Contractual allocation of AI duties across the supply chain
Writes into supplier and customer agreements who does what on documentation, testing, notification, data rights and cooperation, so that legal duties do not fall into the gap between organisations.
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 6 sections
- Duties satisfied
- 5
- done properly, does the work
- Duties supported
- 4
- contributes; the duty needs more
- Jurisdictions
- 4
- Evidence items
- 3
In brief
Contractual allocation of AI duties across the supply chain is a contractual term, owned by the legal counsel and carried out for each AI system. 9 recorded duties in 4 jurisdictions rely on it, and it satisfies 5 of them outright. It produces 3 kinds of evidence an auditor can ask for.
How is it implemented?
Legal maintains a set of AI clauses for supplier, customer and partner agreements. Supplier terms cover the information and documentation to be provided, notice of material changes and incidents, cooperation with regulators, audit rights and restrictions on repurposing data. Customer and deployer terms cover permitted uses, the instructions to be followed, feedback channels and the logs and records each side keeps. Deal teams select clauses based on the system's risk tier and the counterparty's role, deviations are approved by legal, and signed clauses are indexed against the register entry for the system.
Which legal duties does it serve?
Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.
Australia 1 duty
-
satisfies VoluntaryProvide contestability, supply-chain transparency and records (guardrails 7 to 9)
Australian Voluntary AI Safety Standard · Guardrails 7, 8 and 9
AI clauses make supply-chain transparency and record sharing enforceable.
European Union 6 duties
-
satisfies Legal requirement confidence highNon-EU providers must appoint an EU authorised representative for high-risk AI
EU AI Act · Article 22 · applies from 2 Dec 2027
The written mandate allocates the representative's tasks.
-
satisfies Legal requirement confidence highProviders of high-risk AI must have written agreements with suppliers of components, tools and services
EU AI Act · Article 25(4) · applies from 2 Dec 2027
The written agreement itself.
-
satisfies Legal requirement confidence highNon-EU providers of GPAI models must appoint an EU authorised representative
EU AI Act · Article 54 · applies from 2 Aug 2025
The mandate and its task list.
-
supports Legal requirementVerify conformity before importing or distributing high-risk AI
EU AI Act · Articles 23 and 24 · applies from 2 Dec 2027
Supplier terms require the paperwork and notice of changes.
-
supports Legal requirement confidence highDeployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI
EU AI Act · Article 25(1) and 25(2) · applies from 2 Dec 2027
Contracts set out cooperation from the original provider.
-
supports Legal requirementProvide deployers with clear instructions for use
EU AI Act · Article 13 · applies from 2 Dec 2027
Customer terms carry the instructions and feedback channels.
South Korea 1 duty
-
satisfies Legal requirement confidence highForeign AI business operators above the threshold must designate a domestic representative in Korea
AI Basic Act · Article 36 · applies from 22 Jan 2026
The written designation and the representative's task list.
Colorado (United States) 1 duty
-
supports Legal requirementDevelopers must supply deployers with documentation of the technology
Colorado ADMT law (SB 26-189) · applies from 1 Jan 2027
Contract terms that deliver the documentation to deployers.
What evidence shows it is operating?
| Evidence | Type | What it shows |
|---|---|---|
| AI supplier clause set | Contract clause or supplier term | Agreed terms on documentation, change and incident notice, cooperation, audit and data use. |
| AI customer or deployer clause set | Contract clause or supplier term | |
| Contract clause index against the AI register | Register entry |
Owner: Legal counsel. Frequency: once per ai system.
Which risks does it address?
Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.
- 6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
- 6.4 Competitive dynamics Socioeconomic & Environmental3 incidents · 21 risk entries
Which standards clauses does it correspond to?
Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001 | Annex A.10.2, A.10.3, A.10.4 | high | |
| NIST AI RMF | GOVERN 6.1; MANAGE 3.1 | medium |
Cite this record
AIPolicyTracker (2026). “Contractual allocation of AI duties across the supply chain” [AIPT-CTL-0011, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-CTL-0011 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-CTL-0011: it never changes or gets reused, and its address keeps working if this page moves.
BibTeX
@misc{aipolicytracker2026_contractualallocationofa,
author = {{AIPolicyTracker}},
title = {{Contractual allocation of AI duties across the supply chain}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties}},
url = {https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
Which legal duties does "Contractual allocation of AI duties across the supply chain" satisfy?
It is recorded as satisfying 5 and supporting 4 duties across Australia, European Union, South Korea and Colorado (United States). A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?
AI supplier clause set, AI customer or deployer clause set and Contract clause index against the AI register. Owner: Legal counsel. Frequency: once per ai system.