EU AI Act and Public Procurement 2026: Compliance Requirements for AI System Suppliers

High-Risk AI Classification: The Annex III Categories

The AI Act's Annex III defines eight categories of high-risk AI systems — all of which are procurement-relevant because public sector buyers are the primary deployers of these systems:

Annex III defines exactly eight categories — all of them relevant to public sector buyers, who are the primary deployers of these systems. The EU AI Act becomes fully applicable in August 2026 for most high-risk AI obligations:

• Biometric identification and categorisation: Real-time remote biometric systems, emotion recognition in law enforcement and border control contexts. Mostly procured by police and border management agencies.
• Critical infrastructure management: AI systems managing traffic flow, energy grids, water treatment, or waste management — regularly procured by municipal utilities and transport authorities.
• Education and vocational training: AI tools used for student assessment, examination proctoring, or determining access to educational institutions — relevant for universities and education ministries.
• Employment and HR management: AI systems used by public employers for recruitment screening, performance evaluation, or work allocation — applicable to public sector HR procurement.
• Essential public services and benefits: AI determining eligibility for social benefits, credit scoring in public lending programmes, emergency service dispatch prioritisation.
• Law enforcement: Predictive policing tools, evidence assessment AI, crime analytics platforms procured by police and justice ministries.
• Migration, asylum and border control: AI used in visa screening, risk assessments, and document verification at border crossing points.
• Administration of justice and democratic processes: AI assisting courts in case research, sentencing guidance, or legal document analysis.

Conformity Assessment Requirements for AI Suppliers

How Contracting Authorities Are Adapting Tender Specifications

Public sector buyers procuring AI systems are updating technical specifications and selection criteria to reflect AI Act obligations. The pattern emerging across early-adopter contracting authorities (Ministries of Interior, Justice, and social services agencies):

• Technical specification clauses: Tenders now require suppliers to certify AI Act compliance status — including whether the system is classified as high-risk, the conformity assessment route taken (self-assessment or notified body), and the EU database registration number.
• Exclusion grounds: Contracting authorities are adding non-compliance with applicable AI Act obligations as a discretionary exclusion ground under Article 57(4) of Directive 2014/24/EU — meaning suppliers unable to demonstrate conformity can be excluded before technical evaluation.
• Contract performance conditions: AI Act obligations are being incorporated as contract performance conditions — requiring suppliers to maintain registration, report serious incidents within contractually specified timeframes, and provide updated technical documentation when the AI system is substantially modified post-deployment.

Suppliers developing or marketing AI systems that will be classified as high-risk should begin conformity assessment processes immediately — the lead time for Annex IV technical documentation preparation and (where required) notified body engagement can exceed 6 months. With full applicability of most high-risk AI obligations set for August 2026, procurement processes that are mid-flight now may already require compliance documentation at the point of contract signature.