EU AI Act Contract Clauses (2026)

The EU AI Act does not give you a ready-made set of contract clauses. What it does is create obligations that fall on different parties, and the only clean way to allocate those obligations is in writing. So the real work is turning the Act's duties into contract terms: who is the provider, who is the deployer, who warrants compliance, who shares documentation, and who pays when something goes wrong. This guide explains the Act at a working level and then sets out the clauses that matter. It is general information, not legal advice; confirm a live deal with a qualified EU lawyer. ## What the EU AI Act is The EU AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in phases. The bans on prohibited practices started in February 2025, obligations for general-purpose AI models started in August 2025, and most high-risk obligations apply from August 2026, with some extending to 2027. It uses a risk-based structure: - Unacceptable risk: a short list of prohibited practices (for example certain social scoring and untargeted facial-image scraping).

• High risk: AI used in listed sensitive areas (such as recruitment, credit scoring, critical infrastructure, or as a safety component of a regulated product). These carry the heaviest duties.
• Limited risk: transparency duties, such as telling people they are dealing with AI or that content is AI-generated.
• Minimal risk: most ordinary software, with no specific obligations. The Act also regulates general-purpose AI models separately, with lighter duties for most and extra duties for models posing systemic risk. ## Why roles decide everything The Act assigns duties by role, so your contract must fix the roles first. - A provider develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name or trademark. Providers of high-risk systems carry most of the compliance load.
• A deployer uses an AI system under its own authority in a professional capacity.
• There are also importers and distributors with their own duties. Article 25 matters here. A deployer can become a provider in the eyes of the law if it puts its own name or trademark on a high-risk system, makes a substantial modification to it, or changes its intended purpose so that it becomes high-risk. That switch moves a large body of obligation onto a party that may not expect it, so the contract should say plainly who is provider, what counts as a substantial modification, and what happens if the roles change. ## What high-risk providers must do For a high-risk system, the provider must run a risk management system, meet data governance standards, keep technical documentation, enable logging, give clear instructions for use, allow human oversight, and meet thresholds for accuracy, robustness and cybersecurity. It must operate a quality management system, complete a conformity assessment, apply the CE marking, and register the system in the EU database. Deployers have lighter but real duties: use the system according to the instructions, assign competent human oversight, monitor operation, keep logs, and in some cases inform affected people or carry out a fundamental rights impact assessment. ## The clauses to put in the contract Turn those duties into terms. For a contract involving a high-risk AI system, the clauses that earn their place are: - Role definitions. State who is provider and who is deployer, and that the deployer will not act in a way that makes it a provider without written agreement.
• Compliance warranty. The provider warrants the system meets the applicable requirements of Regulation (EU) 2024/1689 at the point it is placed on the market or put into service.
• Documentation and instructions. The provider supplies the technical documentation it is allowed to share, the instructions for use, and the information the deployer needs to meet its own duties. Article 25 expects providers to give downstream parties the information needed for compliance.
• Conformity and CE marking. The provider confirms the conformity assessment is done and the CE marking applied, and agrees to cooperate on reassessment after a substantial change.
• Human oversight and intended purpose. The deployer agrees to keep the system within its intended purpose and to maintain the human oversight the instructions require.
• Logging and records. Both sides agree who keeps which logs and for how long, so each can meet its record duties.
• Change control. Define substantial modification and require notice and re-papering if a change shifts roles or risk class.
• Incident and cooperation. Set notice periods for serious incidents and malfunctions, and a duty to cooperate with authorities.
• Transparency. Where the limited-risk rules apply, allocate who tells end users they are interacting with AI or that output is AI-generated.
• Audit, indemnity and liability. Audit rights proportionate to risk, an indemnity for compliance failures, and a liability position that reflects who controls the obligation. The European Commission is expected to publish voluntary model contractual terms for AI, and the EU has already issued model clauses for public procurement of AI. These are useful starting points, not a substitute for terms fitted to the deal. ## A simple clause-mapping method 1. Classify the system: prohibited, high-risk, limited-risk or minimal.

2. Fix the roles: provider, deployer, importer or distributor.
3. List the statutory duties for each role.
4. Draft a clause that assigns each duty, with a warranty where one side controls it.
5. Add change control, so a later modification does not silently move the duties.
6. Close with audit, indemnity and liability that match who holds the risk. ## Keeping AI Act terms consistent across every contract The practical difficulty is not writing one clause set. It is keeping role definitions, compliance warranties and change-control terms consistent across every vendor and customer contract, and spotting where an old agreement has none of them. That work, drafting from a tuned template, flagging missing or weak clauses, editing clauses in plain English and tracking versions, is what an AI contract workspace can hold in one place. Adira is built for this, with a per-clause favourable, neutral or unfavourable risk view, plain-English clause editing with a diff, and a structured clause tree; it is India-first today with other jurisdictions on its roadmap, so verify EU depth before relying on it for AI Act compliance. More at Adira. The guidance above stands on its own. ## Bottom line The EU AI Act works through roles and risk tiers, and your contract is where those duties get allocated. Classify the system, fix who is provider and who is deployer, warrant the compliance each side controls, and use change control so a later modification does not move the obligations by surprise. Start from the Commission's model terms where they fit, and get EU advice before signing a high-risk deal.