BLOG · 2026-06-25
The AI Act and suppliers: AI sneaks in through the back door
The EU AI Act also binds those who use AI through suppliers. Dates, risks and how to classify your systems before clients demand it.
Quick summary
- Regulation (EU) 2024/1689 (the AI Act) entered into force on 1 August 2024 and applies in phases.
- Already in force: the prohibitions and the AI literacy obligation (since 2 February 2025), and the rules on governance, general-purpose models and penalties (since 2 August 2025).
- General application lands on 2 August 2026. Obligations for high-risk Annex III systems were postponed towards late 2027 under the political agreement of May 2026 (the "AI omnibus"); confirm the consolidated date.
- The regulation applies to providers, deployers (those who use the AI), importers and distributors. It reaches SMEs and sole traders, and has extraterritorial scope.
- Penalties reach up to €35M or 7% of global turnover for prohibited practices.
- In Spain, the supervisory authority is AESIA (based in A Coruña); the AEPD keeps its powers where personal data is involved.
Why is AI a Procurement problem?
Because AI doesn't enter the company through a strategic project with a committee and a budget. It comes in through the back door: every time a new tool is contracted.
The hiring SaaS that scores candidates. The module that decides who gets credit. The system that segments customers or detects fraud. Many of those functions fall into categories the AI Act treats as high-risk (employment and HR, essential services like banking or health, biometrics, education). And when you bring that AI in through a supplier, the obligations don't vanish: they're split between whoever builds it and whoever deploys it. By using it, you are the deployer.
What obligations do you take on by using a supplier's AI?
In practice, you need to be able to answer four questions:
- What AI systems do I have running? Most companies don't even have the inventory.
- What risk category does each fall into? Unacceptable (prohibited), high, limited or minimal.
- What's on me as the deployer? Human oversight, transparency, documentation, staff training.
- What must the contract with that supplier include? Technical-information clauses, support and the split of responsibilities.
Why is this the window of opportunity?
Because almost nobody is doing it today, and the big supplier-management platforms barely touch the AI dimension: it's too new and too legal.
The AI Act won't sell on fear of fines yet. It will sell on something more immediate: your large clients will start requiring the classification of your AI systems in their own supplier vetting. Whoever arrives late loses the contract. Whoever builds the AI inventory and triage into the purchasing point today is two years ahead.
Keep reading
Was this article useful? Let's talk.