In order to support responsible AI procurement, the Community on the Procurement of AI published EU model contract clauses (“MCC-AI”) for AI procurement by public organizations on 29 September 2023. It has now presented an updated version on March 5, 2025:
The model contract clauses stipulate that providers of high-risk AIS (HRAIS) must record risk management protocols, maintain technical documentation and ensure human oversight – requirements that are derived directly from the AIA. For non-high-risk AIS, the clauses provide for a “light version”. The clauses focus on obligations arising from the AEOI and exclude other regulations, for example under the GDPR. The clauses are likely to apply not only in the public sector – see the commentary:
It would not be appropriate for organizations other than public organizations to use the MCC-AI. Nevertheless, parts of them could certainly be used by organizations other than public organizations. They will always have to assess, clause-by-clause, whether the use of the MCC-AI is appropriate in each situation.
The full version for HRAIS provides for 14 core obligations for providers and is structured as follows:
- Section A – Definitions
- Art. 1 – Definitions
- Section B – Essential requirements in relation to the AI system
- Art. 2 – Risk management system
- Art. 3 – Data and data management
- Art. 4 – Technical documentation and instructions for use
- Art. 5 – Retention of records
- Art. 6 – Transparency of the AI system
- Art. 7 – Human supervision
- Art. 8 – Accuracy, robustness and cybersecurity
- Section C – Obligations of the Supplier in relation to the AI System
- Art. 9 – Compliance with Section B
- Art. 10 – Quality management system
- Art. 11 – Conformity assessment
- Art. 12 (Optional) – Assessment of the impact on fundamental rights
- Art. 13 – Corrective measures
- Art. 14 (Optional) – Obligation to declare individual decision-making
- Section D – Rights of use to the data records
- Art. 15 – Rights to data records of the public organization
- Art. 16 – Rights to supplier data records and third-party data records
- Art. 17 – Transfer of data records
- Art. 18 – Exemptions
- Section E – AI register and audit
- Art. 19 (Optional) – AI register
- Art. 20 – Compliance and audit
- Section F – Costs
- Art. 21 – Costs
- Attachments
- Appendix A – The AI system and its intended purpose
- Appendix B – The data sets
- Appendix C – Technical documentation
- Appendix D – Instructions for use
- Appendix E – Measures to ensure transparency
- Annex F – Measures to ensure human supervision
- Appendix G – Accuracy levels
- Annex H – Measures to ensure an appropriate level of resilience, security and cybersecurity