Updated EU AI Model Contractual Clauses
European Union · Framework · European Commission
Our summary
Updated model contractual clauses for public procurement of AI solutions, including separate versions for high-risk and non-high-risk applications aligned with the EU AI Act. The framework provides standardised contract templates and guidance to help public buyers establish clear terms when procuring trustworthy and secure AI systems.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
16 sections
Jump to a chapter
Article 1 Definitions
Defines key terms used throughout the MCC-AI framework, including AI system, intended purpose, reasonably foreseeable misuse, substantial modification, and data sets. Public organizations can determine which specific AI systems and data sets fall under their agreement through completion of designated annexes.
Article 2 Risk management system
The supplier must develop and operate processes to manage risks associated with the AI system, with these processes fully in place when the system is delivered. The supplier remains responsible for maintaining and updating this process throughout the contract term, though the specific frequency of updates is not prescribed. After the contract ends, the supplier must supply information enabling the public buyer to continue managing risks independently if the system remains in use.
Article 3 Data and data governance
Imposes obligations on suppliers concerning data sets used to develop the AI system, particularly those trained using machine learning techniques. The article applies only when the supplier controls or has full access to the data sets; it may be omitted for systems not using training data or when the supplier lacks data access.
Article 4 Technical documentation and instructions for use
Requires suppliers to provide technical documentation and usage instructions meeting standards derived from the AI Act, delivered in English unless otherwise agreed. Public organizations may restrict documentation use to contractual purposes, provided this does not limit the supplier's transparency obligations or the organization's associated rights.
Article 5 Record-keeping
Requires suppliers to establish logging capabilities to support compliance with framework obligations, with emerging EU standards expected to guide implementation. Public organizations may access logs in real time to verify supplier compliance with other contractual obligations.
Article 6 Transparency of the AI system
Obligates suppliers to ensure sufficient transparency regarding AI system operation. Public organizations can specify technical and organizational measures through an annex to define the transparency level required in their particular context.
Article 7 Human oversight
Requires suppliers to enable human oversight of the AI system through appropriate technical and organizational measures. Public organizations can detail the specific oversight mechanisms required using a dedicated annex.
Article 8 Accuracy, robustness and cybersecurity
Requires suppliers to maintain appropriate levels of accuracy, robustness, safety and cybersecurity for the AI system. Public organizations can specify required accuracy thresholds and necessary technical and organizational safeguards through designated annexes.
Article 9 Compliance with Section B
Obligates the supplier to ensure the AI system remains compliant with all framework requirements throughout the agreement period.
Article 10 Quality management system (MCC-High Risk)
Requires suppliers of high-risk AI systems to implement a quality management system as specified in the AI Act framework.
Article 11 Conformity assessment (MCC-High Risk)
Requires suppliers to ensure that conformity assessment is carried out for high-risk AI systems, based on the AI Act requirements.
Article 12 Assessment of the AI system’s impact on fundamental rights ( Article 10 of the
Requires suppliers to cooperate with public organisations in conducting assessments of how the AI system may affect fundamental rights, though the public organisation is responsible for performing the assessment.
Article 13 Corrective action ( MCC-High Risk)
Requires suppliers to take corrective action when the AI system fails to comply with the terms of the contractual clauses.
Article 14 Obligation to explain the functioning of the AI System on an individual level
Requires suppliers to work with public organisations to explain to individuals affected by AI-based decisions how the system functioned and what factors influenced the decision, including technical details where necessary.
Article 15 Rights to public organisation Data Sets (Article 12 in MCC-Light)
Annex B As already indicated regarding the definition of ‘Data Sets’, Annex B allows public
Public organisations using the model contractual clauses may customise data ownership through Annex B: public organisation data sets accrue to the public organisation by default, while supplier and third-party data sets are governed by Article 16 and Annex B. The supplier must hand over the most recent version of public organisation data sets upon request, and parties can agree to require handover of supplier and third-party data sets. Public organisations may specify file formats for delivery under Article 17.3, both parties must guarantee their respective data sets do not infringe third-party rights, public organisations may optionally publish AI system information in their own register subject to supplier audit and compliance verification under Article 20, and implementation costs are presumed covered by the organisation's payment unless parties agree otherwise.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 13 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 2 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
Transparency and records 3 of 4
- Labelling of synthetic content, not covered
Technical safeguards 2 of 4
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 1 of 4
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 1 of 4
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 26 are shown.
