After the vendor questionnaire comes the contract. Enterprise buyers now add EU AI Act clauses to the master agreement, or send a separate AI addendum with the order form. Some of those clauses are reasonable and cheap to accept. Some ask you to promise things the Act does not require of you, or things only the customer controls. This guide goes through the clauses that come up, what each one is for, and where an honest vendor can sign, narrow or push back.
A clause should never say more than your documented classification. If the contract promises more than your dated assessment supports, the contract is what the buyer will rely on, and what an investor will read in due diligence.
This is a guide to the issues, not legal advice. Have a lawyer read the final wording before you sign, especially anything on liability.
Why buyers want AI Act terms at all
Your customer is usually the deployer of your AI features under Article 3(4), and you are the provider under Article 3(3). The Act gives each role its own duties, and the buyer needs some things from you to meet theirs. For high-risk systems, Article 26 requires deployers to use the system in line with the provider's instructions for use, assign human oversight and keep logs. They cannot do that without the information Article 13 obliges you to give.
There is also one place where the Act asks for a contract directly. Under Article 25(4), a provider of a high-risk AI system and a third party that supplies AI systems, tools, services or components integrated into it must set out by written agreement the information, capabilities, technical access and other assistance the provider needs. If your customer builds a high-risk system with your component inside, expect an addendum.
Public buyers can also start from the EU model contractual AI clauses, published through the Commission's community of practice on public procurement of AI, in a version for high-risk systems and a lighter one for others. If you sell to the public sector, read them before the tender arrives.
The clauses, one by one
1. The general compliance warranty
What it says: "Supplier warrants that the Services comply with the EU AI Act and all applicable laws on artificial intelligence." The problem: obligations under the Act attach to roles, not products. Some depend entirely on how the customer uses the system. A blanket warranty makes you answer for duties that are not yours. A narrower version:
Supplier will comply with the obligations under Regulation (EU) 2024/1689 that apply to Supplier as provider of the AI features listed in Schedule [X], as classified in Supplier's assessment dated [date].
Most buyers accept this when the schedule exists. It tells them exactly what they are getting, which a blanket warranty does not.
2. The classification representation
What it says: "No part of the Services is a high-risk AI system." Sign if your classification is documented and current. Add a carve-out for use outside the intended purpose. Under Article 25(1), a customer who changes the intended purpose of a system so that it becomes high-risk can become its provider. You cannot represent how a customer will use your product, only what you built it for.
Supplier has classified the AI features in Schedule [X] as not high-risk for the intended purpose described there. This does not extend to use for any purpose listed in Annex III of Regulation (EU) 2024/1689 that is not described in Schedule [X].
3. Prohibited practices
What it says: "Supplier will not use any AI practice prohibited under Article 5." Sign it, and make it mutual. Article 5 has applied since 2 February 2025, and some prohibited uses, such as emotion recognition on employees, depend on what the customer does with a general feature. Add the customer's matching commitment in your acceptable use policy.
4. Transparency
What it says: "Supplier will meet all transparency obligations." Split it by paragraph. Article 50(1) chatbot disclosure and Article 50(2) machine-readable marking are provider duties: yours. Article 50(3) and 50(4), emotion recognition notices and deepfake disclosure, bind the deployer: theirs. Add one line that the customer will not remove or hide the disclosure you build in, because a disclosure the customer switches off fails both of you. Disclosure wording that holds up.
5. Information and cooperation
What it says: "Supplier will provide all information the Customer requests to meet its obligations." Accept the purpose, limit the scope. Offer the documentation reasonably needed for the customer's own duties under the Act: your classification, your disclosure, your model provider, and for high-risk systems the instructions for use under Article 13 and anything the customer needs for a fundamental rights impact assessment under Article 27, where that applies to them. "All information requested" has no end.
6. Change notification
What it says: "Supplier will notify the Customer of any change to the AI features." Sign a defined version. Commit to notice of material changes: a new intended purpose, a change of model provider, or a change of classification. Pick a notice period you can actually meet. Routine model updates that change neither purpose nor tier should not need a letter.
7. Audit rights
What it says: "Customer may audit Supplier's AI Act compliance." Offer layers. Documentation first, then a written questionnaire, and on-site audits only where a feature is high-risk, with limits on frequency, notice and cost. Most buyers want the paper, not the visit.
8. Logs and records
What it says: "Supplier will retain logs of all AI outputs for [period]." For high-risk systems the Act sets a floor: providers keep the logs under their control for at least six months (Article 19), and deployers keep theirs for at least six months (Article 26(6)). For other systems, logging is purely contractual. Check any retention period against your GDPR data minimisation before you agree to it.
