Can we show where the data behind our AI comes from, how it was cleaned and who checked it?
Pearstop answers it from the invoices and purchase data the company already has.
Sound familiar?
The client questionnaire
The internal AI review
The classification nobody can explain
Why it's hard today
The Act asks for documented data governance, data that is relevant, representative and as free of errors and as complete as possible, records of what the system did, and people who oversee it. Procurement and asset data starts as free text on invoice lines, supplier names that do not say what a supplier does, and edits nobody logged. The evidence has to be built from the lines.
What changes with Pearstop
- See every line the AI classified, with the data it came from.
- Show the checks and the human review behind each classification.
- Export the records when a client, auditor or regulator asks.
What applies, when, and to whom
In plain words: the Act arrives in steps. Some rules already apply. The strictest ones, for high-risk AI, have been postponed.
| When | What applies | Who it concerns |
|---|---|---|
| Since 2 February 2025 | Some AI uses are banned outright, for example AI that manipulates people or scores them on social behaviour. | Everyone who builds or uses AI in the EU |
| Since 2 August 2025 | Rules for the large general-purpose AI models behind chatbots and writing tools: documentation and copyright transparency. | Companies that build general-purpose AI models |
| From 2 August 2026 | Most of the rest of the Act, now enforced by the EU AI Office and national authorities. This includes transparency: AI that talks to people or creates content has to say so. | Companies that build AI systems (providers) and companies that use them (deployers) |
| Until 2 December 2026 | Extra time to label AI-generated content for generative AI systems that were already on the market on 2 August 2026. | Providers of those generative AI systems |
| From 2 December 2027 (was 2 August 2026) | The strictest rules, for high-risk AI in areas such as employment, education, biometrics and critical infrastructure: documented data governance, logs, human oversight. | Providers and deployers of those high-risk systems |
| From 2 August 2028 | The same high-risk rules for AI built into regulated products, such as lifts and toys. | Providers of those products |
What it means for a contractor, FM or infrastructure company: most use AI tools that others built, which makes them deployers. Whether a tool counts as high-risk depends on what it is used for, such as hiring, managing workers or running critical infrastructure. The transparency duties reach everyone. In every case, the AI is only as reliable as the data behind it, and clients and auditors already ask about that data.
(Legal basis: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), in force since 27 July 2026. The amendment postponed the application of the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Source for the timeline: European Commission, AI Act implementation timeline.)
What the Act asks of the data
For high-risk systems, the Digital Omnibus moved these duties to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Which duties apply to a given system is a question for the company's own legal team. They all rest on the data. This is what Pearstop supplies.
| Requirement | What the Act asks | What Pearstop provides |
|---|---|---|
| Data governance | Documented practices for how data is collected, prepared, labelled and cleaned, and for finding gaps and bias (Article 10, high-risk systems) | Every line is classified, cleaned and checked, and each step is recorded. |
| Data quality | Data that is relevant, sufficiently representative and as free of errors and as complete as possible for the intended purpose | Every supplier spelling matched to one supplier, every line classified down to the item, quality checks at every step. |
| Record-keeping | Automatic logs of events over the lifetime of the system (Article 12) | A timestamped audit trail of every file processed, exportable on request. |
| Deployer duties | Input data that is relevant and representative where the company controls it, retained logs and human oversight (Article 26) | Clean, structured input data, with the audit trail behind it. |
| Human oversight | People who can oversee, understand and correct the output of the system (Article 14) | Human review on top of the AI classification. |
What this looks like in client work
Frequently asked questions
What does the EU AI Act require for the data behind an AI system?
For high-risk systems, the Act asks for documented data governance and for data that is relevant, representative and as free of errors and as complete as possible. It also asks for automatic logs and human oversight. Pearstop structures procurement and asset data and records each step, so those records exist when they are asked for.
How do you prepare procurement data for the EU AI Act?
Start with the lines. Classify every invoice and purchase line, match every supplier spelling to one supplier and keep a record of each step. Pearstop does this and produces the audit trail as a by-product of the work.
Does the EU AI Act apply to companies that only use AI tools?
Yes. Companies that deploy AI systems carry duties too, including around input data, logs and human oversight for high-risk systems. The company's legal team confirms which duties apply to which system. Pearstop supplies the data side.
What records does the EU AI Act expect for AI-classified procurement data?
Records of what the system did over its lifetime: what went in, what came out and what changed. Pearstop generates a timestamped audit trail for every file it processes and keeps the classification traceable, exportable on request.
How does human review fit into EU AI Act compliance?
The Act expects people to oversee high-risk systems and to be able to correct their output. Pearstop adds human review on top of AI classification, which gained 20 accuracy points compared with AI alone without context.
Send us a sample of your procurement data
A sample is enough. We send back every line classified, with the audit trail behind it.
