In this article (8 sections)
In EU product legislation, Taiwanese companies know this scenario well: the legal obligation sits with the European customer, but to meet it, the customer has to ask its upstream suppliers for data. The AI Act works the same way, and says so more directly. Article 25(4) requires providers of high-risk AI to agree in a written agreement with third parties that supply AI systems, models, tools, services, components or processes on what each side will provide. The Digital Omnibus then made breaches of this obligation subject to penalties. This article explains what Taiwanese suppliers will be asked for, and how to judge whether a request has a legal basis.
Key takeaways
- Article 25(4): providers of high-risk AI and their third-party suppliers must agree in writing on the necessary information, capabilities, technical access and other assistance so that the provider can fully comply with the AI Act.
- The Omnibus explicitly adds “AI models” to the items supplied and inserts a new point (da) in Article 99(4): breaches of Article 25(2) and (4) carry fines of up to EUR 15 million or 3% of worldwide annual turnover.
- Tools, services, processes or components made publicly available under a free and open-source licence are excluded, except general-purpose AI models.
- The provision requires “necessary” information and assistance. “Providing information” does not mean “handing over source code”; trade secrets remain protected under EU and Member State law.
What does Article 25(4) require?
The provision can be broken down into four parts:
| Part | Content |
|---|---|
| Between whom | The provider of a high-risk AI system and the third party that supplies an AI system, AI model, tools, services, components or processes used in or integrated into that system |
| What | A written agreement specifying the necessary information, capabilities, technical access and other assistance |
| Standard | Based on the generally acknowledged state of the art |
| Purpose | To enable the provider to fully comply with its obligations under the AI Act |
The Commission’s AI Office may develop and recommend voluntary model contractual terms, made publicly available free of charge.
The scope of this provision is wide. “Services” and “processes” include outsourced services such as data labelling, model training, and testing and validation; “components” include sensors, imaging modules and edge computing boards with built-in models.
What did the Omnibus change?
| Amendment | Provision | Impact |
|---|---|---|
| “AI models” added to the items supplied | Article 25(4) | Suppliers that provide models (not only complete systems) are clearly in scope |
| Breaches made subject to penalties | Article 99(4)(da) | The written agreement obligation moves from “a contractual matter” to “a statutory obligation that can be penalised” |
| The original provider’s duty to cooperate made more specific | Article 25(2) | When roles change, the original provider must provide technical documentation, known limitations and failure modes, and the technical access needed for testing and validation |
The maximum fine is the same as for the provider obligations in Article 16. For SMEs, the lower of the amount and the percentage applies (Article 99(6)), and the same applies to small mid-cap enterprises (SMCs) (paragraph 6a).
Are you this kind of supplier?
- You sell imaging, voice or sensing modules with built-in AI models to European equipment makers
- You provide AI software libraries, SDKs or algorithm licences
- You carry out data labelling, model training or testing and validation for European customers
- As an ODM, you develop complete products with AI functions and ship them under the customer's brand
Your customer's high-risk obligations apply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I), and questionnaires usually arrive one to two years earlier.
What will your customer ask you for?
The obligations the provider has to meet determine what it will ask its upstream suppliers for. Looking at the requirements for high-risk AI, common information requests map to the following categories:
| Provider obligation | Types of information it may ask suppliers for |
|---|---|
| Risk management (Article 9) | Known limitations, foreseeable misuse scenarios, failure modes |
| Data and data governance (Article 10) | Descriptions of the sources and characteristics of training, validation and testing data |
| Technical documentation (Article 11, Annex IV) | Design specifications, performance metrics and version information for the model or component |
| Record-keeping (Article 12) | Whether the component supports automatic logging of events, and the log format |
| Accuracy, robustness and cybersecurity (Article 15) | Test results, known vulnerabilities, update and patching mechanisms |
| Post-market monitoring and incident reporting (Articles 72 and 73) | A contact point for reporting problems, a commitment to notify updates |
The questionnaires customers send are often longer than this table, and many questions have nothing to do with the AI Act. Telling statutory requirements apart from the customer’s own policies is the most important step before you reply.
What can you withhold?
The scope is limited to what is “necessary”. Paragraph 4 requires the information, capabilities, technical access and assistance necessary “to enable the provider to fully comply”, measured against the generally acknowledged state of the art. It is not an unconditional duty to hand over source code or complete training data. Article 25(5) also states that the duty to cooperate when roles change (paragraph 2) and the rules on product manufacturers (paragraph 3) are without prejudice to the protection of intellectual property rights, confidential business information and trade secrets; trade secrets themselves are also protected under the EU Trade Secrets Directive (EU) 2016/943 and national law. Which information to disclose, and in what form, is exactly what the written agreement should settle.
If the system is not high-risk, this obligation does not apply. Article 25(4) presupposes a “high-risk AI system”. If your customer’s end product is not high-risk, this provision does not apply, and what remains is whatever the two parties agree in their contract.
The open-source exception is limited. Tools, services, processes or components made publicly available under a free and open-source licence are excluded; general-purpose AI models, however, are not covered by the exception even if they are open source.
The most common supplier mistakes
- Treating the questionnaire as a one-off form: the written agreement covers ongoing assistance, including version updates, problem reporting and post-market monitoring.
- Agreeing to provide “all technical documentation”: whatever scope you write into the contract becomes a commitment you can be held to later.
- Not confirming the customer’s end use: the same imaging module used in a consumer camera and in personnel safety detection leads to completely different obligations for the customer, and a different scope of responsibility for you.
Before you reply to your customer, confirm three things
Whether the customer's system is high-risk, which role you play in the supply chain, and which information counts as trade secrets. There are several ways to draft the clauses and decide how far to disclose information, depending on your product and how you work with the customer.
FAQ
Our European customer wants us to sign an AI Act compliance declaration. Do we have to sign?
The AI Act does not require component suppliers to issue an “AI Act compliance declaration”. What Article 25(4) requires is a written agreement specifying information, capabilities, technical access and assistance, and only where the customer’s system is high-risk. The content and scope of any declaration is a matter for the contract between the parties.
We only sell hardware modules and the customer trains its own model. Are we in scope?
If the module is used in or integrated into a high-risk AI system, the “component” supplier falls within Article 25(4), but the scope of information to be agreed will correspond to what you actually supply.
Who is fined for breaching Article 25(4)?
Article 99(4)(da) refers to “obligations of providers and operators pursuant to Article 25(2) and (4)”, and penalties are laid down by each Member State. Both parties may be examined for whether they have met their obligations under the written agreement.
Does the Commission have model contract terms?
Article 25(4) empowers the AI Office to develop and recommend voluntary model contractual terms, made publicly available free of charge. Before using them, you still need to adapt them to your own product and transaction structure.
Next in the series
Part 7: Using AI to schedule after-sales engineers may be high-risk AI
Previous: Part 5: Do AI quality inspection and performance optimisation count as high-risk?
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and, under annual service agreements, acts as the point of contact for Taiwanese suppliers responding to compliance requests from European customers. We can help you confirm AI Act applicability and the scope of your response.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 9 to 15, Article 25, Articles 72, 73 and 99: EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · Regulation (EU) 2026/1744 (Digital Omnibus on AI) · AI Act consolidated text (27 July 2026). This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI ActArticle 25supply chainsuppliersAI modulestrade secretswritten agreement2024/1689
