Procurement, Vendor Management and Open Models

Chapter 6 assessed where a model comes from and whose law can reach its provider. This chapter, which closes Part II, turns that assessment into the terms on which an organisation buys. Very few large organisations train their own foundation models, so most of the AI they deploy will be bought, licensed, or downloaded, and procurement becomes an architectural activity. The contract decides which documentation the organisation will receive, whether it can leave, what happens when the vendor changes the model, and who answers to a supervisory authority when something goes wrong. The chapter covers the roles that purchasing creates under Regulation (EU) 2024/1689, the AI Act, public procurement, the third-party risk duties of DORA, the choice between open-weight and proprietary models, and the contract clauses that make exit possible.

Every AI purchase assigns the buyer a role, and the role carries duties. The AI Act distinguishes the provider, who develops a system or has it developed and places it on the market under its own name, from the deployer, who uses it under its own authority (1, European Union, 2024). Most purchasing organisations expect to be deployers; the contract and the architecture decide whether that expectation holds.

Article 25 of the AI Act makes a distributor, importer, deployer, or other third party the provider of a high-risk AI system if it puts its own name on a system already on the market, makes a substantial modification to it, or modifies its intended purpose so that it becomes high-risk. Each of these is an architectural act. An organisation that fine-tunes a purchased model and deploys it under its own branding for a purpose the original provider never documented has thereby taken on the provider's obligations for technical documentation, risk management, and conformity assessment. The original provider must then cooperate under Article 25(2), unless it has stated that its system must not be changed into a high-risk system.

Primary topics explored

1. Buying AI is buying an obligation
2. Public procurement of AI
3. Evaluating vendors for AI Act compliance
4. Lock-in and exit strategies
5. Open-weight versus proprietary models
6. Contract clauses for data use, model updates, and audit rights