Vendor and supply-chain governance: AI obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Keyword

Jurisdiction

Obligation category

Sector

AI use case

Actor

Binding

Sort

Reset

2 of 117 obligations match · Download these as CSV

Legal requirement Vendor and supply-chain governance European Union

Providers of high-risk AI must have written agreements with suppliers of components, tools and services

EU AI Act · Article 25(4)

A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must set out, in a written agreement, the information, capabilities, technical access and other assistance needed for the provider to meet its obligations, based on the generally acknowledged state of the art. Suppliers of free and open-source tools and components other than general-purpose AI models are outside this duty. The AI Office may publish voluntary model terms.

Verified 26 Sep 2026 Applies from 2 Dec 2027

Legal requirement Vendor and supply-chain governance European Union

Verify conformity before importing or distributing high-risk AI

EU AI Act · Articles 23 and 24

Importers must verify that the provider completed conformity assessment, drew up technical documentation, affixed CE marking and appointed an authorised representative where required, and must indicate their name and contact details on the system. Distributors must verify CE marking, the declaration of conformity and instructions, and refrain from making non-compliant systems available.

Pending review Applies from 2 Dec 2027

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.