Which legal duties does "Contractual allocation of AI duties across the supply chain" satisfy?

It is recorded as satisfying 5 and supporting 3 duties across Australia, European Union and South Korea. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.

What evidence shows this control is operating?

AI supplier clause set, AI customer or deployer clause set and Contract clause index against the AI register. Owner: Legal counsel. Frequency: once per ai system.

Contractual term Owner: Legal counsel Once per AI system

Contractual allocation of AI duties across the supply chain

Writes into supplier and customer agreements who does what on documentation, testing, notification, data rights and cooperation, so that legal duties do not fall into the gap between organisations.

Source-linked Context file

Duties satisfied: 5; done properly, does the work
Duties supported: 3; contributes; the duty needs more
Jurisdictions: 3
Evidence items: 3

How is it implemented?

Legal maintains a set of AI clauses for supplier, customer and partner agreements. Supplier terms cover the information and documentation to be provided, notice of material changes and incidents, cooperation with regulators, audit rights and restrictions on repurposing data. Customer and deployer terms cover permitted uses, the instructions to be followed, feedback channels and the logs and records each side keeps. Deal teams select clauses based on the system's risk tier and the counterparty's role, deviations are approved by legal, and signed clauses are indexed against the register entry for the system.

Which legal duties does it serve?

Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.

Australia 1 duty

satisfies Voluntary
Provide contestability, supply-chain transparency and records (guardrails 7 to 9)
Australian Voluntary AI Safety Standard · Guardrails 7, 8 and 9

AI clauses make supply-chain transparency and record sharing enforceable.

European Union 6 duties

satisfies Legal requirement confidence high
Non-EU providers must appoint an EU authorised representative for high-risk AI
EU AI Act · Article 22 · applies from 2 Aug 2026

The written mandate allocates the representative's tasks.
satisfies Legal requirement confidence high
Providers of high-risk AI must have written agreements with suppliers of components, tools and services
EU AI Act · Article 25(4) · applies from 2 Aug 2026

The written agreement itself.
satisfies Legal requirement confidence high
Non-EU providers of GPAI models must appoint an EU authorised representative
EU AI Act · Article 54 · applies from 2 Aug 2025

The mandate and its task list.
supports Legal requirement
Provide deployers with clear instructions for use
EU AI Act · Article 13 · applies from 2 Aug 2026

Customer terms carry the instructions and feedback channels.
supports Legal requirement
Verify conformity before importing or distributing high-risk AI
EU AI Act · Articles 23 and 24 · applies from 2 Aug 2026

Supplier terms require the paperwork and notice of changes.
supports Legal requirement confidence high
Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI
EU AI Act · Article 25(1) and 25(2) · applies from 2 Aug 2026

Contracts set out cooperation from the original provider.

South Korea 1 duty

satisfies Legal requirement confidence high
Foreign AI business operators above the threshold must designate a domestic representative in Korea
Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust · Article 36 · applies from 22 Jan 2026

The written designation and the representative's task list.

What evidence shows it is operating?

Evidence this control produces
Evidence	Type	What it shows
AI supplier clause set	Contract clause or supplier term	Agreed terms on documentation, change and incident notice, cooperation, audit and data use.
AI customer or deployer clause set	Contract clause or supplier term
Contract clause index against the AI register	Register entry

Owner: Legal counsel. Frequency: once per ai system.

Which risks does it address?

Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.

6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
6.4 Competitive dynamics Socioeconomic & Environmental3 incidents · 21 risk entries

Which standards clauses does it correspond to?

Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.

Framework references
Framework	Reference	Note	Confidence
ISO/IEC 42001	Annex A.10.2, A.10.3, A.10.4		high
NIST AI RMF	GOVERN 6.1; MANAGE 3.1		medium

Cite this record

AIPolicyTracker (2026). “Contractual allocation of AI duties across the supply chain”. https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties (accessed 24 September 2026). Data licensed CC BY 4.0.

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.

Governance card

Kind: Contractual term
Owner: Legal counsel
Frequency: Once per AI system
Binding duties: 7 of 8
Review status: Pending human review

Confirm which of the duties above reach you (applicability check).
Assign the owner and the frequency.
Operate the control and keep the evidence listed.
Re-check when a duty changes (change log).

Related controls

AI system inventory and classification Process
Technical documentation, model cards and instructions for use Process
Vendor and third-party AI due diligence Process

Report a correction How we verify

Run this control as a tracked task with Certifyi, a separate compliance execution platform. AIPolicyTracker itself stays open and independent.

Frequently asked questions

Which legal duties does "Contractual allocation of AI duties across the supply chain" satisfy?: It is recorded as satisfying 5 and supporting 3 duties across Australia, European Union and South Korea. A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?: AI supplier clause set, AI customer or deployer clause set and Contract clause index against the AI register. Owner: Legal counsel. Frequency: once per ai system.