The EU AI Act Has Entered Its Enforcement Phase: What Should Buyers Verify When Procuring AI-Enabled Devices and Software?
AI is no longer just a product feature. For procurement projects entering the EU market, it can also become part of compliance, data governance, and lifecycle responsibility.
Key Takeaway
When procuring AI-enabled products, buyers should not only ask what the AI can do. They should also ask what regulatory role the AI has, who maintains it, and who is responsible when it changes.
The EU AI Act follows a phased implementation schedule. For corporate procurement teams, the main change is not the sudden arrival of a single “AI certificate.” Buyers now need to identify AI functions, supplier roles, intended uses, and risk boundaries earlier in the purchasing process.
What should be confirmed first during the RFQ stage?
1. Does the AI function actually affect product decisions?
Buyers should distinguish ordinary automation and rule-based algorithms from machine-learning functions. They should pay particular attention when AI is involved in safety, personnel management, identity recognition, scoring, prediction, or other important decisions.
2. Who is the responsible party under the regulation?
A single project may involve a model provider, software developer, device manufacturer, brand owner, importer, and final deployer. The procurement contract should state who is responsible for technical documentation, updates, incident response, and regulatory changes.
3. Can the supplier provide verifiable information?
Buyers should request:
- a description of the AI functions and version information;
- use restrictions and the intended purpose;
- an explanation of data sources and data governance;
- the method of human oversight;
- performance limits and failure boundaries;
- update and change-management procedures.
An AI procurement checklist for buyers
| Check | Procurement question |
|---|---|
| Intended Use | In what exact scenario is the AI used? |
| Risk | Does it involve a regulated or high-impact use? |
| Documentation | Is product-level technical documentation available? |
| Data | How are training and operational data managed? |
| Human Oversight | Can a person review or override the AI result? |
| Change Control | How will customers be notified after a model update? |
| Support | Who is responsible for ongoing maintenance after deployment? |
Why should contracts clearly address changes?
AI products may be updated continuously through cloud models, firmware, or software. Passing procurement review once does not mean that later versions will automatically retain the same capabilities and risk profile. For equipment used over a long period, buyers should require suppliers to record material changes to models, functions, and data-processing methods.
Scope and limits
Not every product marketed as “AI” falls into the same regulatory category. Specific duties depend on the product’s role, actual use, market, and the applicable provisions of the AI Act.
FAQ
Does a CE mark mean that the AI component is fully compliant?
No. CE marking relates to specific product legislation. Responsibilities under the AI Act still need to be assessed separately according to the actual functions and roles.
What is the most useful supplier question buyers can add now?
Ask the supplier to specify the AI function, version, intended use, update responsibility, and method of human oversight.
Recommendation for stellar.shop
stellar.shop can add fields such as AI Function, Model/Software Version, EU AI Act Readiness, and Update Policy to pages for smart hardware, industrial equipment, and software-based products. These fields can help overseas buyers complete an initial information review before sending an inquiry.
References
- European Commission — EU Artificial Intelligence Act: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- European Commission — AI Act implementation: https://digital-strategy.ec.europa.eu/en/policies/ai-act