{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","id":"AIPT-OBL-0030","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0030","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","short_title":"Written agreements with suppliers","category":"vendor_governance","summary":"A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must set out, in a written agreement, the information, capabilities, technical access and other assistance needed for the provider to meet its obligations, based on the generally acknowledged state of the art. Suppliers of free and open-source tools and components other than general-purpose AI models are outside this duty. The AI Office may publish voluntary model terms.\n","practical_action":"Insert AI Act information, access and assistance clauses into contracts with model, data and component suppliers.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 25(4)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["finance_and_credit","generative_ai","safety_critical"],"applicability":[{"description":"Providers of high-risk AI systems and their third-party suppliers of components, models, tools, services or processes.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Supplier agreement with AI Act information and access clauses","description":null,"artifact_type":"document"},{"title":"Supplier register with agreement status","description":null,"artifact_type":"register"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.10.3","note":"Supplier relationships aligned with the organisation's AI responsibilities.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1","note":"Policies for third-party AI risks.","confidence_level":"high","is_original":true}],"controls":[{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"satisfies","note":"The written agreement itself.","confidence_level":"high","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"},{"slug":"third-party-ai-due-diligence","title":"Vendor and third-party AI due diligence","kind":"process","relationship":"supports","note":"Identifies which suppliers fall within Article 25(4).","confidence_level":"medium","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}