The high-risk AI rules now start in December 2027 and August 2028. Transparency, AI literacy and your GDPR duties did not move. What to keep asking AI vendors.
A renewal with the AI questions crossed out
A procurement team is renewing an AI-assisted document tool. Last year's review had a full section on the AI Act: risk classification, technical documentation, human oversight. This year someone suggests skipping it, because "the AI Act got delayed".
Part of that is true. The high-risk obligations now start later than the original text said. But much of the AI Act already applies, the transparency rules took effect in August, and the questions that protect you in a contract were never only about the AI Act. Dropping the section would remove the checks that still matter.
What exactly was delayed?
The AI Act, Regulation (EU) 2024/1689, was amended as part of the EU's Digital Omnibus simplification package. The amendment moves the start of the high-risk requirements in Chapter III, Sections 1 to 3:
- High-risk AI systems listed in Annex III (for example AI used in recruitment, credit scoring, access to essential services or education) now follow from 2 December 2027.
- High-risk AI systems that are safety components of products covered by the EU harmonisation legislation in Annex I (machinery, medical devices, toys and similar) now follow from 2 August 2028.
What still applies today?
Several parts of the Act were never part of the delay, and some of them reach your vendors directly:
- Prohibited practices (Article 5) and the AI literacy duty (Article 4): applying since 2 February 2025. Article 4 applies to providers and deployers alike, so it covers your own staff using a vendor's AI.
- General-purpose AI model obligations (Chapter V, including the documentation and copyright policy duties in Article 53): applying since 2 August 2025, with models placed on the market before that date given until 2 August 2027.
- Transparency obligations (Article 50): applying since 2 August 2026. Providers of generative systems already on the market before that date have until 2 December 2026 to meet the marking requirement in Article 50(2).
What does Article 50 mean for the tools you buy?
Article 50 splits duties between the provider (the vendor that builds the system) and the deployer (you, when you use it professionally). Providers must design systems that interact with people so those people know they are dealing with AI, and must mark synthetic audio, image, video and text output in a machine-readable way. Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless a human has reviewed it and taken editorial responsibility.
For a buyer, that turns into concrete questions: does the tool disclose itself to end users where needed, does it mark generated content, and does the vendor document how, so your team can meet its own deployer duties?
Which duties never depended on the AI Act?
Most of the risk in an AI vendor relationship sits in documents you already review. GDPR Article 28 still requires a processor to act only on your documented instructions, to get your authorisation before engaging another processor, and to pass the same obligations down the chain. When an AI vendor adds a model provider that processes your personal data, that is a sub-processor change, whatever the AI Act timetable says.
If you are in scope of DORA or NIS2, an AI tool is still an ICT service or a supplier like any other: the contract clauses, the register of information and the supply chain security measures apply now. Our earlier posts, NIS2 asks about your suppliers. Your customers are asking about you, and Fourth-party risk when everyone runs on the same 19 providers, cover those duties in more detail.
What should you keep asking AI vendors now?
- Which models and model providers does the service use, and are they on the sub-processor list in the DPA?
- Is your data used to train or improve models, under what setting, and can you switch it off contractually?
- How does the system meet Article 50: AI disclosure to users and machine-readable marking of generated content?
- If the vendor builds on a general-purpose AI model, what documentation does it receive from the model provider and pass on to you?
- Could your intended use fall under Annex III? If so, what is the vendor's plan for conformity before 2 December 2027, and will it share technical documentation and instructions for use?
- What notice do you get when the vendor changes the underlying model, and can you object or terminate?
How to use the extra time in contracts
The delay gives buyers time to put the right flow-down terms in place before the high-risk rules arrive, rather than renegotiating under pressure in 2027. Terms worth adding at renewal:
- A warranty that the vendor complies with the AI Act obligations that apply to it, as they come into force.
- An obligation to provide the documentation, instructions for use and logs you need to meet your own deployer duties.
- Information and audit rights that cover AI components and the model providers behind them.
- Change notification for models, model providers and material changes in intended purpose.
What to prepare if you are the vendor being assessed
- A plain list of the models and model providers in your service, matching your sub-processor list.
- A short Article 50 statement: how users are told they are dealing with AI, and how generated output is marked.
- Your position on whether any customer use case could make your system high-risk under Annex III, and your plan for that date.
- A model change notification process with a notice period your customers can act on.
See how a review links findings to the document
The ProcureCortex demo at procurecortex.com/explore (self-serve: email sign-in link, no sales call) shows vendor reviews where each finding points to the document and clause it came from, including an AI vendor whose DPA does not list its model providers. All vendors and findings in the demo are sample data, and the demo labels findings against SOC 2, ISO 27001, GDPR and contract clauses; mapping them to the AI Act is your own team's analysis.
Sources
- Regulation (EU) 2024/1689 (AI Act), consolidated text on EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- AI Act implementation timeline (Future of Life Institute, artificialintelligenceact.eu): https://artificialintelligenceact.eu/implementation-timeline/
- AI Act Article 50, transparency obligations: https://artificialintelligenceact.eu/article/50/
- European Commission, AI Act regulatory framework page: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- Regulation (EU) 2016/679 (GDPR), Article 28: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Get the vendor review guide
One email a month with a worked example like this one. Nothing else.