When do I, as a user, become the provider of an AI system (Art. 25)?
Adopted 2026-06-16 · ≈ 2 min read · 
edited by Dirk Baaijen
You become the provider once you put your name or brand on a high-risk system, make a substantial modification, or change its intended purpose so it becomes high-risk. The heavier provider obligations then apply.
Short answer: Normally you are the deployer of AI you have bought in, with lighter duties than the provider. But Article 25 of the AI Act sets out three situations in which you yourself become the provider of a high-risk system — and then inherit the full, heavier provider obligations.
The three situations under Article 25
Under Article 25(1), you (as a deployer, distributor or importer) are deemed to be the provider of a high-risk system in three cases:
- Name or brand (rebranding): you put your own name or trademark on a high-risk system that is already on the market. White-labelling or offering someone else's AI under your own flag therefore makes you the provider.
- Substantial modification: you make a substantial modification to a high-risk system in such a way that it remains high-risk. The system changes materially and you take over responsibility.
- Change of intended purpose: you change the intended purpose of a system that was not classified as high-risk, so that it does become high-risk.
In each of these cases the original provider steps back: it no longer counts as the provider for that specific system, but it must still support you with information and access (Article 25(2)).
Why this matters in practice
Many organisations buy AI in and assume they are "just a user." But as soon as you start fine-tuning, reconfiguring or stretching the scope of use, you can unknowingly cross the Article 25 line. Examples:
- You buy a planning tool and put your own brand name on it towards customers.
- You further train a bought-in model on your own data so that it performs materially differently.
- You use a general-purpose tool for a new purpose that falls under a high-risk category (Annex III).
What this means if you adapt a GPAI model
If you adapt a general-purpose AI model (GPAI) and build a high-risk application on top of it, Article 25 can make you the provider of that high-risk system. You then inherit duties such as risk management, technical documentation, registration, conformity assessment and human oversight. So before you start, assess whether your change is "substantial" or alters the intended purpose — and record who holds which role.
Read more: AI Act: timeline of obligations. Take the scan.
Sources
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2024/1689 (AI Act), Art. 25: responsibilities along the value chain.
Read next
Provider or deployer in HR AI: who is what?
In HR AI the builder of the ATS or HR tech is usually the provider and the employer the deployer. But an employer can become a provider itself through own branding or substantial modification (Art. 25). The role determines which duties apply.
Registering high-risk systems in the EU database (Article 49)
Article 49 of the AI Act requires providers and certain deployers to register high-risk systems in a public EU database before deployment. The registration makes visible which systems are on the market and is a condition for lawful use.
Procuring an AI model (GPAI): what duties do you have as a deployer?
The heaviest GPAI duties fall on the provider, not on you. As a deployer your obligations centre on AI literacy (Article 4), transparency (Article 50) and — for high-risk use — the deployer duties in Article 26.