AI Act: what your supplier must deliver and what you must keep

Your supplier mainly has to give you information on how to use the system properly. You mainly have to be able to show that you did. For every AI system in your company, that means three things: knowing which systems you use, being able to show what you have done on AI literacy, and recording how you tell people they are dealing with AI where the law asks for it. For a high-risk system, more is added. Your supplier then has to deliver instructions for use with a fixed content (Article 13 of the AI Act), and you have to keep the logs the system generates for at least six months, to the extent those logs are under your control (Article 26(6)). On top of that, you record who has human oversight and how you informed employees and the people affected.

That is the short answer. The rest of this piece is about doing it: which paper comes from whom, what you keep yourself, for how long, and in which folder. It is written for a director of a company with fifty to three hundred and fifty people and no legal department of its own. This is not legal advice. It is a workable structure based on the text of the regulation, with the article numbers included so you or your lawyer can check them.

If you first want to know which obligations apply in general, read the EU AI Act for SMEs. If you are after what to put in the contract with your supplier, that is in the AI Act and your suppliers. This piece is about the documents themselves.

Two questions first: what is your role, and what kind of system is it

The AI Act divides obligations by role. The provider is the party that develops a system and places it on the market under its own name. The deployer is the party that uses the system under its own authority, usually you. If you buy an AI feature in your accounting package, your applicant tracking system or your customer service software, you are almost always the deployer and your supplier is the provider.

The second question is which risk class a system falls into. Nearly everything depends on it. A writing assistant that helps draft emails is in a very different class from a module that pre-sorts job applications. The latter is listed in Annex III of the regulation, under employment, and is therefore a high-risk system. How to make that classification is explained in the AI Act risk classes, explained.

For the documents, this means a simple split:

1. What applies to every AI system. A limited set: AI literacy (Article 4) and, for certain systems, transparency towards the people who deal with them (Article 50).
2. What applies only to high-risk systems. The provider's instructions for use (Article 13) and your obligations as a deployer (Article 26), including keeping logs.

Note the date for that second group. Because of the Digital Omnibus, Regulation (EU) 2026/1744, the obligations for high-risk systems in Annex III apply from 2 December 2027. For high-risk AI in products under Annex I, the date is 2 August 2028. So you have time. But you can set up the folder you need for it now, and the first group already applies.

What your supplier has to deliver

For every AI system

For an ordinary AI system that is not high-risk, the AI Act prescribes few documents that your supplier has to hand to you. What the law does require sits in the product itself. A system that talks directly to people, such as a chatbot, must be designed by the provider so that people know they are interacting with an AI system, unless that is already obvious to a reasonably attentive person (Article 50(1)). And a system that generates text, images, audio or video must mark that output in a machine-readable way as artificially generated (Article 50(2)). That too is an obligation of the provider.

Few legal requirements does not mean you need to ask for nothing. To meet your own obligations, you need a few things per system. A short description of what the system does and what it is intended for. The version or model you are working with. Where your data goes. And a contact person. These are not delivery duties under the AI Act. They are what you need to keep the register and handle AI literacy properly. How to put that in a contract is covered in the AI Act and your suppliers.

For a high-risk system

Here the law is specific. A high-risk system must come with instructions for use containing concise, complete, correct and clear information (Article 13(2)). Paragraph 3 lists what must be in them at a minimum. In plain words:

• who the provider is and how to reach them;
• the intended purpose of the system, and how accurate, robust and secure it has been tested to be;
• known or foreseeable circumstances in which it performs worse or can be misused;
• where relevant: how the system can explain its output, how it performs for specific groups of people, and what input data it expects;
• changes to the system that were determined in advance;
• the human oversight measures, including technical aids for interpreting the output;
• what computing resources and maintenance are needed, including software updates, and the expected lifetime;
• where relevant: how you collect, store and interpret the logs.

That last point matters for what you have to keep. Without that explanation you do not know where the logs are or how to hold on to them for six months.

A common confusion: the technical documentation (Article 11) is not the same as the instructions for use. The provider keeps the technical documentation available to the authorities for ten years (Article 18). The law does not give you as a deployer an automatic right to see all of it. What the law does guarantee you is the instructions for use. If you want more, you arrange it in the contract.

