The EU AI Act is entering into force in stages, and most organisations focus on their own AI. The catch lies elsewhere: the regulation also expects you to have a grip on the AI that comes in through your vendors. And that AI is often already in the software you run — sometimes without anyone having switched it on.
What the AI Act expects of you — including at vendors
The AI Act is risk-based: the higher the risk of an AI system, the stricter the requirements. For your sourcing that means looking not only at your own applications but also at the AI in the services you buy. If a vendor runs high-risk AI in your processes, it becomes your responsibility.
The regulation doesn't ask you to slow innovation. It asks you to be demonstrably in control: to know which AI is in play, which risk class it falls into and what measures are attached.
Start with an inventory and risk class
The first step is unspectacular but indispensable: map which AI runs in the software you buy. Which vendor, which system, which purpose, which data? Many organisations discover AI features here whose existence they weren't aware of.
Then determine the risk class per system under the AI Act. That determines which requirements apply — from basic transparency to heavier obligations around documentation, human oversight and logging.
From requirement to demonstrable file
Compliance is ultimately about demonstrability. Translate the requirements per risk class into concrete agreements you include in selection and contract, and record the outcomes in a file per vendor. That file is what you show your board, your client and the regulator.
Do this at procurement time and it's part of the negotiation and virtually free. Do it afterwards and you negotiate from a weak position and pay the bill in time and extra costs.
What you'd do now
Start an AI inventory across your entire vendor landscape and classify each system by risk.
Include AI requirements and a file obligation as standard in your specification and your contracts, so every new or renewed agreement is automatically AI-Act-proof.
This article provides general information and is not legal or financial advice. Want to apply it to your own situation? Get in touch.