From Policy to Practice: Prototyping the EU AI Act’s value chain requirement

Following the two previous editions of our policy prototyping projects on the AI Act’s transparency and human oversight requirements, the Knowledge Centre Data & Society launched a new edition of this project in the autumn of last year, this time focusing on the value chain management provision set out in Article 25(4) AI Act. In this report, we share some findings on the first implementation of the obligation, as well as regarding the text and clarity of the provision.

Article 25(4) of the AI Act describes the value chain management for high-risk AI systems. This article requires providers of such systems and third parties that supply AI systems, tools, services, components or processes used or integrated into a high-risk AI system to enter into a written agreement. This agreement must set out the necessary information, capabilities, technical access and other assistance in line with the generally acknowledged state of the art, in order to enable the provider to comply with its obligations under the AI Act.

The report first contains an introduction on the concept of policy prototyping, followed by a comprehensive look at the phases of the project. The report focuses on the development and evaluation of prototype compliance documents for the above mentioned value chain requirement, enriched with feedback from subject matter experts. The final section of the report provides legal feedback on Article 25(4) AI Act.

Our findings emphasise the importance of:

• Assessing the qualification of each party, namely providers, third-party suppliers as well as other potential parties, in detail;
• Defining key terms such as ‘the necessary information, capabilities, technical access and other assistance’;
• Using existing materials or standard contracts as a basis. 

In addition to ensure the written agreements are user-friendly:

• The language used must be tailored to the target audience(s);
• A clear and logical structure must be considered to enhance the usability of the documentation. Existing contractual structures can serve as useful reference points.

While the provision establishes an important obligation, its current broadness leaves too much room for divergent interpretation. 

• The reviewers determined that further information and guidance are required to facilitate the implementation of the AI Act. Article 25(4) presents certain challenges in terms of negotiation and practical implementation, particularly for SMEs. 
• The voluntary terms that the AI Office is expected to develop could provide meaningful support in this regard. For example, providing generic model terms that are broad enough to be subsequently tailored by the specific entity to its own use case. 
• Reviewers emphasise that policymakers should be aware of the potential consequences of over-regulation, which can be attributed to the existence of supplementary guidelines and legislations in addition to the core text of the AI Act that parties are required to adhere to.

The report is a tool for understanding and applying the obligation to draft written agreements according to Article 25(4) AI Act. By bridging the gap between regulatory expectations and practical implementation, we thus provide a valuable resource for policymakers and AI professionals alike.

Image by Alexander via Adobe Stock.