If you use the system for something that requires a data protection impact assessment (DPIA) under the GDPR, you use the information from those instructions to carry it out (Article 26(9)). That is another reason you want them complete.


What you have to keep

For every AI system

An overview of which AI you use. To be fair: the AI Act does not oblige a company to keep its own AI register. Only public authorities that use a high-risk system must register that use in the EU database (Article 26(8)). Still, this is the first document in your folder. Without an overview you cannot determine which systems are high-risk, or for whom you need to arrange AI literacy. One line per system: name, supplier, what it is used for, which department, which risk class and why, and who the internal owner is.

What you have done on AI literacy. Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and of others who use AI systems on their behalf. Since the Digital Omnibus it explicitly adds that you do not have to guarantee a particular level per person. It is an obligation of effort, not of result. You do need to be able to show the effort. The law prescribes no document, but without a record you cannot prove anything. Write down which groups work with which systems, what they have learned about them, how (a session, an instruction, a manual) and when. What AI literacy means in practice is on what is AI literacy.

How you inform people, where Article 50 asks it of you. Two situations put an obligation on you as a deployer. If you use emotion recognition or biometric categorisation, you inform the people it is applied to (Article 50(3)). And if you create deepfakes, or publish AI-generated text to inform the public on matters of public interest, you disclose that it was artificially generated (Article 50(4)). For that text there is an exception if it has undergone human editorial review and someone holds editorial responsibility. The information must be given at the latest at the first interaction or exposure, clearly and accessibly (Article 50(5)). Keep the text you use and the date you introduced it. For most companies this is a short note, or does not apply at all.

Only for a high-risk system

The logs. You keep the logs the system generates automatically, to the extent they are under your control, for a period appropriate to the purpose of the system and of at least six months (Article 26(6)). Other legislation, in particular the GDPR, may provide otherwise. If the logs sit with your supplier, the question is who controls them. That is not a question to ask only when a regulator calls.

Who has oversight. You assign human oversight to people who have the necessary competence, training and authority, and you give them the support they need (Article 26(2)). Record who that is, per system, since when, and what training that person has had. The name of someone who has never seen the system does not count.

That you use it as intended. You take appropriate technical and organisational measures to use the system in line with the instructions for use (Article 26(1)). If you control the input data yourself, you make sure it is relevant and sufficiently representative (paragraph 4). Keep a brief record of how you set that up.

Monitoring and notifications. You monitor the operation on the basis of the instructions for use. If you see a risk, you inform the provider or distributor and the market surveillance authority without undue delay, and you suspend use. In the case of a serious incident you first inform the provider immediately (Article 26(5)). Keep a simple log: date, what you saw, whom you informed.

Information to employees and the people affected. If you as an employer put a high-risk system into use at the workplace, you inform the workers' representatives and the employees concerned in advance (Article 26(7)). In the Netherlands, it is logical for the works council to be part of that. And if you use an Annex III system to make decisions about people, or to help make them, you inform those people that the system is being used on them (Article 26(11)). Keep what you sent and when.

Your DPIA, if one is needed. See above: Article 26(9) refers to the GDPR. The DPIA itself is a GDPR document, but it belongs in the same folder.

Who delivers what, who keeps what, for how long and where

Two remarks on this table. The only fixed period the AI Act imposes on you as a deployer is the six months for logs. Where the table says the law sets no period, our advice is to keep the document as long as the system is in use and then follow your normal retention policy for contracts. That is a practical choice of ours, not a requirement of the regulation. And where documents contain personal data, the GDPR also determines how long you may keep them. Keeping things longer is not always better.

A simple folder structure

You do not need a system to keep track of this. A shared folder with a fixed layout is enough, as long as everyone knows where it is and one person owns it.

Folder: AI file

• 00 Organisation: the AI register (a spreadsheet is enough), the AI policy, and the record of AI literacy (who, what, when).
• One folder per system, always with the same subfolders:
  • 01 Supplier: contract, instructions for use per version, contact person.
  • 02 Assessment: why this system falls into this risk class, and the DPIA if one is needed.
  • 03 Oversight: who has oversight, since when, with what training.
  • 04 Logs: where the logs are, how long they are kept, who has access.
  • 05 Informing: texts to customers, employees and the works council, with date.
  • 06 Incidents: log of deviations and notifications.
  • 07 Changes: new versions, new features, decisions.

