What the EU AI Act means for procurement leaders

Artificial Intelligence (AI) is always in the news. With new models capturing the world’s—and the market’s—attention, and new AI-powered software applications transforming business operations and delivering new value opportunities, AI seems to be everywhere.

This is also true in procurement. AI is promising things like predictive analytics in demand forecasting, along with new optimized tools for supplier risk management and more. But according to KPMG, concerns about data security and privacy are the biggest barriers to AI adoption.

This makes understanding and preparing for the European Union’s proposed Artificial Intelligence Act a strategic necessity for procurement leaders seeking a competitive edge.

In this article, we’ll go over what the EU AI Act is, how this affects procurement operations, and steps you can take today to future-proof your function and stay compliant.

‍

‍

Understanding the EU AI Act

The EU AI Act establishes a risk-based framework for AI systems, categorizing them into four levels: unacceptable risk, high risk, medium risk, and low or minimal risk. Each category carries different requirements and obligations.

1. Unacceptable risk: AI systems deemed to violate fundamental rights are prohibited. This would be things like social scoring and manipulation through subliminal techniques.
2. High risk: These AI systems, while permitted, create an elevated risk to the health and safety or fundamental rights of consumers and are subject to mandatory compliance requirements and a conformity assessment.
3. Medium risk: AI systems in this category are permitted but are subject to AI transparency requirements. We’ll talk about these in a moment.
4. Low or minimal risk: These systems are permitted without restriction, although organisations should still periodically monitor them for changes, especially if they begin interacting with human emotions. 

Most AI applications in procurement likely fall into the ‘Low or minimal risk’ category, but it’s still important to manage your function with care in order to stay compliant. Let’s take a look at what that means for procurement.

‍

Strategies for managing AI compliance in procurement

For procurement leaders, the EU AI Act necessitates a fundamental shift in how they approach technology adoption and supplier management. AI is an increasingly useful tool, but also a potentially regulated domain that demands careful consideration throughout the procurement lifecycle. 

Here’s how procurement leaders should strategically manage their function to meet the Act's compliance requirements.

1. Inventory and classify AI usage

The first step is to create a comprehensive inventory of all AI systems currently in use with the procurement function and any AI embedded in the products of services provided by suppliers.

You’ll need to check everything from sourcing platforms with AI-powered recommendations, to supplier risk assessment tools that use AI for contract risk management. Once identified, these systems need to be classified according to the EU AI Act’s risk framework, and will require collaboration with IT, legal, and other compliance teams to assess the data, and the impact of AI-powered decision making.

2. Integrate AI risk management into procurement processes

Existing risk management frameworks might not adequately address the unique challenges posed by AI. Procurement leaders must integrate AI-specific risk assessments into their sourcing, supplier selection, and contract management processes, in order to evaluate the inherent risks associated with AI systems being procured, and any potential risks arising from their use by suppliers.

3. Conduct rigorous due diligence on AI-powered suppliers

When evaluating new suppliers or engaging with existing ones that offer AI-powered solutions, procurement teams must conduct thorough due diligence to ensure compliance with the EU AI Act. 

What this means is that you’ll have to:

• Request detailed information about the AI systems used, their risk classification under the EU AI Act, and the measures taken to meet the relevant requirements.
• Assess the supplier’s data governance practices to ensure they align with the Act’s requirements and complement GDPR compliance.
• Evaluate the technical documentation provided by the supplier regarding the AI system’s development, testing, and performance.
• Understand the supplier’s transparency mechanisms and their ability to provide necessary disclosures as per the Act.

4. Incorporate AI compliance clauses into supplier clauses

To ensure ongoing compliance and accountability, procurement contracts must include specific clauses addressing the EU AI Act. These clauses should: 

• Clearly define the responsibilities of the supplier regarding AI compliance for the solutions they provide.
• Require suppliers to notify the procuring organisation of any changes to their AI systems that could impact their risk classification or compliance status.
• Outline audit rights for the procuring organisation to verify the supplier’s adherence to the Act.
• Establish clear remedies and termination clauses in case of non-compliance.

5. Establish transparency and record keeping practices

Procurement teams need to establish robust processes for maintaining records related to the AI systems they use and procure. The EU AI Act has firm rules around record keeping in case of audits, and maintaining transparent practices while leveraging these AI tools. For procurement, this means you should:

• Document risk classification, compliance measures, technical specifications, and any relevant assessments conducted.
• Ensure necessary disclosures for relevant stakeholders for any AI system subject to these transparency requirements.

6. Implement ongoing monitoring and auditing

AI systems are constantly evolving, so it’s important that procurement establishes mechanisms for the ongoing monitoring of the AI systems in use and regular audits of supplier compliance. This will empower them to make informed decisions regarding AI adoption and supplier selection.

By taking these proactive steps, procurement leaders can transform potential compliance challenges into opportunities for building more resilient, ethical, and innovative supply chains. 

The EU AI Act, while demanding, provides a framework for fostering trust and responsibility in the deployment of this transformative technology. Embracing this framework will not only ensure compliance but also position procurement as a strategic driver of responsible AI adoption within the organisation.

Leverage Zip for global procurement compliance

Procurement leaders who prioritize understanding the implications of the EU AI Act, the Digital Operational Compliance Act (DORA), the German Supply Chain Act (SCDDA) and others will be best positioned to operate and thrive in this shifting global regulatory environment.

Zip’s is the category leader in intake and procurement orchestration, and is designed with global compliance in mind. With Zip, you’ll get:

• Vendor due diligence and verification: Centralized vendor portals with automated third-party risk checks to validate compliance and legitimacy.
• Risk-based scoring & tiering: Assigns risk levels to suppliers based on industry, location, and regulatory exposure to prioritize oversight.
• Automated approval workflows: Standardizes supplier risk approvals across Procurement, Legal, Finance, and IT for faster, audit-ready decisions.
• Seamless audit & reporting: Generates real-time risk reports to track compliance, remediation efforts, and regulatory obligations effortlessly.

Now is the time for procurement to step forward and play a key role in shaping a future where AI innovation and ethical considerations go hand-in-hand. 

Stay ahead of regulatory changes and third-party risks with a flexible, automated risk orchestration platform that connects teams, tools, and workflows—ensuring compliance without slowing down business operations.

‍Book a demo of Zip today, and we’ll show you how to stay ahead of the global curve.