How to Sell AI to the EU Public Sector: A Step-by-Step Guide to Winning Contracts Under the AI ACT

Last updated: June 2026 · Reading time: 9 minutes

---

The EU public sector is investing heavily in AI, from healthcare diagnostics to smart city infrastructure. But there’s a catch: you can’t win a single contract without proving AI ACT compliance.

Public procurement rules now explicitly require AI ACT adherence for high-risk systems (Article 41). And even for lower-risk AI, compliance is the tiebreaker between vendors. If you’re not ready, you’re not in the game.

This guide gives you the 5-step playbook to dominate EU public sector tenders- with DILAIG helping you accelerate every phase.

---

Why the EU Public Sector Is a Significant Opportunity for AI Vendors

Sector	Key AI Use Cases	Risk Level (AI ACT)
Healthcare	Diagnostic support, patient triage, drug discovery	High (Annex III, point 1)
Transport	Traffic management, autonomous public transport	High (Annex III, point 2)
Education	Personalized learning, proctoring, admissions	High (Annex III, point 3)
Public Safety	Predictive policing, emergency response	High (Annex III, point 6)
Social Services	Benefits eligibility, fraud detection	High (Annex III, point 5)
Administration	Document processing, citizen services	High (Annex III, point 8)

In nearly all of these areas, an AI system used by a public entity falls under Annex III and must meet high-risk obligations- which in practice makes compliance a market-access prerequisite rather than just a competitive edge.

---

The 5-Step Playbook to Win Public Sector Contracts

Step 1: Classify Your AI System (Before You Even Bid)

Why it matters: If your system is high-risk (Annex III), you’ll need full AI ACT compliance to qualify. If it’s not high-risk, you still need to prove it.

How to do it:

1. Map your use case to Annex III categories (e.g., healthcare = point 1, employment = point 4).
2. Assess if it’s a substantial modification of an existing system (Article 25).
3. Check for prohibited practices (Article 5)- if it’s banned, don’t bid.

DILAIG’s Role: DILAIG’s free audit (50 questions, 20 minutes) classifies your system against Annex III and identifies the applicable obligations.

Pro Tip: If your system is high-risk, start the compliance process 6–12 months before bidding- it takes time.

---

Step 2: Build Your Compliance Package (The Non-Negotiable)

Public sector buyers won’t even look at your proposal unless you can prove compliance. Here’s what you need:

For High-Risk AI Systems (Annex III)

✅ Technical Documentation (Annex IV)- System architecture, training data, performance metrics. ✅ EU Declaration of Conformity (Article 47)- Signed by an authorized representative. ✅ Risk Management System (Article 9)- Documentation of your risk assessment and mitigation. ✅ Fundamental Rights Impact Assessment (FRIA) (Article 27)- Mandatory for public sector deployments. ✅ EU Database Registration (Article 71)- Proof of registration for high-risk systems. ✅ CE Marking (Article 49)- Only applicable if your system falls under harmonized legislation.

For Non-High-Risk AI Systems

✅ Self-Assessment Report- Proving your system doesn’t fall under Annex III. ✅ Transparency Documentation (Article 50)- For limited-risk systems (e.g., chatbots, deepfakes). ✅ GDPR Compliance Proof- Public sector buyers always check this.

DILAIG’s Role: For high-risk systems, DILAIG generates the technical documentation (Annex IV), the EU Declaration of Conformity, the transparency notice, and the FRIA from the answers you gave in the free audit- so you’re not starting each document from a blank page.

---

Step 3: Align with Public Procurement Rules (The Hidden Hurdles)

Even with AI ACT compliance, you must also comply with EU public procurement law (Directive 2014/24/EU). Here’s how:

1. Include Compliance in Your Technical Specifications

• Don’t: "Our AI is compliant with relevant laws."
• Do: "Our AI system complies with AI ACT Article 6 (High-Risk Requirements), Article 9 (Risk Management), and Article 27 (FRIA), as evidenced by [attached documents]."

DILAIG’s Role: Documentation generated by DILAIG from your audit gives you precise, article-referenced language you can reuse in your technical specifications.

2. Use the Right Award Criteria

Public buyers typically evaluate bids on a mix of price and quality, with regulatory compliance often acting as a gatekeeper before the substantive comparison even begins. Exact weightings vary by tender and are set out in the procurement documents.

How to Stand Out:

• Offer a compliance guarantee (e.g., "We warrant our system meets AI ACT requirements as of [date].").
• Provide structured documentation rather than general claims.
• Show scalability (e.g., "Our compliance processes work across multiple member states.").

3. Prepare for the Selection Phase

Public buyers will verify your compliance claims. Be ready with:

• A compliance checklist covering every applicable obligation.
• Sample documentation (redacted if necessary).
• References from other public sector clients.

Pro Tip: Complete the free DILAIG audit ahead of time to identify documentation gaps before you submit, rather than discovering them during the selection phase.

---

Step 4: Master the Contract Negotiation (The Make-or-Break Phase)

Once you’re shortlisted, the real scrutiny begins. Here’s what public buyers will demand:

1. Contract Clauses You MUST Include

Clause	Why It Matters
AI ACT Compliance Warranty	Protects the buyer from non-compliance risks
Data Processing Agreement (DPA)	GDPR + AI ACT data obligations
Incident Reporting (Article 73)	Defines your obligations for serious incidents
Change Management	Ensures modifications don’t break compliance
Audit Rights	Allows the buyer to verify compliance

DILAIG’s Role: The documentation generated from your audit (technical documentation, DoC, FRIA) provides the factual basis these contract clauses rely on- your legal team drafts the clauses themselves.

