Risk · R-100 · Governance & Accountability
Unrecognised provider obligations
An organisation rebrands, substantially modifies or repurposes an AI system and takes on a provider's legal duties without realising it.
- Severity
- Medium
- Audience
- Heads-of · Practitioner
- Frameworks
- Article 6 · Article 25
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
The EU AI Act places its heaviest duties on providers. A deployer, distributor or other party is treated as the provider of a high-risk system if it puts its own name or trademark on one, makes a substantial modification to one, or changes the intended purpose of a system so that it becomes high-risk. Ordinary activities, such as fine-tuning, white-labelling or extending a tool to a new use, can therefore change an organisation's legal role.
How it happens
- A bought system is presented to customers under the organisation's brand.
- A model is fine-tuned or reconfigured beyond what the supplier's instructions allow.
- A general-purpose tool is applied to a use listed as high-risk.
- Contracts do not address which party holds which role.
Why it matters
Provider duties include risk management, technical documentation, conformity assessment and post-market monitoring. An organisation that does not know it holds them will have done none of them.
Warning signs
- No analysis records the organisation's role for each high-risk system.
- Supplier products carry the organisation's branding.
- Fine-tuning or repurposing was not reviewed by legal.
- Supplier terms exclude the use the organisation is making.
Mitigating controls
Primary controls
- AI risk tiering and classification Directive
- Classification on change tests whether a modification or rebranding makes the organisation a provider. Each system is assigned an internal risk tier and a regulatory class by documented criteria, the result is reviewed independently, and it is revisited whenever the system or its use changes.
Supporting controls
- AI change management Preventive
- Flags substantial modifications for that test. Changes to models, prompts, data sources, tools and configuration are assessed, tested, approved and versioned before they reach production.
- AI contract terms Directive
- Allocates provider and deployer duties with the supplier. Contracts with AI suppliers cover data use, change notification, information and audit rights, sub-contracting, incident notification, liability and exit.
- High-risk conformity assessment and registration Preventive
- Repeats the assessment when a substantial modification is made. High-risk AI systems complete the required conformity assessment, declaration, marking and registration before they are placed on the market or used, and again after substantial modification.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Article 6 | Classification rules for high-risk AI systems Classification after repurposing. |
| EU AI Act | Article 25 | Responsibilities along the AI value chain The rule that makes a modifier a provider. |
Sources
- EU AI Act: Regulation (EU) 2024/1689 European Union (EUR-Lex) · official text
Related terms
How to cite
Axiom Verity (2026). Unrecognised provider obligations. Reference Library, R-100. https://axiom-verity.com/risks/unrecognised-provider-obligations. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.