The AI Act's second wave is a procurement problem, not a compliance one
The obligations are clear. The vendors who can meet them are not.
Placeholder article. The frontmatter is the real schema; the words are scaffolding for the template and are not editorial copy.
Placeholder copy, written to length so the template can be judged.
The compliance teams solved this one on paper eighteen months ago. There is a register, there is a risk classification, there is a named owner. What there is not is a supplier who will sign the annex.
The annex problem
Ask a vendor to warrant the training data provenance of a model they license from someone else and watch the call go quiet. The obligation sits with the deployer. The evidence sits three companies upstream. Nobody has yet built the contract that moves one to the other without a footnote that eats the warranty.
The buyers are ready. The sellers are ready. The paperwork between them is a different industry that has not been invented yet.
What the good ones are doing
Buying smaller. A model you can characterise beats a model you cannot, even when the benchmark says otherwise, because the benchmark is not the thing you have to sign.
That is not a compliance insight. It is a procurement one, and it is being made by procurement people who were not in the room when the policy was written.