The most expensive assumption in enterprise AI is that compliance came with the licence. It did not. Under the EU AI Act, the company that puts an AI system to use carries duties of its own — separate from, and additional to, whatever the vendor carries.
Your supplier can be entirely compliant and you can still be exposed, because you are answerable for how the thing is used inside your organisation: who operates it, whether they understand it, who can overrule it, and what you can show afterwards.
Where the gap usually opens
Nobody wrote down what it is used for. A tool bought for one purpose gets pointed at another. The classification that was fine for the first use is not necessarily fine for the second, and nobody revisits it.
The people using it were never trained. The AI literacy duty has been in force since February 2025. It is not satisfied by a policy document. It is satisfied by the person at the keyboard understanding what the system does and where it fails.
The logs are on the vendor’s side. When you need to show what happened on a given day, you find out that the retention period is thirty days, or that the export is a screenshot.
The contract is silent. Most software contracts signed before 2024 say nothing about model changes, training data, incident notification or documentation. They were not wrong at the time. They are simply from a different era.
Six questions for your next procurement pack
- What exactly does this system do, and what will we not use it for? Written down, and re-checked when the use changes.
- What documentation do you provide, and does it stay current? Ask to see it before signing, not after.
- What can we log, export and keep — and for how long? If the answer is short, that is your retention period, not theirs.
- How and when are we told the model has changed? A silent upgrade can change the behaviour you validated.
- What happens to the data we put in? Specifically, whether it is used to train anything.
- Who do we call when it gets something seriously wrong, and how fast? Put the hours in the contract.
The clause most contracts are missing
Not an indemnity — a cooperation clause. A commitment that the supplier will give you, within a stated time, the information and records you reasonably need to meet your own obligations to a regulator or a customer.
It costs a vendor nothing to agree to at signature. It is close to impossible to obtain in the week you actually need it.
This applies to more than you think
Not just the obvious AI platforms. The recruitment tool that ranks candidates. The credit-decisioning module inside a finance suite. The monitoring feature switched on in a system you have run for years. The AI is often a feature of something you bought for another reason entirely, which is exactly why it never went through an AI review.
The question to ask on Monday
Which of our suppliers would we have to call if a regulator asked us to explain a decision — and does the contract oblige them to answer?
Most organisations find that the list is longer than expected and the contracts are quieter than they hoped. Better to find that out over a coffee than under a deadline.