Update: Model clauses in EU public procurement of AI

In September 2023, model contractual clauses for public procurement of AI in the EU under the anticipated EU AI Act were published (“MCC-AI”) (see our summary here).  Following the enactment of the EU AI Act on 13 June 2024, the European Commission has released an updated version of the MCC-AI.  The publication includes a: full version for high risk AI; light version for non-high risk AI; and commentary on how to use, customise and apply the model clauses.

Whilst the MCC-AI publications remain working documents which do not represent a European Commission official position, the model clauses provide a useful steer to contracting authorities seeking to ensure that they comply with their EU AI Act obligations when procuring AI. 

The MCC-AI do not cover any other obligations or requirements under other applicable legislation and are designed to be annexed to contracts.

Who might use the model clauses?

The clauses are aimed at public organisations rather than private organisations, though parts can be adapted to fit private organisations where appropriate on a clause by clause basis.

The full version of the MCC-AI is intended to apply to high risk AI systems as explained and set out in Chapter III of the EU AI Act, whereas the light version is more appropriate for use in relation to non-high risk systems (but which still could pose risks to the health, safety or fundamental rights of humans). 

Where there are no such risks, the light version may not be relevant but the MCC-AI commentary recommends that contracting authorities still make contractual arrangements in relation to risk management systems; data and data governance; technical documentation and use; rights to use data sets; and AI registers. 

There are no restrictions on types of procurement that the clauses are intended to apply to.

What do the clauses cover?

The clauses are set out within sections of the MCC-AI: essential requirements in relation to the AI system; obligations of the supplier of AI systems; rights to use data; AI register and audit; and costs.  The model clauses cover obligations related to High-Risk AI systems.

Annexes are also set out to complement the above categories of clauses, as well as an additional annex designed to be used to set out the description and purpose of the AI system.

The updated model clauses publications can be found here.

For more information on which organisation must comply with the EU AI Act, see our EU AI Act flowchart here.

If you would like to discuss how current or future regulations impact what you do with AI, please contact Tom Whittaker, Brian Wong, Lucy Pegler, Martin Cook, Liz Smith or any other member in our Technology team.

For the latest on AI law and regulation, see our blog and sign-up to our AI newsletter.

This article was written by Ryan Jenkins.