AstorX Insights

What the EU AI Act actually asks of your tender AI

The EU AI Act entered into force in 2024 and its obligations phase in through 2027. If your team uses AI anywhere in the tender process, or is about to buy some, here is what the law actually asks, without the vendor panic or the vendor complacency.

Where tender AI sits in the risk framework

The AI Act sorts systems into prohibited practices, high-risk systems, limited-risk systems with transparency duties, and minimal-risk everything else. AI that reads tender documents, extracts requirements, flags conflicts, or drafts responses for human review is not on the prohibited list and does not fall into the high-risk categories of Annex III, which target domains like biometrics, credit scoring, employment decisions, and access to essential services.

That puts most procurement AI in the lower tiers. But "lower tier" is not "no obligations," and two things can pull the bar up:

• General-purpose model obligations. If the system is built on large general-purpose models, and modern document AI is, the model providers carry transparency and documentation duties, and deployers inherit questions about what those models were trained on and how they are governed.
• Public-sector buyers. If your customers are public bodies, expect them to push AI Act-shaped questions into their own procurement of you: logging, human oversight, accuracy reporting. The Act's vocabulary is becoming tender vocabulary.

The duties that matter in practice

For a tender team deploying AI, the practically relevant obligations reduce to four things, and they are all good engineering practice anyway:

1. Human oversight that is real, not ceremonial. A person must be able to understand, override, and reject the system's outputs. A review step that always clicks approve does not count, and audit trails make that visible.
2. Transparency. People interacting with an AI system should know they are. Outputs that look authoritative should be traceable to sources. For tender work this is the difference between "the AI says the deadline is March 14" and "page 61, section 4.2 says the deadline is March 14". Only the second survives scrutiny.
3. Record-keeping. Logs of what the system did, when, and on whose instruction. If a bid decision gets challenged, you want the reconstruction to take an hour, not a forensic project.
4. AI literacy. Since February 2025, organizations using AI must ensure staff operating it are adequately trained. A one-page SOP for how your team reviews AI-extracted requirements goes a long way.

Questions to put to any procurement AI vendor

These separate marketing from substance quickly:

• Where does our data go, and is it ever used to train models? The answer should name the infrastructure and be contractual, not aspirational.
• Does every extracted fact carry a citation to the source passage?
• What exactly is logged, and is authorship distinguishable, AI versus human, for every action?
• Can the system act outside the scope we configured? The right answer is a short no, with an explanation of how scope is enforced.
• Which obligations under the AI Act do you consider yours, and which do you consider ours? A vendor who has not thought about this will improvise. It shows.

The quiet advantage of compliance-shaped AI

Teams sometimes read the Act as a tax on using AI. In tendering, it is closer to a filter that rewards the systems built properly: grounded outputs, scoped permissions, human sign-off, full audit trails. Those properties were worth paying for before the law said so, because tender work is adversarial: every claim you make may need defending. Regulation just made the good-practice list mandatory reading.