EU AI Act in procurement: what buying teams need to do now

The EU AI Act reaches procurement in two ways: your team uses AI, and it buys AI systems for the rest of the business. The prohibitions, the duty to take AI literacy measures and the transparency rules already apply; high-risk obligations under Annex III follow on 2 December 2027. Procurement teams should now list and classify their AI use cases, set rules and training, and align new AI contracts with the Regulation.

Which EU AI Act rules apply today, and which come later?

The AI Act applies in stages. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, moved several dates and has been in force since 27 July 2026. Older EU AI Act timelines showing 2 August 2026 as the high-risk deadline are out of date. This article reflects the position on 3 November 2026.

Date	What applies	What it means for procurement
2 Feb 2025	Prohibited practices (Art. 5), AI literacy (Art. 4)	Applies. Art. 4 was rewritten in 2026, see below.
2 Aug 2026	General application, including transparency duties (Art. 50)	Applies. Matters for AI agents that deal with suppliers.
2 Dec 2026	New prohibitions, for example on non-consensual intimate images (Art. 5(1)(ba) and (bb)); deadline for existing systems to mark synthetic content (Art. 111(4))	Mainly affects AI providers rather than daily buying work.
2 Dec 2027	High-risk systems under Annex III, including deployer obligations (Art. 113, third paragraph, point (c))	Relevant if you use such systems or buy them for other departments.
2 Aug 2028	High-risk systems under Annex I, such as in regulated products	Relevant when buying those products.
2 Aug 2030	Existing high-risk systems intended for use by public authorities (Art. 111(2))	Relevant for public buyers.

Under Article 111(2), high-risk systems already on the market or in service before the relevant date generally fall under the Regulation only if their design changes significantly afterwards. Keep that in mind for running contracts and software updates. The 2030 deadline for public authorities applies regardless.

In Germany, the KI-MIG has been in force since 29 July 2026. Unless the KI-MIG provides otherwise, the Federal Network Agency (Bundesnetzagentur) is the market surveillance authority, and it is the central complaints body (sections 2 and 8 of the KI-MIG).

Which role does procurement play under the AI Act?

Your role decides your obligations under the EU AI Act. A deployer uses an AI system under its authority in a professional context (Art. 3(4)). A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name (Art. 3(3)). If you simply use a tool you bought, you are normally a deployer.

That role can change. Under Article 25(1), you are treated as the provider of a high-risk system if you put your name or trademark on one, substantially modify one, or change the intended purpose of another system so that it becomes high-risk. This is a common trap for buying teams: if you use a general-purpose tool for an Annex III task, have your role checked by a lawyer. What counts is what you use the tool for.

Is AI in procurement high-risk under the EU AI Act?

In our assessment, most everyday procurement use cases fall outside Annex III, which does not list purchasing as an area of its own. The cases to watch are those where AI evaluates people rather than goods or companies. The table below is a guide, not a legal assessment. When this article went to press, the Commission’s guidelines on high-risk classification were available to us only as a draft from May 2026.

Procurement use case	Likely classification	What to do
Drafting, research and summaries with an assistant	Not an Annex III case	Art. 4, internal rules
Classifying spend, assigning categories	Not an Annex III case	Art. 4, spot checks
Comparing quotes, evaluating suppliers as companies	Probably not an Annex III case, as long as only companies and their offers are evaluated	Art. 4, keep the decision with a person; check further for sole traders, contractors, or where staff such as CVs are assessed too
AI agent corresponding directly with suppliers	Transparency duty (Art. 50(1))	Ensure disclosure, see below
Selecting and evaluating self-employed contractors	May fall under Annex III(4), which covers the selection of natural persons and access to self-employment; how far this reaches for individual contracts is unclear	Until clarified, treat as high-risk, take legal advice, consider Art. 25
Assessing the creditworthiness of individuals, such as sole traders	Needs checking: Annex III(5)(b)	Take legal advice
Monitoring and evaluating the performance and behaviour of your own buyers	Probably Annex III(4)(b)	Plan for high-risk obligations, involve staff representatives
Detecting the emotions of your own staff from voice or video	Prohibited under Art. 5(1)(f), except for medical or safety reasons	Do not use
Detecting the emotions of a supplier’s negotiators from voice or video	At least high-risk (Annex III(1)(c)); whether the prohibition applies needs checking	Do not use without legal review; inform those affected (Art. 50(3))

Emotion recognition under the Regulation is based on biometric data (Art. 3(39)). Text-only analysis is therefore unlikely to fall under these two rows, but should still be checked case by case.