9. Incidents
What it says: "Supplier will notify the Customer of any AI incident within 24 hours." Serious incident reporting to authorities under Article 73 applies to providers of high-risk systems. Everything else is contractual. Define what counts as an incident, and choose a window you can meet with the team you have.
10. Fines and indemnities
What it says: "Supplier will indemnify the Customer against any fines or losses arising from the EU AI Act." The problem: fines under Article 99 are set for the operator that breached its own obligations, and an open indemnity can make you pay for the customer's deployer failures. Tie any indemnity to your own breach of duties you actually carry, and keep it inside the liability cap or a defined, separate cap. This is the clause to take to a lawyer. For scale, the fine calculator shows the Article 99 ceiling at a given turnover, and the penalties guide explains the SME rule in Article 99(6).
11. Training on customer data
Usually a GDPR and confidentiality question asked under the AI heading. Answer with a plain yes or no, name the data and the model provider's data-use terms, and point to the data processing addendum rather than restating it.
At a glance
| Clause | Usually fine | Push back when | Basis |
|---|---|---|---|
| Compliance warranty | Tied to your listed features and role | It covers "all AI laws" and the customer's use | Articles 3(3), 3(4) |
| Not high-risk | With a dated classification | No carve-out for new purposes | Articles 6, 25(1) |
| Prohibited practices | Always, made mutual | Only you are bound | Article 5 |
| Transparency | Split by paragraph | You carry deployer duties | Article 50 |
| Information | What their own duties need | "Anything requested" | Articles 13, 26, 27 |
| Change notice | Material changes, defined | Every model update | Contract |
| Audit | Documents, then questionnaire | On-site, unlimited, at your cost | Contract |
| Logs | Six months for high-risk | It conflicts with GDPR minimisation | Articles 19, 26(6) |
| Fines indemnity | Your own breach, capped | Uncapped, any cause | Article 99 |
Keep the contract and the paperwork aligned
The schedule of AI features in the contract, the answers in the questionnaire and the classification in your data room should be the same document, or at least say the same thing. Build the schedule from your AI inventory, answer the questionnaire from the same rows, and re-issue all three when a feature changes. The vendor questionnaire guide covers the answers; investors check the contracts too, as the due diligence guide explains.
Do not sign words you cannot prove. There is no EU AI Act certificate for limited-risk or minimal-risk systems: conformity assessment under Article 43 and CE marking apply to high-risk systems only. A clause stating that your product is "certified" or "fully compliant with the EU AI Act" is a warranty a buyer can test later. "Classified as limited risk, Article 50(1) disclosure in place since [date]" is a fact they can check today.
A Reglynn gap report gives you the dated classification, role analysis and Article references to put in a contract schedule, in one document. See a sample report before you decide. It is a self-assessment, not legal advice, and it does not replace a lawyer's review of the contract itself.
Frequently asked questions
Do I have to sign an AI addendum to sell to an enterprise customer?
Usually it is a commercial requirement, not a legal one. The exception is Article 25(4): where your AI system, tool or component is integrated into a customer's high-risk AI system, the two of you must set out the information and assistance needed in a written agreement.
Can an AI vendor warrant that its product complies with the EU AI Act?
A blanket warranty is risky because obligations attach to roles and some depend on how the customer uses the product. A narrower warranty is easier to stand behind: compliance with the obligations that apply to you as provider of listed features, as classified in a dated assessment.
Who pays an EU AI Act fine, the vendor or the customer?
Article 99 fines are imposed on the operator that breached its own obligations, whether provider or deployer. A contract can shift the cost between the parties through an indemnity, which is why open-ended indemnities for any AI Act fine deserve a lawyer's review.
Put a dated classification behind the contract
The free scan gives your likely risk tier in about two minutes: eight questions plus your email. The gap report gives you the dated classification and Article references a contract schedule can point to.
Get your risk tierNo card, no account. Full gap report from €59. See a sample report. Prices exclude VAT, added at checkout where applicable. 14-day refund.
Self-assessment, not legal advice. This page and the Reglynn report are a structured self-assessment based on the EU AI Act (Regulation 2024/1689, as amended by the June 2026 Omnibus). They indicate where you likely stand and what to verify with a qualified advisor. Reglynn is not a notified body and issues no certification.
How this was made. Reglynn reports are generated by an AI system built on Anthropic's Claude and delivered automatically. Reglynn is a Limited Risk AI system under Article 50; we disclose AI involvement wherever it occurs, including in our chat assistant. Our own self-assessment.