{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","id":"AIPT-OBL-0029","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0029","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","short_title":"Responsibilities along the AI value chain","category":"governance_accountability","summary":"A distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system, with all Article 16 duties, if it puts its own name or trademark on a system already on the market, makes a substantial modification to a high-risk system that stays high-risk, or changes the intended purpose of a system so that it becomes high-risk. The original provider then ceases to be provider for that system but must cooperate and supply the information and access needed for the new provider to comply.\n","practical_action":"Add a reclassification check to change control so that white-labelling, fine-tuning or repurposing a high-risk system triggers the provider workstream.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 25(1) and 25(2)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider","deployer","importer","distributor"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","safety_critical"],"applicability":[{"description":"Any organisation in the value chain that rebrands, substantially modifies or repurposes a high-risk AI system; original providers owe the cooperation duty.","actors":["deployer","distributor","importer","provider"],"conditions":null}],"evidence_examples":[{"title":"Change-control reclassification assessment","description":"Documented decision on whether a modification or rebranding triggers provider status.","artifact_type":"record"},{"title":"Cooperation clause with original provider","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4.1; Annex A.10.2","note":"Determining the organisation's role and allocating responsibilities along the chain.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1, MAP 1.1","note":"Roles across the AI supply chain and context of use.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"supports","note":"Contracts set out cooperation from the original provider.","confidence_level":"high","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"},{"slug":"ai-system-inventory","title":"AI system inventory and classification","kind":"process","relationship":"supports","note":"Inventory records the organisation's role for each system.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-system-inventory"},{"slug":"model-release-and-change-management-gate","title":"Model release and change-management gate","kind":"process","relationship":"satisfies","note":"The gate flags substantial modification, rebranding and repurposing and opens the provider duties.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}