Which mistake do companies make most often in purchasing contracts for AI systems
The most common mistake is that a company purchases an AI system without specifying in the contract who has which role: the supplier or the purchaser. Many software purchasing contracts were drawn up years ago, well before the AI Regulation, and cover licences, updates and support. They say nothing about risk classification, about who provides the instructions for use, or about what happens if the supplier adapts the software itself with new AI features.
The result is that a company assumes upon purchase that the supplier "has taken care of it", while the Regulation distinguishes between the provider of an AI system and the user who deploys the system within their own organisation. These two roles can coincide, but do not have to. Without an explicit agreement in the contract, it remains unclear which obligation lies with whom at the moment when it really matters.
Why this goes wrong more often than expected
Procurement departments and IT managers have traditionally looked at functionality, price and security. That makes sense: until recently, these were the most important questions in software purchasing. The AI Regulation adds a layer to this that does not automatically find its way into existing procurement processes, simply because no one on the procurement team is used to asking that question. A supplier who is not explicitly asked about their role will rarely provide that information of their own accord.
A second reason is that much AI functionality now reaches existing software via updates, without a new contract being concluded. An accounting package gets an AI assistant, a planning tool gets automatic scheduling suggestions. The original contract does not cover that function, and no one checks afterwards whether the terms still apply to what the system now does.
How this goes wrong in practice
The mistake usually only becomes apparent when a company has to demonstrate something itself: when a supervisory authority asks a question, when a customer conducts an audit, or simply because the works council asks how an AI application came about. It then turns out that there is no documentation on the classification of the system, no contact person at the supplier for this matter, and no contractual agreement on who supplies which information when the software changes.
In addition, the question about personal data is often treated separately from the question about AI, even though in practice they often overlap. A processor agreement under the GDPR governs something different from the question of what role a party has under the AI Regulation; one does not replace the other.
How to prevent this in a new contract
The most practical step is to conduct the conversation with the supplier early in the procurement process, not afterwards. Ask explicitly which role the supplier assigns to itself, what documentation comes with the system, and what contractually applies to changes to the AI functionality during the contract term. Document those answers, even if the answer is still incomplete at this point: a supplier who cannot yet provide clarity is also worth documenting.
It helps to separate this question from the usual procurement checklist on price and functionality, precisely because these two subjects are assessed by different people in the organisation. Anyone who treats this as a separate point of attention avoids it falling through the cracks. In the knowledge base by topic there is an overview of the questions that commonly come up in conversations of this kind, organised by the phase a company finds itself in.
Review existing contracts
For existing contracts, it is advisable to ask the same questions again at the next contractual modification, extension or update notification. A contract does not need to be reopened immediately, but a note at the next contact moment with the supplier prevents the matter from lying dormant for years. Companies that do not know where they currently stand, get a first indication in a few questions which topics are relevant for their situation.
Whether and how a specific contract should be amended, and what liability is associated with it, is a question for a lawyer or, for questions about supervision, the competent supervisory authority. This article only describes where the error usually arises, not what the correct adjustment is for your own contract.
Frequently asked questions on this type of procurement issues, including questions that other readers have already asked, are collected on the frequently asked questions page. If you would first like to get an overview of where your organization stands, please take the free quick-scan or browse through the topics in the knowledge base; both are accessible without obligation.