Providers of high-risk AI must have written agreements with suppliers of components, tools and services

Practical action

Insert AI Act information, access and assistance clauses into contracts with model, data and component suppliers.

Who does it apply to?

Providers of high-risk AI systems and their third-party suppliers of components, models, tools, services or processes.

Actors

Provider / developer

Sectors

Cross-sector / all sectors

Use cases

AI in finance, credit and insuranceGenerative AI and foundation modelsSafety-critical and infrastructure

Applies from: 2 December 2027

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesContractual termLegal counsel · once per ai system
  Contractual allocation of AI duties across the supply chain

  Serves 9 recorded duties · evidence: AI supplier clause set, AI customer or deployer clause set, Contract clause index against the AI register

  The written agreement itself.

• supportsProcessProcurement or vendor risk lead · once per ai system
  Vendor and third-party AI due diligence

  Serves 6 recorded duties · evidence: AI supplier due-diligence assessment, AI supplier and component register, Supplier onboarding decision

  Identifies which suppliers fall within Article 25(4).

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• EU AI Act Role and Risk Classifier

  Checklist · XLSX · v4

• AI Vendor Due-Diligence Questionnaire

  Checklist · XLSX and DOCX · v3

• EU AI Act Article 50 Transparency Kit

  Kit · DOCX and XLSX · v44

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

All 8 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Providers of high-risk AI must have written agreements with suppliers of components, tools and services (EU AI Act)” [AIPT-OBL-0030, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0030 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0030: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

@misc{aipolicytracker2026_providersofhighriskaimus,
  author       = {{AIPolicyTracker}},
  title        = {{Providers of high-risk AI must have written agreements with suppliers of components, tools and services (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Verify conformity before importing or distributing high-risk AI — EU AI Act, European Union
• Provide contestability, supply-chain transparency and records (guardrails 7 to 9) — Australian Voluntary AI Safety Standard, Australia (voluntary)