EU AI Act and ISO 42001 for General Counsel: roles, AI contracts and liability

Is the company a provider or a deployer for each AI system? Do rebranding and repurposing change legal liability?

Under Article 25(1), you are treated as the provider of a high-risk AI system if you:

• (a) put your name or trademark on a high-risk system already on the market (unless contracts allocate otherwise)
• (b) make a substantial modification
• (c) change the intended purpose so that it becomes high-risk, for example using it for staff scheduling and performance decisions

A Taiwanese company with no EU establishment is still in scope if it places AI systems on the EU market or their output is used in the EU (Article 2(1)). Record the determination in the AI system inventory; the final view on legal classification comes from lawyers.

When we buy AI from a vendor, or sell AI features to customers, what should the contract cover?

• Article 25(4): the provider of a high-risk AI system and any third party supplying AI systems, tools, services, components or processes shall, by written agreement, specify the necessary information, capabilities, technical access and other assistance so the provider can fully comply; the AI Office may develop and recommend voluntary model terms. Recital 90 explains that model terms are meant to facilitate cooperation along the value chain.
• Article 25(2): the original provider cooperates with the new provider, unless it has clearly specified that the system is not to be changed into a high-risk system.
• What deployers need: use the system according to the provider's instructions, keep logs for at least 6 months, and inform the provider when risks arise (Article 26); the contract must secure the instructions, logs and a contact point.

A framework: state clearly who the provider is; the scope of technical documentation, test evidence and logs to be provided; notice of model updates; deadlines to cooperate on incident reporting; liability caps and indemnities. Acceptable terms are for legal counsel to judge case by case.

If AI causes harm, what liability does the company face? How high are the fines?

Administrative fines (Article 99, whichever is higher; for SMEs, whichever is lower):

Civil damages: the EU AI Act has no civil damages rules of its own, and the European Commission's Q&A states that the AI Act does not create criminal offences or a right to compensation. The Commission has withdrawn the AI Liability Directive proposal; harm caused by AI is mainly handled under the new Product Liability Directive (EU) 2024/2853 (covering software and AI systems, for products placed on the market from 9 December 2026) and Member State tort law.

How contracts allocate liability, and whether a provision is needed, are for legal counsel and the external auditor to judge case by case.

Employees paste customer data or company secrets into generative AI. What should legal control?

• AI literacy: Article 4 has applied since 2 February 2025; as amended by Regulation (EU) 2026/1744, providers and deployers take measures to support staff AI literacy, without having to guarantee any specific level. The Commission explains that no certificate is needed, internal training records can be kept, and staff should know specific risks such as hallucinations.
• Internal use rules: state which data must not be entered, such as confidential and personal data, and train staff; for general generative AI tools with no high-risk use, this is usually enough.
• Trade secrets: before confidential information goes into an external AI service, check what the contract says about use and retention of inputs; reasonable secrecy measures must be visible in rules, training sign-offs and access records.

Whether an AI service's terms let the vendor use input data, and whether data licensing is lawful, is ultimately for legal or outside counsel to judge.

If an AI system has a serious incident, must we notify authorities? What is legal's role in reporting?

• Providers (Article 73): report to the market surveillance authority of the Member State where the incident occurred, no later than 15 days after becoming aware; 2 days for widespread infringements and similar cases; 10 days where a person has died; an incomplete initial report may be submitted first.
• Deployers (Article 26(5)): monitor the operation of the high-risk system and inform the provider when risks or serious incidents arise.
• The Commission has issued draft guidance and a reporting template on Article 73 for consultation.

Legal should decide in advance: the company's role in each system, who decides whether something is a serious incident, who approves public statements and notices to providers or customers, and how decisions are recorded. The service page's approach is to fold post-market monitoring and serious incident reporting into the existing security incident process.

What does Taiwan's AI Basic Act require? Can an ISO 42001 certificate show we met our duties?

• Taiwan: the AI Basic Act was promulgated and took effect on 14 January 2026, with the National Science and Technology Council as the central competent authority; most provisions govern government, and concrete requirements for companies will mainly come through risk-based rules and industry guidelines from sector regulators, which the Executive Yuan requires by January 2028. The Ministry of Digital Affairs published AI Risk Classification Framework 1.0 on 7 July 2026 as a reference for inventories.
• Limits of ISO 42001: it is a certifiable AI management system standard but not a harmonised standard under the EU AI Act, so certification creates no presumption of conformity under Article 40(1). As of October 2026, the only AI Act harmonised standard published in the Official Journal is EN 18286:2026 (AI quality management system, supporting Article 17).
• What it can show: the AI system inventory, risk and impact assessments, human oversight and incident records kept under ISO 42001 are evidence that governance runs; whether they work as a legal defence is for legal counsel to judge case by case.

How does Winners Consulting help the General Counsel with the EU AI Act and ISO 42001?

This is Winners Consulting's own account. Test us with the questions above.

• Who leads: VP- and director-level consultants run every engagement personally and do not outsource, and hold ISO 42001 lead auditor qualifications; Winners Consulting is a consultancy and does not issue certificates
• Roles and risk levels: we inventory AI systems across the organisation, determine roles and risk levels, and record the determinations in the AI system inventory
• Three core documents: the AI system inventory, the AI risk and impact assessment, and the EU AI Act obligations matrix (each obligation by role, with owner, evidence and due date), each column citing the article
• Post-market monitoring: post-market monitoring and serious incident reporting folded into the existing security incident process
• Division of work: we build the system and the chain of evidence; legal opinions come from partner lawyers; certification is done by a certification body accredited under ISO/IEC 42006
• Timeline (as listed on the service page): high-risk AI compliance usually 6–9 months; with integrated ISO 42001 certification 9–12 months
• First step: the first mechanism diagnosis is free

More: EU AI Act, ISO 42001, choosing an EU AI Act consultant, roles when repurposing or rebranding, evidence for third-party AI