Annex III has an exemption. Under Article 6(3), a system is not high-risk if it poses no significant risk and meets one of four conditions, for instance performing a narrow procedural task or a preparatory task. This never applies where the system profiles natural persons. The provider documents this assessment and must register it (Art. 6(4)). Ask to see it.

When must an AI agent identify itself to suppliers?

Article 50(1) requires that people learn they are interacting directly with an AI system unless that is obvious. The Commission’s guidelines of July 2026 are non-binding but speak directly to procurement. They mention AI agents that handle correspondence or execute purchases (para. 31). Such agents should be designed to disclose that they are artificial and on whose behalf they act, including where contact with a person is merely reasonably likely.

The guidelines also set limits. If a buyer uses AI as an aid, properly reviews the reply and sends it personally, that is not direct interaction under the provision (para. 30). Purely machine-to-machine calls whose output never reaches a person are not covered either. The duty sits with the provider. For a purchased agent, that is normally the vendor, but it can be your own company if you offer an agent under your own name, or build one and put it into service for your own use (para. 11). So settle who implements disclosure before you go live.

What should procurement teams do about the EU AI Act now?

Five steps are enough to start. They are our recommendation and do not come word for word from the Regulation.

1. Build an AI inventory: Which tools does the team use, for which task, with which data? Include AI features inside existing software.
2. Classify each use case: Role, risk class, owner. Flag borderline cases for legal review.
3. Set rules for use: Which tool is approved for which purpose? A clear boundary stops a tool drifting unnoticed into an Annex III purpose.
4. Build and record AI literacy: Since its rewrite, Article 4 requires measures to support the AI literacy of staff and others acting on your behalf. You do not have to guarantee a specific level for any individual. For what this means in practice, see our overview of the prerequisites for AI in procurement.
5. Adapt the buying process: Give every new AI purchase a fixed review, including software requested by other departments.

What should you look for when buying AI systems?

Here procurement acts as gatekeeper for the whole company: what the contract leaves open is hard to fix later. For Annex III systems from December 2027, Article 26 sets out duties for deployers of high-risk systems, including use in line with the instructions, human oversight by competent people, monitoring, keeping logs for at least six months, and informing workers, their representatives and affected persons. Public buyers must also observe the registration duties (Art. 26(8)) and, in the cases covered by Article 27, carry out a fundamental rights impact assessment before deployment. Those duties translate into questions for your vendor.

Public buyers can draw on the EU model contractual clauses, available in a version for high-risk AI and a light version for other systems. They date from March 2025, before the Digital Omnibus. Private buyers can use them as a checklist too, but should check any dates against the current text of the Regulation.

What fines does the EU AI Act provide for?

Breaches of the Article 5 prohibitions can be fined up to EUR 35 million or 7 per cent of worldwide annual turnover (Art. 99(3)), and breaches of provisions including Articles 26 and 50 up to EUR 15 million or 3 per cent (Art. 99(4)). The higher figure generally applies. For SMEs the lower figure applies in each case (para. 6), and the same goes for small mid-caps under paras. 4 and 5 (para. 6a).

Article 4 is not listed in Article 99(4), and the KI-MIG has no separate fine for it. The duty still stands.

In Germany, authorities and other public bodies as defined in section 2(1) or (2) of the Federal Data Protection Act are not fined in the cases covered by Article 99(3) to (5) and section 15(1) and (2) of the KI-MIG (section 17(2) of the KI-MIG).

Your next step

You can build the inventory yourself; we can help with building skills. Our AI enablement and training works with examples from your own procurement and sets clear rules for handling data; it does not replace legal advice. If you are buying a new AI tool, vendor-neutral AI tool selection helps you build the questions above into the process.

For a no-obligation initial call, please use the contact form.

Sources

• Regulation (EU) 2024/1689 (AI Act), consolidated version of 27 July 2026, EUR-Lex
• Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Official Journal of the EU, 24 July 2026
• KI-MIG, German Act on market surveillance and innovation support for AI (in German), BGBl. 2026 I No. 223
• European Commission: Guidelines on the implementation of the transparency obligations under Article 50, C(2026) 5054, 20 July 2026
• European Commission: Guidelines on the classification of high-risk AI systems, draft, AI Act Service Desk
• Public Buyers Community: Updated EU AI model contractual clauses, 5 March 2025