Article 25 of the EU AI Act: three ways a deployer turns into a provider (and takes on provider duties)
Three triggers, with SME examples
| Trigger | Example |
|---|---|
| (a) Your brand on it | A recruitment agency white-labels a CV-screening tool as its own product |
| (b) Substantial modification | You retrain a supplier's credit-scoring model on your data and change how it decides |
| (c) New, high-risk purpose | You use a general chatbot to rank job applicants or decide on staff promotions |
What changes if you become the provider
- Risk management, data governance and technical documentation (Articles 9–11)
- Logging, transparency to deployers, human oversight, accuracy and robustness (Articles 12–15)
- Quality management system, conformity assessment, CE marking and EU database registration
How to stay a deployer
- Use high-risk tools only for the purpose the provider states
- Do not rebrand them as your own
- Get written confirmation from the vendor before retraining or changing logic
- Record each AI system, its purpose and your role, and review when use changes
Common mistakes
- Assuming "we only use it" always means deployer. Purpose changes can flip your role.
- Using general AI for HR or credit decisions without checking Annex III.
- No record of the intended purpose agreed with the vendor.
Frequently asked questions
When does a deployer become a provider under the AI Act?
Under Article 25(1): when it puts its name or trademark on a high-risk AI system, substantially modifies one that remains high-risk, or changes an AI system's intended purpose so it becomes high-risk.
Can using ChatGPT make my company a provider?
It can, if you change a general-purpose system's intended purpose to a high-risk use listed in Annex III, such as ranking job applicants (Article 25(1)(c)).
What happens to the original provider?
It is no longer the provider of that specific system for the AI Act, but must cooperate and provide the information needed (Article 25(2)).
What duties does a new provider take on?
The provider obligations in Article 16, including risk management, documentation, conformity assessment and registration.
Official sources
Not tax or legal advice. This is a free explainer of public rules; deadlines and rules can change by notification, so confirm on the official portal or with your CA before you file. Last checked 21 Oct 2026.
Get free deadline reminders. Free: one short email every Wednesday listing the GST, TDS and ITR due dates coming up. Unsubscribe anytime.
Subscribe free on Gumroad (email only, no payment).
Or put every date in your calendar now: free India tax deadline calendar (Google Calendar, Outlook, phone; .ics + spreadsheet).
If you want a ready-made tool
Record each AI system, its intended purpose and your role (provider or deployer) in one register. Free for up to 10 systems: EURO AI Register.
Unadhi Guides are free, independent explainers. Not an official government publication. We correct errors as soon as we find them: write to mininglife7@gmail.com.
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.