The EU AI Act: why procurement cannot delegate AI compliance to legal or IT

On August 2, 2026, the world's first comprehensive regulatory framework for artificial intelligence becomes fully enforceable. The EU AI Act imposes fines of up to EUR 35 million or 7% of global annual turnover for violations. It requires organizations to inventory, classify, document, and audit every AI system they use or procure. And despite what most CPOs assume, the person on the hook for much of this compliance work is not the general counsel or the CIO — it is the procurement function.

A 2025 survey by Ardent Partners found that 62% of procurement leaders believe AI will have a "transformational" or "significant" impact on procurement within 2–3 years. Yet most organizations have not assigned ownership of AI Act compliance to their procurement teams. The gap between awareness and preparation is wide — and with enforcement 10 weeks away, it is also expensive.

Why procurement is in scope — not just legal or IT

The EU AI Act defines four roles in the AI value chain: provider, deployer, importer, and distributor. Procurement teams become deployers the moment they use an AI system in a professional context. They become responsible for supplier AI compliance when they contract a SaaS platform, a business process outsourcing arrangement, or an industrial equipment purchase that embeds AI — which is most of them.

The Act's obligations cascade down the supply chain. Procurement cannot contract with an AI provider and claim ignorance of the provider's compliance status. The official text of Regulation (EU) 2024/1689 requires deployers to use AI systems in accordance with the provider's instructions for use, monitor operation for risks, and suspend use if a serious incident occurs. These are operational obligations that sit with the team that manages the supplier relationship.

When a supplier's warehouse management system uses AI to optimize picking routes and that system makes a decision that impacts worker safety, procurement is the function that contracted that system, manages the SLA, and holds the relationship. Legal writes the contract. IT integrates the API. But procurement owns the supplier — and the Act makes that ownership legally consequential.

The high-risk classification trap

High-risk AI systems trigger the most demanding obligations under the Act: conformity assessments, technical documentation, risk management systems, human oversight, and accuracy and robustness requirements. The EU AI Act Portal lists Annex III use cases that include employment and worker management, access to essential services (credit, insurance, healthcare), critical infrastructure management, and law enforcement.

For procurement, the trap is that many systems that appear innocuous fall into high-risk categories. AI-powered recruitment and workforce scheduling tools are high-risk under employment management. Automated supplier credit scoring and payment term optimization tools are high-risk under access to essential services. Warehouse robotics and logistics AI that affect worker safety fall under product safety regulation referenced in Annex I.

Most organizations have not conducted even a preliminary inventory of which supplier AI systems touch these categories. According to the Keystone Procurement 2026 analysis, the shift from "What can AI do?" to "Where are organizations actually deploying it?" has revealed that most companies still lack a framework for classifying AI risk across their supplier base. Procurement teams that wait for legal to flag high-risk systems will discover the problem after the contract is signed, not before.

What enforcement looks like in practice

The Act enters full enforcement on August 2, 2026 — less than three months from this article's publication date. But the timeline is more nuanced than a single deadline:

• August 2, 2025: General-purpose AI (GPAI) obligations took effect. GPAI providers must comply with transparency, copyright, and training-data disclosure requirements.
• August 2, 2026: Full enforcement begins. Enforcement powers for GPAI models activate. Fines of up to EUR 15 million or 3% of global turnover apply to GPAI providers.
• August 2, 2027: Full compliance required for high-risk AI systems already on the market.

The 2027 extension for existing high-risk systems creates a dangerous assumption among procurement teams: that they have another year. They do not. New supplier contracts signed in 2026 will be governed by the Act from day one. Kodiak Hub's 2026 trends analysis notes that procurement is being pushed into a "24/7 risk-orchestrator role" — and AI compliance is the most immediate example. Contracts signed today without AI Act clauses will need to be reopened, renegotiated, or terminated when enforcement begins.

The Market Dojo procurement regulations guide outlines a practical 2026 checklist: inventory all AI systems used by suppliers, classify risk levels, update standard contracts to include AI Act clauses, prepare P2P systems for structured e-invoicing under ViDA, and implement supplier data-access requirements. The guide estimates that organizations face five converging regulatory shifts in 2026 — and the AI Act is the one with the shortest fuse.

The contractual gap that creates liability

Standard procurement contracts as of early 2026 do not address the EU AI Act. They contain data protection clauses (GDPR), service level agreements, termination provisions, and indemnification language. But they do not require suppliers to provide AI Act conformity assessments, document their AI model architecture and training data, disclose subcontractors whose AI systems touch the buyer's data, or commit to ongoing compliance monitoring.

