You may already be a provider without knowing it — Article 25(1) is the trap.
If you embed, rebrand or substantially modify an AI model you are a provider under Article 25(1), with Annex IV technical documentation, conformity assessment and CE marking — a completely different cost base from being a deployer.
- Annex
- Annex III + Article 25(1) — provider conversion, GPAI integration
- Provisions
- Art. 25(1) · Annex IV · Arts. 53–55 · Art. 50
- Pack
- €149/month add-on · 4 duties · 1 notice templates
Why this sector is different
Software companies sit on both sides of the line. Internal use is deployer territory; shipping an AI feature to customers can make you a provider. The distinction, documented early, is the difference between a €490/month programme and a conformity-assessment project.
Determine the role for each shipped AI feature and record it
Rebranding, substantial modification or putting your name on a high-risk system makes you the provider.
Art. 25(1) · Art. 3 · due within 14 days of activation
Draft Annex IV technical documentation for any high-risk feature you place on the market
This is the provider's deliverable and it is substantial. Find out now whether you need it.
Annex IV · Art. 11 · due within 90 days of activation
Flow the provider duties into your own supplier terms
Article 25(4) expects the information, capabilities and access to be specified in writing between provider and supplier. Without it the duty is impossible.
Art. 25(4) · due within 60 days of activation
Disclose AI features in customer-facing documentation
A customer's own deployer duties depend on your disclosure. It also sells.
Art. 50 · due within 30 days of activation
The notices you owe
Unlocked with the pack, rendered with your own facts, blanks kept where you must decide.
Customers, in product documentation
Customer-facing AI feature disclosure
{feature} uses an AI system. It is {tier} under the EU AI Act. A human can review and override its output. Inputs are processed in the {region} and are not used to train models. …
What your buyers will ask
The questions that stall a deal or trigger an audit. Each one is a control in the matrix.
- ?Are you the provider or the deployer of this feature?
- ?Can you give us Annex IV documentation?
- ?Where do our inputs go, and are they used for training?
Straight answers
We just add our logo to a model. Does that make us a provider?
It can. Article 25(1) treats putting your name or trade mark on a high-risk AI system as becoming its provider. The same applies if you substantially modify it or change its intended purpose. For non-high-risk features the provider question is mostly contractual; for high-risk features it is the whole ballgame.
We integrate a GPAI model through an API. What do we owe?
You are generally a deployer of the GPAI-based system, unless you place a high-risk system on the market under your own name. Either way you need the provider's documentation for your deployer duties, and your customers will ask for it.
Know where you stand before the questions arrive.
Four minutes, no card. You get your exposure score and the exact articles that apply to a technology & saas organisation.