Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
Procurement can ask for evidence before a statutory deadline. That does not turn a contractual request into a law, but it can still determine whether a product is ready for a particular customer.
Prepare evidence for the buyer’s actual question
Ask what the customer needs to establish. They may be reviewing data handling, access controls, incident response or the conditions under which the supplier can change the service. A generic compliance deck can miss every one of those questions while looking impressively complete.
Build a small evidence pack around the deployment. Explain the intended use, the relevant boundaries and the tests already performed. Identify limitations plainly. If a requested capability has not been implemented, distinguish the roadmap from the current product.
For an illustrative agent, demonstrate a permitted action and a rejected one. Show what happens when approval is missing. Explain who can inspect the resulting record. These demonstrations should use appropriate test data and should not expose another customer’s information.
Keep commercial promises aligned with the evidence. If the sales conversation introduces a new requirement, route it back to the people who must implement and support it. A sentence in a proposal can create months of work.
| Decision | Evidence to request |
|---|---|
| Customer requirement | Deployment-specific question |
| Evidence | Current demonstration or document |
| Gap | Owner, decision and honest limitation |
What to do with this
Treat procurement as a chance to make the product’s boundaries understandable. The goal is a clear agreement about what is being bought, not a contest to see who can attach the most PDFs.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
