{"slug":"contractual-allocation-of-ai-duties","id":"AIPT-CTL-0011","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","kind_label":"Contractual term","purpose":"Writes into supplier and customer agreements who does what on documentation, testing, notification, data rights and cooperation, so that legal duties do not fall into the gap between organisations.\n","description":"Legal maintains a set of AI clauses for supplier, customer and partner agreements. Supplier terms cover the information and documentation to be provided, notice of material changes and incidents, cooperation with regulators, audit rights and restrictions on repurposing data. Customer and deployer terms cover permitted uses, the instructions to be followed, feedback channels and the logs and records each side keeps. Deal teams select clauses based on the system's risk tier and the counterparty's role, deviations are approved by legal, and signed clauses are indexed against the register entry for the system.\n","owner_role":"Legal counsel","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["6.5","6.4"],"evidence":[{"type":"contract_clause","title":"AI supplier clause set","description":"Agreed terms on documentation, change and incident notice, cooperation, audit and data use."},{"type":"contract_clause","title":"AI customer or deployer clause set","description":null},{"type":"register_entry","title":"Contract clause index against the AI register","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.10.2, A.10.3, A.10.4","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1; MANAGE 3.1","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","relationship":"supports","note":"Supplier terms require the paperwork and notice of changes.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","relationship":"satisfies","note":"AI clauses make supply-chain transparency and record sharing enforceable.","confidence_level":"medium","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records"},{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","relationship":"satisfies","note":"The written mandate allocates the representative's tasks.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","relationship":"supports","note":"Contracts set out cooperation from the original provider.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","relationship":"satisfies","note":"The written agreement itself.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers"},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","relationship":"satisfies","note":"The mandate and its task list.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative"},{"slug":"eu-ai-act-transparency-to-deployers","title":"Provide deployers with clear instructions for use","relationship":"supports","note":"Customer terms carry the instructions and feedback channels.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers"},{"slug":"south-korea-ai-basic-act-art-36-domestic-representative","title":"Foreign AI business operators above the threshold must designate a domestic representative in Korea","relationship":"satisfies","note":"The written designation and the representative's task list.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative"},{"slug":"us-colorado-admt-developer-documentation","title":"Developers must supply deployers with documentation of the technology","relationship":"supports","note":"Contract terms that deliver the documentation to deployers.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation"}],"related_controls":["third-party-ai-due-diligence","technical-documentation-and-model-cards","ai-system-inventory"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties","context_url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties.md"}