AI clauses for your supplier contract: a fill-in clause sheet for small EU businesses buying AI tools (EU AI Act and GDPR)
What you get: a finished AI supplier clause sheet: twelve fill-in clauses you can paste into an email, an order form or a contract annex when you buy or renew an AI tool, each with the EU AI Act or GDPR article it supports and the kind of tool it is for. Plus a contract check sheet to record what each supplier agreed, and a short list of what to do this week. Built from the text of Regulation (EU) 2024/1689 as consolidated after the Digital Omnibus on the Commission's AI Act Service Desk, Article 28 GDPR, and the Commission-hosted EU model contractual AI clauses.
The short version
- No general AI Act rule says a small business must sign an AI contract. The written-agreement duty in Article 25(4) is between the provider of a high-risk AI system and the companies that supply models, tools or components for it.
- But your own duties depend on the supplier. As a deployer of a high-risk system you must use it according to its instructions (Art. 26(1)), keep the logs under your control for at least six months (Art. 26(6)) and report risks and serious incidents (Art. 26(5)). You cannot do any of that without documents, log access and notices from the supplier.
- If the tool sees personal data, GDPR already requires terms. Article 28(3) GDPR lists what a processor contract must contain.
- Start with your questions, then lock the answers in. Ask the AI vendor questions first; this sheet turns the answers into commitments.
The clause sheet (copy and fill in)
AI supplier clause sheet · Customer: [your business] · Supplier: [name] · Tool: [name, plan, version] · Prepared by: [name, role] · Date: [dd/mm/yyyy]
"Customer" means your business, "Supplier" means the company selling the AI tool. Text in [brackets] is for you to fill in or delete. Use only the rows that fit the tool.
| No. | Clause | Wording you can send | Why (source) | Use it for |
|---|---|---|---|---|
| 1 | What the tool is for | The Supplier confirms that [tool name, version] is intended for [purpose, e.g. drafting replies to customer emails]. The Supplier will tell the Customer in writing at least [30] days before it changes that intended purpose or adds a feature that could make the tool high-risk under Article 6 and Annex III of Regulation (EU) 2024/1689. | Your duties depend on the use. Art. 13(3)(b)(i) (intended purpose in the instructions for use); Art. 6 and Annex III (high-risk uses) | Every AI tool |
| 2 | Who is the provider | The Supplier is the provider of the AI system within the meaning of Article 3(3) of Regulation (EU) 2024/1689. The Customer will not place the system on the market under its own name or trademark unless the parties agree in writing who carries the provider obligations. | Putting your name on a high-risk system, substantially modifying it or changing its purpose so it becomes high-risk can make you the provider: Art. 25(1) | Every AI tool; vital if you resell or white-label it |
| 3 | High-risk status in writing | The Supplier states in writing whether it considers the AI system high-risk under Article 6 of Regulation (EU) 2024/1689 and, if not, its reasons. It will update this statement if the classification changes. | High-risk deployer duties apply from 2 Dec 2027 for Annex III uses (Art. 113(c)(i) as amended) | Every AI tool used for staff, hiring, credit, education or similar |
| 4 | Instructions for use | The Supplier provides, free of charge and kept up to date, instructions for use containing at least the information listed in Article 13(3) of Regulation (EU) 2024/1689, including limitations of performance, known risks, human oversight measures and how to collect and read logs. For a tool that is not high-risk, the Supplier provides user documentation describing what the tool can and cannot do. | You must use a high-risk system in line with its instructions: Art. 26(1); contents: Art. 13(3) | High-risk tools (full); other tools (light) |
| 5 | Chatbot notice and AI-output marking | Where the AI system talks directly to people, the Supplier ensures they are told they are interacting with an AI system, as required by Article 50(1). Where it generates audio, image, video or text, the Supplier ensures the output is marked in a machine-readable format as required by Article 50(2), and tells the Customer how the marking works. | Provider duties under Art. 50(1) and (2); you keep your own deployer duties for deepfakes and published AI text (Art. 50(4)) | Website chatbots, voice bots, image, video and text generators |
| 6 | Logs | The Supplier keeps the logs automatically generated by the AI system, or lets the Customer export them, for at least [six months] or longer if required by law, and provides them on request within [5] working days. | Deployers keep logs under their control for at least six months: Art. 26(6); logging capability: Art. 12 | High-risk tools; useful for any tool that makes decisions about people |
| 7 | Human oversight | The Supplier describes the oversight features (for example review before a decision is sent, override and stop) and keeps them available for the whole contract. | Deployers assign oversight to competent people: Art. 26(2); provider oversight measures: Art. 14 and 13(3)(d) | High-risk tools; recommended for any tool affecting customers or staff |
| 8 | Incident, risk and change notice | The Supplier informs the Customer without undue delay, and in any case within [72 hours], of any serious incident, any risk to health, safety or fundamental rights, any corrective action, withdrawal or recall, and any material change to the model or its performance. | Providers must inform deployers of corrective actions: Art. 20(1); deployers report risks and serious incidents: Art. 26(5) | Every AI tool (the 72 hours is a commercial choice, not a legal deadline) |
| 9 | Help with explanations, authorities and impact assessments | The Supplier provides the information and reasonable help the Customer needs to answer a person's explanation request, a request from a market surveillance or data protection authority, a data protection impact assessment, or a fundamental rights impact assessment where one is required. | Art. 86 (explanation of individual decisions), Art. 26(9) (DPIA using Art. 13 information), Art. 27 (FRIA, where it applies) | High-risk tools; tools that process personal data |
| 10 | Personal data (GDPR processor terms) | Where the Supplier processes personal data on the Customer's behalf, the parties sign data processing terms meeting Article 28(3) of Regulation (EU) 2016/679, for example the Commission's standard contractual clauses in Implementing Decision (EU) 2021/915. | GDPR Art. 28(3): documented instructions, confidentiality, security, sub-processors, help with rights, deletion or return, audit information | Any tool that sees customer, staff or applicant data |
| 11 | Training on your data | The Supplier will not use the Customer's inputs, outputs or uploaded files to train or improve its models [unless the Customer opts in in writing]. The Supplier states where the data is stored and which sub-processors are used. | Not an AI Act rule: a commercial and GDPR point. The MCC-AI cover data-set rights in their Annex B; check the official source and your data protection adviser | Every AI tool |
| 12 | Exit and records | At the end of the contract the Supplier returns the Customer's data and logs in a usable format within [30] days and then deletes them, unless law requires storage, and confirms deletion in writing. | GDPR Art. 28(3)(g) (delete or return); keeps your own Art. 26(6) log evidence | Every AI tool |
Most AI tools for small businesses are sold on standard online terms, and a supplier may refuse to change them. That is still useful: a written "no" to clause 3, 6 or 11 is a fact to record in your AI register, and it tells you whether to keep the tool for that use.
