# Providers of high-risk AI must have written agreements with suppliers of components, tools and services

- **Record type**: Obligation
- **Instrument**: Regulation (EU) 2024/1689 — Artificial Intelligence Act
- **Jurisdiction**: European Union
- **Category**: vendor_governance
- **Binding**: Yes
- **Applies from**: 2026-08-02
- **Provision**: Article 25(4)

## What the duty requires

A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must set out, in a written agreement, the information, capabilities, technical access and other assistance needed for the provider to meet its obligations, based on the generally acknowledged state of the art. Suppliers of free and open-source tools and components other than general-purpose AI models are outside this duty. The AI Office may publish voluntary model terms.

## What an organisation does about it

Insert AI Act information, access and assistance clauses into contracts with model, data and component suppliers.

## Controls that meet this duty

- Contractual allocation of AI duties across the supply chain (satisfies): https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties
- Vendor and third-party AI due diligence (supports): https://aipolicytracker.org/controls/third-party-ai-due-diligence

## Parent instrument

- Regulation (EU) 2024/1689 — Artificial Intelligence Act
  - Record: https://aipolicytracker.org/policies/eu-ai-act
  - Context file: https://aipolicytracker.org/policies/eu-ai-act.md

## Provenance

- **Record page**: https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers
- **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- **Provision**: Article 25(4)
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.