Demystifying Supply Chain Risk Assessment EU ARTIFICIAL INTELLIGENCE ACT: SUPPLY CHAIN DUE DILIGENCE REQUIREMENTS
The EU AI Act establishes a comprehensive regulatory framework for AI systems based on risk categorization. The regulation applies progressively. Prohibitions and AI literacy requirements took effect in February 2025. GPAI model obligations became enforceable in August 2025. Full high-risk AI system requirements were originally set for August 2, 2026. As of early 2026, however, the European Commission’ s Digital Omnibus on AI proposal is under active legislative consideration, seeking to link high-risk enforcement to the availability of harmonized standards, with backstop dates of December 2, 2027( Annex III systems) and August 2, 2028( Annex I product-embedded systems) [ 8 ]. We note that the Digital Omnibus remains a proposal; until formally adopted, the original August 2026 deadline applies. The substantive obligations themselves are not weakened by the Omnibus. Of particular significance for supply chain management are the Act’ s requirements for deployers of high-risk AI systems and the responsibilities outlined in Article 25 regarding the AI value chain.
Article 25 establishes that organizations throughout the AI supply chain bear compliance responsibilities. This creates what the regulation terms‘ cascading compliance requirements.’ A company deploying AI systems for supplier risk assessment, procurement decision-making, or vendor evaluation must ensure not only its own compliance but also verify that its AI providers meet relevant regulatory standards [ 9 ]. The result is a dual imperative. Organizations must conduct thorough due diligence on their AI system suppliers while also potentially using AI systems that themselves require supply chain due diligence. Key Article 25 obligations include:
• Requesting detailed technical documentation from AI system providers
• Assessing the provider’ s data governance practices
• Evaluating human oversight mechanisms
• Verifying accuracy, robustness, and cybersecurity measures
• Establishing written agreements specifying information sharing and technical access rights
ECODESIGN FOR SUSTAINABLE PRODUCTS REGULATION AND DIGITAL PRODUCT PASSPORT REQUIREMENTS
The ESPR introduces mandatory Digital Product Passports that will fundamentally transform supply chain transparency requirements. DPPs function as digital identity cards for products, storing comprehensive sustainability performance, materials, manufacturing, and lifecycle data. The ESPR entered into force on July 18, 2024, with phased implementation beginning in 2026 for iron and steel products and expanding to textiles, electronics, and other categories through 2029.
84