Contract check sheet (one row per AI tool)
| Tool | Supplier | High-risk? (supplier's answer) | Clauses asked | Agreed | Refused or changed | GDPR terms signed | Where the evidence is | Review date |
|---|---|---|---|---|---|---|---|---|
| [AI email assistant] | [Supplier A] | [no, reasons given] | [1, 2, 5, 10, 11, 12] | [1, 2, 10, 12] | [11: trains on data unless opted out; opted out in settings] | [yes, standard DPA] | [shared drive/contracts/A.pdf] | [01/04/2027] |
| [website chatbot] | [Supplier B] | [no] | [1, 2, 5, 8, 10, 11, 12] | [1, 5, 10] | [8: notice "as soon as practicable", no fixed hours] | [yes] | [email of dd/mm/yyyy] | [01/01/2027] |
| [CV screening add-on] | [Supplier C] | [asked; no answer yet] | [all 12] | [pending] | [pending] | [pending] | [ticket no.] | [before go-live] |
The three rows above are made-up examples to show how to fill the sheet, not real suppliers, real answers or legal conclusions.
What the official model clauses are, and are not
The Procurement of AI community of practice on the European Commission's Public Buyers Community published updated EU model contractual AI clauses (MCC-AI) on 5 March 2025, in all EU languages: a full version for high-risk AI aligned with the AI Act, a light version for other AI, and a commentary. The commentary says they are written for public bodies, contain only AI-specific provisions, and "do not constitute a full contractual agreement": there are no terms on intellectual property, payment, delivery, applicable law or liability, so they are meant to be annexed to a contract that already covers those points. A private business can borrow from them clause by clause; the twelve rows above are a shorter, plain-language starting point in the same spirit.
Article 25(4) of the AI Act, as amended, also lets the AI Office develop and recommend voluntary model terms for contracts between providers of high-risk AI systems and their suppliers, published free of charge. Check the official source for whether they have been published before you rely on this sheet alone.
Do this week
- List every AI tool you pay for or use for free, and who supplies it (SME AI inventory template)
- Mark which tools touch personal data, talk to customers, generate content, or help with decisions about people
- Check your role for each tool, especially if you resell or rebrand one (provider or deployer role check)
- Send the vendor questions plus the clause rows that fit, and diarise the renewal date
- Record every answer, including refusals, in the contract check sheet and keep the emails
- Recheck tools that may be high-risk well before 2 December 2027 (Annex III check)
This sheet is a starting point, not a legal opinion, a complete contract or proof of compliance. Article references were checked on 20 October 2026 against the consolidated text on the Commission's AI Act Service Desk (EUR-Lex consolidated version as at 27 July 2026, including the Digital Omnibus amendments), EUR-Lex for the GDPR, and the Public Buyers Community page. Notice periods, retention periods and the training-on-data wording are suggestions, not legal requirements. National contract law, sector rules (for example financial services) and liability terms are not covered; check the official source and ask a lawyer before you sign. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients sign AI subscriptions with a click and never read the terms. At the next review, ask for a list of AI tools and their renewal dates, hand over this clause sheet with the client AI inventory workshop, and flag any tool that sees payroll, client or applicant data without signed GDPR processor terms. Stay inside your professional rules and pass contract drafting to a lawyer.
Keep the answers with your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, pick its role, and store the supplier's written answers and signed terms as evidence records against that tool.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill one row of the contract check sheet per tool. Related: AI vendor questions · record-keeping and logs · AI incident and complaint log · AI Act deadline sheet.
Sources
- European Commission AI Act Service Desk: Article 25, responsibilities along the AI value chain (consolidated text with Digital Omnibus amendments)
- AI Act Service Desk: Article 26, obligations of deployers of high-risk AI systems
- AI Act Service Desk: Article 13, transparency and provision of information to deployers
- AI Act Service Desk: Article 20, corrective actions and duty of information
- AI Act Service Desk: Article 50, transparency obligations
- AI Act Service Desk: Article 113, application dates (as amended)
- Regulation (EU) 2024/1689 (AI Act): Articles 3, 6, 12, 13, 14, 20, 25, 26, 27, 50, 86 and 113, Annex III
- Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- Regulation (EU) 2016/679 (GDPR): Article 28
- Commission Implementing Decision (EU) 2021/915: standard contractual clauses between controllers and processors
- Public Buyers Community: Updated EU AI model contractual clauses (5 March 2025) and Commentary (PDF)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.