What must we require from our AI vendor by contract?
In short: For an ordinary German SME this is a GDPR question, not an AI-Act question. The reason is in the heading of the article every “AI contract checklist” hangs on: “Article 26 Obligations of deployers of high-risk AI systems”. Every Art. 26 deployer duty presupposes a high-risk system. And even there they have not started: legal databases print “applies from 02.08.2026” above Art. 26, but that heading is expressly subject to Art. 113. Under Art. 113(3)(c), Chapter III Sections 1 to 3 — which contain Art. 13 (instructions for use) and Art. 26 — apply only from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I. So if you use ChatGPT, Copilot or a SaaS tool with no Annex III purpose, the AI Act currently prescribes no mandatory content for your vendor contract. What the contract must cover is governed by data protection law: Art. 28 GDPR, as soon as the vendor processes personal data on your behalf.
Why Art. 26 is not your article
Art. 3(4) defines a deployer as “a natural or legal person … using an AI system under its own authority”. A company using ChatGPT is a deployer — undisputed, and often read as proof that “the deployer obligations” apply. That step is too quick. The Art. 26 duties sit under a heading that carries their scope: they bind deployers of high-risk AI systems. No Annex III purpose, no Art. 26.
The date almost nobody names
Art. 113(3)(c), as amended by the Digital Omnibus, reads: “Chapter III Sections 1, 2 and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I.” Art. 26 sits in Chapter III Section 3, Art. 13 in Section 2. Both are deferred — including for companies that do operate a high-risk system.
The only AI-Act provision that prescribes contract content
Art. 25(4) requires a written agreement on information, capabilities and technical access — between the provider of a high-risk system and its suppliers. It does not address you as a deployer, and it also sits in Chapter III Section 3, so it shares the dates above.
What the AI Act does require of you, contract aside
Art. 4 (AI literacy), since 2 February 2025. Softened by the Digital Omnibus: providers and deployers take measures to support the development of AI literacy among their staff, and the Regulation states expressly that this does not oblige anyone to guarantee a particular level of competence for any individual. Many guides still write “ensure” — that is the superseded wording.
Art. 50(3) and (4) (transparency), since 2 August 2026. Art. 50 sits in Chapter IV and is not affected by the deferral. On the role question: Art. 50(1) and (2) address the provider of the system, not you; (3) and (4) address the deployer.
What belongs in the contract
As soon as your AI vendor processes personal data on your behalf, Art. 28 GDPR applies with its mandatory content. That is the review an SME actually faces today — and the reason the common “AI Act contract checklists” answer, for most readers, a question that has not yet arisen.
Frequently asked questions
Does Art. 26 apply to us if we use ChatGPT in the company?
No, as long as there is no high-risk system within the meaning of Annex III. The heading of Art. 26 expressly limits its scope to deployers of high-risk AI systems.
Why do legal databases print “applies from 02.08.2026” above Art. 26?
That heading is expressly subject to Art. 113. Under Art. 113(3)(c), Chapter III Sections 1 to 3 apply only from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
So we need no AI contract at all?
You need an Art. 28 GDPR processing agreement as soon as the vendor processes personal data on your behalf. For non-high-risk use the AI Act currently prescribes nothing for the contract.
As a deployer, must I give the Art. 50 AI disclosure?
Art. 50(1) and (2) address the provider of the system. A deployer may have duties of its own under Art. 50(3) and (4) — for example emotion recognition, or published deep fakes.
Sources: Verordnung (EU) 2024/1689 (KI-VO), Art. 3 Nr. 4, Art. 4, Art. 13, Art. 25, Art. 26, Art. 50, Art. 113, Verordnung (EU) 2026/1744 (Digital Omnibus), Verordnung (EU) 2016/679 (DSGVO), Art. 28
Primary sources: Regulation (EU) 2024/1689 on EUR-Lex · Digital Omnibus, Regulation (EU) 2026/1744 · Bundesnetzagentur — the German AI-Act authority