2. Common Negotiation Pitfalls

• "We’ll comply when we deploy." → No. Compliance must be proven before contract signing.
• "Our general T&Cs cover it." → No. Public sector contracts require specific AI ACT clauses.
• "We’re not liable for deployer errors." → Partially true. But you are liable for your system’s compliance (Article 26).

Pro Tip: Involve your legal team early- documentation that’s already structured reduces the time they need to spend on it.

---

Step 5: Deliver and Maintain Compliance (The Long Game)

Winning the contract is just the first step. Public sector buyers will monitor your compliance throughout the project.

1. Post-Contract Compliance Obligations

• Annual Compliance Reports (Article 9(1)).
• Incident Reporting (Article 73)- 2-day deadline for life-threatening issues.
• Documentation Updates (Article 11)- Whenever the system changes.
• Audit Support- Be ready for unannounced checks.

DILAIG’s Role: A completed DILAIG audit can be reopened to track your obligations as they evolve over the life of the contract.

2. How to Handle Changes

If you modify your AI system during the contract:

1. Assess if it’s a substantial modification (Article 3(23)).
2. Update your technical documentation (Annex IV).
3. Re-run conformity assessment (if high-risk).
4. Notify the buyer and get written approval.

DILAIG’s Role: Updating your audit answers after a substantial modification lets you regenerate documentation aligned with the new version of the system.

---

Illustrative Scenario: Winning a Public Tender Through Well-Prepared Compliance

Consider a hypothetical example. A medical imaging AI startup bids on a public tender for an AI-assisted screening tool across several hospitals, competing against more established vendors.

A structured approach might look like:

1. Classify their system as Annex III, point 1 (Medical Devices).
2. Generate a full compliance package (Annex IV docs, FRIA, DoC) from a DILAIG audit.
3. Include AI ACT clauses in their technical specifications.
4. Provide a documented compliance warranty.
5. Offer post-contract monitoring as a value-add in their proposal.

This scenario illustrates the general idea: well-prepared compliance documentation can become a differentiator against more established competitors, without guaranteeing any particular tender outcome.

---

How DILAIG Helps in the Public Sector

Challenge	What the DILAIG audit provides
Risk Classification	Annex III classification from 50 structured questions
Compliance Documentation	Generates technical documentation, DoC, FRIA, and transparency notice for high-risk systems
Procurement Language	Article-referenced documentation you can reuse in technical specifications
Ongoing Tracking	Reopenable audit to track the system’s evolution over the life of the contract

---

Common Mistakes That Cost You Contracts

Mistake	Why It’s Fatal	How to Fix It
Assuming compliance is optional	Public buyers won’t even shortlist non-compliant vendors	Start with the free DILAIG audit
Using generic compliance language	Buyers see through vague claims	Rely on referenced, system-specific documentation
Ignoring FRIA requirements	Mandatory for public sector deployers	Generate your FRIA from the DILAIG audit
Not updating docs post-contract	Non-compliance = risk of contract termination	Update your audit whenever the system changes materially
Underestimating procurement timelines	Public tenders take 6–12 months	Start compliance early

---

Your Public Sector Checklist (Print This Out!)

✅ Pre-Bid Phase (6–12 Months Before)

• Classify my AI system under AI ACT (free DILAIG audit).
• Generate applicable compliance documentation.
• Register in EU database (if high-risk).
• Have documentation reviewed by legal counsel if needed.

✅ Bidding Phase (3–6 Months Before)

• Include AI ACT compliance in technical specs.
• Highlight compliance strengths in quality criteria.
• Provide sample documentation (redacted).
• Offer compliance warranty.

✅ Contract Phase (1–3 Months Before)

• Have your legal team draft the contract clauses.
• Negotiate audit rights.
• Define incident reporting process.
• Agree on change management terms.

✅ Post-Contract Phase (Ongoing)

• Set up ongoing compliance tracking.
• Schedule annual compliance reports.
• Update documentation for changes.
• Prepare for audits.

---

The Bottom Line: Compliance as a Competitive Advantage

In the EU public sector, AI ACT compliance is often less an administrative hurdle than a market-access prerequisite. Vendors who can prove compliance: ✅ Win more contracts (public buyers trust compliant vendors). ✅ Scale across borders (compliance work done for one member state = a reusable base for others). ✅ Avoid costly mistakes (non-compliance = bans, fines, lawsuits).

DILAIG doesn’t replace a lawyer- but it structures the classification and documentation work behind a credible public sector bid.

---

How DILAIG Helps

The free DILAIG audit (50 questions, 20 minutes, no credit card required) classifies your system against Annex III and identifies the applicable obligations. For high-risk systems, DILAIG then generates the technical documentation, DoC, transparency notice, and FRIA from your answers.

For vendors or consultants managing compliance across several prospects or public sector clients in parallel, connecting an AI agent via MCP lets you pre-fill an audit draft per system or per client from existing internal documents. The agent never sees the score and cannot submit the audit or generate documents- a human must always validate the draft before proceeding.

---

DILAIG helps you structure AI ACT compliance as part of your public sector go-to-market. Our tool doesn’t replace legal advice.

→ Find out your classification and obligations- free audit- 20 minutes, no credit card required.

See DILAIG’s AI agent / MCP connection · View pricing

---

Not sure if this applies to you? Check in 2 minutes, no account needed.

Am I a GPAI provider? →   ·   Is my AI prohibited under Article 5? →