Procuring AI as a public body: contract terms, roles and exit
Short answer
When procuring AI you settle three things: what happens to your data, who holds which role under the AI Act, and how you get out again. The European Commission published model contractual clauses for public procurement of AI, in a version for high-risk AI and a light version. Use them as a checklist alongside your own purchasing terms, and have the answers confirmed in writing.
Model clauses as a starting point
The European Commission had model contractual clauses drawn up for the procurement of AI by public organisations, with a version for high-risk AI and a lighter version for the rest. They cover transparency, risk management, data quality, human oversight and security.
They are working documents, not law. But they are written from the duties the AI Act places on deployers, which makes them useful as a checklist. Public bodies combine them in practice with their own standard IT purchasing terms.
Which role do you hold yourself?
The AI Act places the heaviest duties on the provider of an AI system and lighter, but real, duties on the deployer. A public body is usually the latter. But take care: if you put a system on the market under your own name, or substantially modify an existing system, you can be regarded as a provider yourself.
So ask explicitly in every tender: which role does the supplier take, which documentation do they deliver, and which duties remain with us? See Assessing an AI vendor.
What to settle in any case
- Data: no training on your data, retention periods you set, and processing within the EU.
- Access: which subprocessors can reach it, and whether any party falls under non-European law. See The CLOUD Act and your European data.
- Logging: an audit log you can export to your own monitoring, with a retention period that fits the AI Act and your records rules.
- Changes: advance notice of a new model or new terms, because a model swap changes the outcomes.
- Exit: return of data, configuration and automations, and the ability to switch models. See Comparing open-weight models.
How werqly relates to this
With werqly the AI runs on a node of your own organisation, with open-weight models. That makes part of the procurement questions easy to answer: no training on your data by a third party, no foreign jurisdiction over the content, and no chain of subprocessors in the processing. The questions about logging, updates, support and exit remain, and they belong in the contract.
See AI for local government and Generative AI in local government.
Frequently asked questions
Questions on this topic
Are there model contractual clauses for AI procurement?
Yes. The European Commission published model contractual clauses for the procurement of AI by public bodies, in a version for high-risk AI and a light version. They are working documents rather than mandatory text, but they follow the duties in the AI Act.
Is a public body a provider or a deployer?
Usually a deployer: you put a supplier’s system to use. If you place a system on the market under your own name or substantially modify it, you can be regarded as a provider yourself, with heavier duties.
What should the contract say about exit?
How you get your data, configuration and automations back, in which format and within which period, and whether you can switch models without rebuilding everything. Also record what happens when support for a model ends.
Do we have to run a tender for AI?
That depends on the value of the contract and your own purchasing policy, as with other IT. What is new is mainly what goes into the specification: the roles under the AI Act, the terms on data and logging, and the exit provisions.
Sources
- European Commission — Public Buyers Community, model contractual clauses for AI procurement
- AI Act — Regulation (EU) 2024/1689, Articles 16, 25 and 26
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.