Article 2 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must develop and operate a system to manage risks associated with the AI system, and this system must be fully operational when the AI system is delivered.
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must maintain and update their risk management system throughout the entire contract period.
- ObligationApplies to: ProviderDrafted by the Index
Once the contract expires, suppliers must provide information to the public organisation enabling it to maintain risk management independently if the AI system remains in use.
Article 3 1 control
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must comply with obligations concerning data sets used to develop AI systems trained using machine learning techniques.
Article 4 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must provide technical documentation meeting standards derived from the AI Act, delivered in English unless otherwise agreed.
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must provide instructions for use meeting requirements derived from the AI Act.
- Applies to: DeployerDrafted by the Index
Public organizations may restrict use of supplied documentation to contractual purposes without affecting the supplier's transparency obligations or the organization's associated rights.
Article 5 1 control
- ObligationApplies to: ProviderDrafted by the Index
Suppliers should establish logging capabilities to support compliance with framework obligations and enable public organizations to access logs in real time to verify their compliance.
Article 6 2 controls
- ObligationApplies to: ProviderDrafted by the Index
Suppliers should ensure sufficient transparency regarding how the AI system operates.
- Applies to: DeployerDrafted by the Index
Public organizations may specify the technical and organizational measures needed to define the transparency level required through an annex to the contract.
Article 7 2 controls
- ObligationApplies to: ProviderDrafted by the Index
Suppliers should enable human oversight of the AI system through appropriate technical and organizational measures.
- Applies to: DeployerDrafted by the Index
Public organizations may detail the specific technical and organizational measures for human oversight using a dedicated annex.
Article 8 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Suppliers should maintain appropriate levels of accuracy, robustness, safety and cybersecurity for the AI system.
- Applies to: DeployerDrafted by the Index
Public organizations may specify the required accuracy thresholds through a designated annex so that both parties understand the expected performance level.
- Applies to: DeployerDrafted by the Index
Public organizations may describe the technical and organizational measures needed to ensure robustness, safety and cybersecurity through a designated annex.
Article 9 1 control
- ObligationApplies to: ProviderDrafted by the Index
The supplier should ensure that the AI system remains compliant with all requirements of Section B throughout the agreement.
Article 10 1 control
- ObligationApplies to: ProviderDrafted by the Index
Suppliers of high-risk AI systems should establish and maintain a quality management system.
Applies when: high-risk AI systems
Article 11 1 control
- ObligationApplies to: ProviderDrafted by the Index
Suppliers should ensure that conformity assessment is performed for high-risk AI systems.
Applies when: high-risk AI systems
Article 12 1 control
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must work together with public organisations in conducting evaluations of how the AI system may affect fundamental rights.
Article 13 1 control
- ObligationApplies to: ProviderDrafted by the Index
Suppliers should take corrective action when the AI system is found not to comply with the conditions in the contractual clauses.
Article 14 2 controls
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must cooperate with public organisations to explain to individuals subjected to AI-based decisions how the system operated and the main factors that influenced the decision.
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must provide technical information to public organisations to enable explanation of the AI system's functioning to individuals and groups, giving them adequate knowledge to contest the decision.
Annex B 4 controls
- Applies to: AnyoneDrafted by the Index
Rights to data sets belonging to public organisations accrue to the public organisation, though parties may modify this through Annex B.
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must deliver the most recent version of public organisation data sets to the organisation upon request.
- ObligationApplies to: ProviderDrafted by the Index
Suppliers must guarantee that use of their data sets and third-party data sets by the public organisation will not infringe third-party intellectual property or other rights.
- Applies to: DeployerDrafted by the Index
Public organisations may specify the file format in which data sets are to be delivered.
Change history
No changes recorded since we began monitoring this policy.