For a system that is not high-risk, most subfolders stay empty or hold a single line. That is fine. Using the same layout for every system makes it easy to see what is missing.

Folder 07 Changes deserves extra attention. Suppliers regularly switch on new AI features in software you have had for years. A new feature can move a system into a different risk class. Agree that someone checks the release notes of each key supplier for anything AI-related, and records it in this folder.

The AI policy belongs in 00 Organisation. That is the document in which you record which AI you allow, who decides and how you exercise oversight. What belongs in it is on what is an AI policy.


An example

Suppose: an installation company with 140 employees. It uses three AI applications. A writing assistant in the office suite, used by everyone in the office. A chatbot on the website that answers maintenance questions. And a feature in the recruitment system that sorts incoming applications by suitability.

The writing assistant and the chatbot are not high-risk. Each gets a line in the register and a short folder. For the chatbot, the company checks whether the bot itself says it is an AI system. That is the provider's obligation, but the company still wants to see that it works on its own site, and keeps a dated screenshot. For both systems it records which employees use them and what short instruction they received.

The sorting feature in the recruitment system falls under employment in Annex III. It gets the full folder. The company asks the supplier for the instructions for use and asks where the logs are and how long they are kept. It appoints the HR manager as the oversight person, records what training she has had, and notes in the folder how candidates are informed. A short note goes to the works council in advance. Because the obligations for this category apply only from 2 December 2027, the company has time to arrange this calmly. There is a transitional rule for systems that were already on the market before that date (Article 111(2)). How it works out for this particular system is a question for a lawyer.

This example is made up to show the structure. It is not a client case.

What it costs when it is missing, and what it costs to arrange

Money and risk first. The fines are in Article 99. For failing to meet the deployer obligations in Article 26, and the transparency obligations in Article 50, the maximum is 15 million euros or 3 percent of worldwide annual turnover (Article 99(4)). For SMEs the lower of those two amounts applies, where for large companies the higher one applies (Article 99(6)). Article 4 is not on that list. Member States set the penalties themselves for infringements the article does not spell out (Article 99(1)).

The fine is not the only risk. The biggest practical risk is that when an applicant complains, the works council asks a question or a regulator makes a request, you have nothing to show. Then you have to reconstruct afterwards what you did, and that usually only half works.

Against that stands the cost of arranging it. For a system that is not high-risk, it is a line in the register and a short note. For a high-risk system, setting up the folder the first time is a few hours of work, and after that it is mostly upkeep. Most of the time goes into getting the instructions for use and the log arrangements out of the supplier. That goes faster when it is already in the contract.

When to check this again

The rules are still moving. In July 2026 the Digital Omnibus shifted the high-risk dates and changed the text of Article 4. The European Commission is publishing guidelines and practical examples, and in the Netherlands the supervisory set-up still has to take further shape. So put two moments in the diary: once a year, go through the whole file, and once more well before 2 December 2027, when the obligations for high-risk systems in Annex III start to apply.

At every check, ask the same four questions. Is the register still correct? Has any system moved into a different risk class through new features? Do you have the latest instructions for use for every high-risk system? And are you sure the logs are kept for at least six months?

Where to read on

As a next step, you can create this folder today and put the first line in the register. After that, these pieces help:

• The EU AI Act for SMEs for the overview of what applies and since when.
• AI Act checklist for the board for the order in which to work through the points.
• The AI Act and your suppliers for what to put in the contract, so the documents in this piece actually get delivered.
• What is an AI policy for the document that belongs at the top of your file.

About this page

This page describes the situation on 5 October 2026. The obligations and article numbers come from the official text of Regulation (EU) 2024/1689 on EUR-Lex, as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI), published in the Official Journal on 24 July 2026. The high-risk dates (2 December 2027 for Annex III, 2 August 2028 for Annex I) and the new text of Article 4 come from that amending regulation. The retention advice for documents for which the law sets no period, and the folder structure, are Radical's own proposal and not a legal requirement. The installation company example is made up; no client data was used. This is not legal advice; put your own situation to a lawyer. Review date: check the rules and dates again by 1 March 2027 at the latest, and once more before 2 December 2027.