This gap matters because the Act imposes obligations on deployers that depend entirely on information only the provider can supply. How does a procurement team confirm that a supplier's AI system has passed a conformity assessment if the contract does not require the supplier to provide it? How does a procurement team monitor for serious incidents if the contract does not mandate incident reporting? How does a procurement team exercise its obligation to suspend use if the contract does not define what constitutes non-compliance?

The liability does not stop at regulatory fines. The Act explicitly permits individuals and organizations to seek damages for violations. A supplier's non-compliant AI system that causes harm creates a chain of liability that traces back to the procurement team that selected, contracted, and managed that supplier without conducting AI due diligence.

What every CPO should have in place by September 2026

The compliance checklist for procurement is concrete and time-bound. Every item below maps to a specific obligation in the Act:

Inventory every AI system. Procurement must know which of its suppliers provide AI-enabled products or services. This is not a departmental survey — it is a line-by-line audit of every active contract, every SaaS subscription, every equipment lease, every BPO arrangement. Tools in scope include any system that uses machine learning, natural language processing, computer vision, or generative AI to make or inform decisions.

Classify each system by risk level. The Act defines four risk categories: unacceptable (banned), high-risk, limited-risk (transparency obligations), and minimal-risk (no obligations). Procurement does not need to become an AI regulation expert, but it must be able to categorize supplier systems and escalate high-risk classifications to the cross-functional compliance team.

Update standard contract templates. Every new supplier contract and every renewal must include AI Act compliance clauses. The EU AI Act Portal provides guidance on documentation requirements that should flow into contractual obligations. Minimum clauses: provider confirmation of conformity assessment completion, documentation on model use and training data, commitment to ongoing compliance monitoring, incident notification obligations, subcontractor disclosure requirements, and audit rights for the buyer.

Implement a supplier AI compliance assessment process. Before onboarding a new supplier whose services include AI, procurement must run a compliance assessment. For high-risk systems, this means reviewing the provider's conformity assessment, technical documentation, and risk management system. For limited-risk systems, it means confirming transparency obligations are met. For minimal-risk systems, documentation is sufficient.

Audit existing high-risk suppliers. For suppliers already under contract that provide high-risk AI systems, procurement must begin the compliance gap analysis now. The 2027 transition period for existing high-risk systems does not mean deferring action. It means the compliance work must be completed before the August 2027 deadline — and that work involves renegotiating contracts, requesting documentation, and potentially replacing non-compliant suppliers.

Establish cross-functional governance. No single function can own AI Act compliance alone. Legal owns the regulatory interpretation. IT owns the technical assessment. Risk owns the incident response framework. But procurement owns the supplier relationship — and must be the function that coordinates across these domains for every AI-enabled supplier. The Focal Point 2026 outlook identifies unified data management across ERPs, S2P platforms, and risk tools as the foundation that makes compliance scalable. Without it, procurement will be assessing AI compliance contract by contract — and there are too many contracts for that to work.

What this means in practice

The organizations that will navigate the EU AI Act with minimal disruption share three characteristics:

First, they treat AI compliance as a procurement process, not a legal project. The general counsel's office can produce the regulatory interpretation. Procurement must operationalize it. The difference between a compliance clause in a contract template and a compliance clause that is actually negotiated, agreed, and enforced across 500 supplier contracts is the difference between preparation and exposure. An April 2025 study by Ardent Partners found that 62% of procurement leaders expect AI to be transformational for the function — but transformation requires operationalization, not documentation.

Second, they start the inventory now. A full supplier AI audit for an enterprise with 2,000 active suppliers takes 8–12 weeks. Starting in May 2026 means completing the audit by August, when enforcement begins. Starting in July means running against the deadline. Starting in September means discovering the problem after the regulator has already begun asking questions.

Third, they coordinate across functions before the crisis, not during it. The Barkers Procurement 2026 trends analysis describes this year as a "watershed" for the procurement sector — the moment when digital procurement, ESG integration, and regulatory readiness converge into a single operational imperative. AI Act compliance is the test case. Organizations that manage it well will have a framework they can apply to CSDDD, ViDA, the EU Data Act, and the next set of regulatory obligations already in the pipeline.

The EU AI Act is not a technology regulation that happens to touch procurement. It is a procurement regulation that happens to govern technology. The distinction matters — because the team that owns the supplier relationship also owns the liability. Legal can write the contract. IT can assess the system. But procurement must ensure that every AI-enabled supplier in the portfolio is compliant, documented, and auditable before enforcement begins.

The clock is running. August 2, 2026 is 10 weeks away.

Common questions about the EU AI Act and procurement