Analysis: Who Can Afford to Wait for Clear AI Rules?

Companies buying AI services need to know which requirements to put in contracts. Providers need to know what rules to build for. Both face uncertainty while the technology develops faster than legislation, a dilemma discussed at a roundtable hosted by think tank Think.ai. Participants had experience in law, policy, public administration and digital service delivery. Their comments were not attributed to individuals.

The EU AI Act distinguishes among uses. AI for recruitment screening and some credit assessments can be classed as high-risk, triggering requirements including risk management, documentation and human oversight. Under the EU’s AI Omnibus amendment package, the central high-risk requirements have been delayed: they apply from December 2, 2027, for those uses, and from August 2, 2028, for high-risk AI regulated as products, including some medical devices and machinery.

For qualifying older systems placed on the market or put into service before the relevant date, the requirements generally apply only after significant design changes. High-risk systems intended for public authorities have an outer deadline: providers and user organizations must take the necessary compliance measures by August 2, 2030.

The transition period can affect launch and procurement timing, but AI Act prohibitions and other laws, including GDPR, still apply. Participants said buyers should clarify contracts for future service changes, intended uses and the evidence providers will supply. A product’s claimed compliance does not by itself establish what a customer may do with it; risk classification depends on intended use.

Participants called for practical guidance from authorities and said standards can help, while stressing that certification of an AI management system is not blanket approval of every use. They also warned that documentation and audits can burden small providers and favor established companies.

They discussed CADA, the European Commission’s proposal from June to strengthen European data-center capacity and establish a framework for cloud and AI sovereignty. It is not law. Its proposed four public-sector levels range from EU-based storage and processing to stronger requirements for independence, control and software supply chains. Participants warned that buyers choosing the highest level by default could narrow the framework in practice and increase provider costs and customer constraints.

The discussion ended with disagreement over where AI work should begin; the source text cuts off before completing that point.