The Short Version for Procurement Leaders
The EU AI Act is the first comprehensive, horizontal AI law, and it reached procurement quietly. Most teams discovered it not through a regulator but through a vendor security questionnaire that suddenly asked which "risk tier" their tools fell into. The good news for procurement: the overwhelming majority of procurement AI sits in the lighter-touch tiers of the Act. The catch: a handful of use cases can quietly cross into high-risk territory, and the duty to know the difference now sits partly with you, the buyer.
This brief is written for the procurement decision-maker, not the lawyer. It explains the Act's risk-based structure, the crucial distinction between being a provider and a deployer, the obligations that realistically apply to procurement, the phased timeline, and a concrete set of questions to put to any vendor before you sign. Nothing here is legal advice — confirm specifics with your own counsel — but it should let you walk into a vendor meeting knowing which answers matter.
For the wider compliance picture beyond Europe, read this alongside our guide to procurement AI compliance across GDPR and SOX and the governance controls mapped in our State of Procurement AI 2026 report.
Key takeaways
The Act is risk-based, not technology-based — what the AI does determines the rules, not how clever it is. Most procurement AI is limited- or minimal-risk with proportionate duties. As a buyer you are usually a "deployer," so the heavy lifting falls on vendors — but you inherit duties around transparency, human oversight and due diligence, and you can accidentally become a "provider" if you modify or rebrand a system.
The Four Risk Tiers — and Where Procurement Lands
The Act sorts AI systems by the risk they pose to people's rights and safety, and attaches obligations accordingly. The four tiers, from heaviest to lightest:
| Risk tier | What it covers | Typical procurement relevance |
|---|---|---|
| Prohibited | Practices banned outright (e.g. social scoring, manipulative systems) | Essentially none in normal procurement use |
| High-risk | Systems affecting safety or fundamental rights; heavy documentation, oversight and conformity duties | Edge cases — e.g. AI materially deciding employment of contingent workers |
| Limited-risk | Transparency obligations — people must know they're dealing with AI | Most copilots, chat-based intake, supplier-facing bots |
| Minimal-risk | No specific obligations beyond voluntary good practice | Spend classification, analytics, forecasting, internal automation |
The practical message is reassuring: a spend-analytics engine that classifies invoices, a negotiation tool that recommends a counter-offer, or an intake assistant that routes a request are almost always limited- or minimal-risk. They inform decisions; they do not, by themselves, decide a person's legal rights.
The High-Risk Traps Hiding in Procurement
The exceptions matter because they are easy to overlook. A use case can drift toward high-risk when an AI's output materially determines outcomes for individuals. In procurement, the clearest example is contingent-workforce and services procurement: if an AI scores or ranks individual workers in a way that effectively governs whether they are hired or retained, you are touching employment-related high-risk territory. Supplier-diversity scoring that affects individuals, or any system used to evaluate people rather than companies, deserves the same scrutiny.
The test to apply internally is simple: does this system's output decide something about a person, or merely inform a decision a human still makes about a company? The first pulls you toward high-risk duties; the second usually does not.
Provider vs Deployer: The Distinction That Decides Your Workload
This is the single most important concept for buyers. The Act assigns most of the burdensome obligations — technical documentation, conformity assessment, risk management systems — to the provider, the entity that develops the system or places it on the market. The deployer is the organisation using the system under its own authority. If you license Coupa, Icertis or Keelvar and use them as intended, you are a deployer, and your duties are lighter.
The trap is that you can become a provider without meaning to. Three triggers do it: substantially modifying a high-risk system, putting your own name or brand on a system you then make available, or using a system for a purpose its original provider never intended. Building your own procurement agents in-house — increasingly common as teams wire LLMs into their workflows — makes you a provider from day one.
"Most procurement teams stay deployers, and that's the comfortable place to be. The moment you fine-tune a model on your own data and ship it to other business units, you've quietly stepped across the line into provider territory."
What Deployers Actually Have to Do
For the limited- and minimal-risk systems that dominate procurement, deployer duties are proportionate and mostly align with good governance you should want anyway:
- Transparency: make sure staff and suppliers know when they are interacting with an AI system rather than a person — relevant for chat-based intake and supplier-facing bots.
- Human oversight: keep a meaningful human in the loop for consequential decisions, with the authority and information to override the AI. Our human-in-the-loop benchmark shows how far real tools actually support this.
- Records and logs: retain basic logs of how the system is used, so decisions can be reconstructed if questioned.
- Provider due diligence: confirm the vendor has met its own obligations — instructions for use, accuracy and robustness information, and any conformity evidence for higher-risk systems.
Where a use case is genuinely high-risk, deployers take on more: stronger human-oversight arrangements, data-governance checks on the inputs you feed the system, and cooperation with authorities. Those situations are the minority, but they are the ones to identify early.
The Timeline: Why 2026 Is an Inventory Year
The Act does not switch on all at once. Its obligations phase in over time: prohibitions on banned practices and baseline AI-literacy expectations applied first, obligations on general-purpose AI models followed, and the substantial high-risk system requirements phase in across 2026 and into 2027. For procurement, that staggered schedule has a clear implication. 2026 is not the year every rule becomes enforceable against you — it is the year to get organised before they do.
The single highest-value action this year is to build an inventory of every AI system in your procurement stack and tier each one. Most will land in minimal- or limited-risk and need only light documentation. The few that approach high-risk are the ones to escalate to legal and compliance now, while there is time to design oversight rather than retrofit it.
Build your AI inventory first
Before you worry about conformity paperwork, list your tools and tier them. Our buyer's decision framework gives you the evaluation structure to do it.
The Vendor Questions That Actually Matter
Compliance lives or dies in the contract, not the demo. Put these questions to any procurement AI vendor selling into or operating in the EU, and get the answers in writing:
- How do you classify this system's risk tier under the EU AI Act, and what's your reasoning?
- What technical documentation, instructions for use, and accuracy/robustness information can you provide?
- For any high-risk component, what conformity evidence or CE-style declaration exists?
- How does the product support human oversight and override, and what does it log?
- Where are your models and our data hosted, and do you use our data to train models?
- How will you keep us informed of changes that affect the system's risk classification?
The last two overlap heavily with GDPR diligence, which is why the smartest teams run AI Act and data-protection reviews as one process rather than two. Vendors who answer these crisply have done the work; vendors who deflect are telling you something too.
The Bottom Line
For most procurement organisations, the EU AI Act is manageable and arguably overdue — it formalises the transparency, oversight and documentation that responsible buyers already wanted from AI vendors. The work in 2026 is unglamorous but cheap: inventory your tools, tier them honestly, flag the rare high-risk uses, and harden your vendor contracts. Do that, and the Act becomes a governance asset rather than a compliance fire drill.
Two adjacent reads round out the picture: our companion news brief on procurement AI acquisitions in 2026, where regulatory diligence is increasingly shaping deal terms, and the VC investment analysis, which shows how compliance readiness is now a factor investors price in. For the forward view of how regulation reshapes the agentic-procurement roadmap, see our strategic planning assumptions through 2030.