The EU AI Act is often read as a compliance obligation on deployers. For procurement teams it functions more usefully as a specification for what a supplier must be able to produce.
High-risk classification brings documentation duties: intended purpose, data governance, logging, human oversight and post-market monitoring. A buyer who requires those artefacts at tender stage filters the market efficiently, because vendors who cannot produce them will not be able to produce them later either.
The practical shift is in contract language. Clauses specifying log retention, model change notification, evaluation evidence and portability now do more work than clauses about uptime.