AI Act, part two: requirements on your suppliers
Aug 29th, 2025 by Jesper Kråkhede
On the 2nd of August the next part of the EU AI Act started to apply: the rules for general purpose AI models, the large models that many AI services are built on. They mostly concern the companies that develop those models, with requirements for documentation, transparency, copyright and, for the most powerful models, risk management and security.
Most organisations don´t build such models. But almost all of them use services built on them. So what does it mean for you?
It means you should ask your suppliers questions. Which model is your service built on, and who provides it? Where is our data processed, and is it used for training? How do you protect against prompt injection and data leakage? How do you handle the requirements of the AI Act? What happens if the underlying model changes or is withdrawn? What do you do when your AI makes a mistake that affects us?
Put AI requirements in your procurement and contracts. Not as a separate project, but as part of the normal supplier management, just like security and data protection.
And connect it to what happened this month with the stolen tokens from an integration. AI services are suppliers in your supply chain, often with deep access to your data. They need the same scrutiny as any other supplier, maybe more.
Your AI is only as trustworthy as the supplier behind it.