EU AI Act, AI procurement compliance

The Act classifies AI systems into four risk tiers based on the potential harm they pose. Most enterprise AI builds fall into the limited- or minimal-risk categories, but any system touching certain protected domains, employment decisions, access to education, credit scoring, biometric identification, critical infrastructure management, or law enforcement, may be high-risk, with substantially heavier compliance obligations.

Unacceptable-risk systems are prohibited outright. These include systems that manipulate people through subliminal or deceptive techniques, that exploit the vulnerabilities of specific groups, and most real-time remote biometric identification in publicly accessible spaces.

High-risk AI systems fall into two categories. The first covers AI components in products already regulated under EU harmonisation legislation (medical devices, machinery, aviation safety equipment) where CE marking obligations apply. The second covers stand-alone AI applications listed in Annex III: biometric categorisation, management of critical infrastructure, access to education and vocational training, employment and worker management, access to essential private services such as credit scoring, law enforcement and judicial risk assessment, and migration and asylum decisions.

For high-risk systems, the obligations before market placement are substantial. Providers must implement a risk management system, use training data that meets defined quality criteria, maintain detailed technical documentation, enable automatic logging, provide transparency information to deployers, enable human oversight, and demonstrate accuracy and robustness. Deployers of high-risk systems carry their own obligations, including conducting a fundamental rights impact assessment in certain cases.

The Act also introduces obligations for providers of general-purpose AI (GPAI) models, large foundation models that can be used across many tasks. All GPAI providers must supply technical documentation and comply with copyright transparency requirements. Providers of GPAI models with systemic risk (defined by a training compute threshold of 10²⁵ floating-point operations) face additional obligations including model evaluation, adversarial testing, and incident reporting to the European AI Office.

The Act places obligations on both providers (those who develop AI systems) and deployers, those who put them into use. If you commission a system and then operate it within the EU, you are the deployer. High-risk deployers must use the system in accordance with the provider's instructions, implement human oversight where required, and suspend use if the system presents a risk that the provider has not addressed.

Risk classification should happen before procurement, not after contract signature. A provider who cannot classify your intended use case by risk tier, naming the relevant Annex III category if it may be high-risk, either has not examined the use case or does not know the Act. Either is a procurement signal.

The timeline matters: the prohibition on unacceptable-risk systems applied from 2 February 2025; GPAI model obligations from 2 August 2025; high-risk system obligations under Annex III from 2 August 2026. If you are procuring a system that will be in operation past those dates, the obligations apply to the system as deployed, not only as originally built.

A provider who has delivered EU AI Act-relevant work answers risk-tier questions precisely. A provider who classifies every use case as minimal-risk without examining the use case, or who conflates EU AI Act compliance with GDPR compliance, has not done this before. The questions below are simple to ask and difficult to fake a substantive answer to.

Trustgent's provider profiles include an EU AI Act readiness attribute populated from cross-referenced evidence rather than self-declaration. A provider listed as AI Act-ready at L2 cross-reference level or above has had that attribute checked against sources the provider does not control, documentation, case studies, regulatory filings, third-party publications. We do not certify legal compliance; that is the role of notified bodies and national market surveillance authorities. What we do is distinguish, using our verification spectrum, between a claimed badge and an evidenced one.