Missing provider documentation

What it is

Using a model responsibly requires knowing what it is for, how it performs, where it fails and how it should be overseen. That knowledge sits with the provider. The EU AI Act requires providers of high-risk systems to give deployers instructions for use, and providers of general-purpose models to give documentation to those who build on them. In practice the material is often marketing, a short model card, or nothing. The deployer's own obligations, such as validation, impact assessment and documentation, then cannot be met. The internal equivalent is covered in inadequate technical documentation.

How it happens

• The provider treats technical detail as a trade secret.
• Documentation describes a different version from the one supplied.
• A reseller passes on the product and not the information.
• The contract contains no right to information.

Why it matters

Validation is limited to black-box testing, limitations are found by accident, and regulatory documentation has gaps the organisation cannot fill. Responsibility for the outcome stays with the deployer.

Warning signs

• Validators report that they could not obtain basic facts about the model.
• No instructions for use or statement of limitations is on file.
• Test results by population are unavailable.
• Requests for information go unanswered.