duties, and a fixed moment each year to look at it again. That last part is exactly what VendorManager.nl does as a service: keep the AI inventory with risk classes, put vendors' AI addenda and declarations on file, and prepare every renewal and annual review with the AI terms included.
AI clauses are not the same as the data processing agreement. That covers personal data under the GDPR; AI clauses also cover non-personal data, model training, liability for output, transparency about new features and the option to switch AI off. You need both, and they must not contradict each other.
Schedule a no-obligation call with Bob Goosen or take the free Sourcing Quick Scan first.
Schedule a call Take the free Quick Scan