Reselling AI services: when does a business become a provider under the AI Act?

The AI Act allocates obligations according to the role an operator has in the value chain, not according to who trained the model. Businesses that sell or build services on language models from OpenAI, Anthropic, Google and others must therefore determine whether they are a provider, distributor, importer or deployer. AI Act Art. 25 governs when an operator further down the chain takes over the provider’s obligations for a high-risk system, and the provision was amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The questions are which role the business has, when a change of provider occurs, and how the contracts should be drafted.

What roles does the AI Act define in Article 3?

The Regulation operates with four principal roles, and the same business may hold different roles for different systems. In this article, provider refers to the role under the Regulation, while supplier refers to the contracting party. A provider is a person or body that develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, cf. AI Act Art. 3(3). It is irrelevant whether this is done for payment or free of charge. A deployer is a person or body using an AI system under its authority, other than in the course of a personal non-professional activity, cf. AI Act Art. 3(4).

A SaaS supplier that integrates a language model into its own product and sells the product under its own name is, in our assessment, the provider of the AI system from the outset. The business is at the same time a downstream provider, meaning a provider of an AI system that integrates an AI model supplied by another entity on a contractual basis, cf. AI Act Art. 3(68). The model supplier is the provider of the general-purpose AI model, cf. AI Act Art. 3(63). A consultant or integrator building a solution that the client puts into service under the client’s own name will normally not be the provider, because it is the client that has the system developed. Passing on a standard service under the producer’s name makes the business a distributor or, where the system comes from a third country, an importer.

When does reselling AI trigger a change of provider under Article 25?

AI Act Art. 25(1) provides that a distributor, importer, deployer or other third party is to be considered the provider of a high-risk system, and is subject to the obligations in Article 16, in three situations. The first is where it puts its name or trademark on a high-risk system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated (point (a)). The second is where it makes a substantial modification to a high-risk system (point (b)). The third is where it modifies the intended purpose of an AI system that has not been classified as high-risk, including a general-purpose AI system, in such a way that it becomes high-risk under AI Act Art. 6 (point (c)).

A substantial modification is a change made after placing on the market or putting into service which was not foreseen in the provider’s initial conformity assessment, cf. AI Act Art. 3(23). The change must affect compliance with the requirements in Chapter III, Section 2 or modify the intended purpose for which the system was assessed. Fine-tuning, new data sources or altered decision logic in a high-risk system may in our assessment amount to a substantial modification where accuracy, robustness or human oversight is affected. A change of model at the upstream supplier raises the same question, and it remains unsettled where the Commission will draw the line.

Point (c) is the most significant in practice for resellers, because a general assistant based on a general-purpose AI model is not high-risk in itself. Where an integrator markets the same assistant as a tool for screening job applicants, the system falls within point 4 of Annex III on employment, and the integrator becomes the provider of a high-risk system. The intended purpose is determined by the instructions for use, promotional material and technical documentation, cf. AI Act Art. 3(12), so that sales material alone may trigger the change of provider.

What happens to the initial provider?

Once a change of provider has occurred, the initial provider is no longer considered the provider of that specific AI system, cf. AI Act Art. 25(2). Following the amendment by Regulation (EU) 2026/1744, the initial provider must cooperate closely with the new provider and make available technical documentation sufficient to assess compliance with Article 16, known limitations and failure modes, and targeted technical access, including for testing and validation. The duty to cooperate does not apply where the initial provider has clearly specified that its system is not to be changed into a high-risk system.

The exception matters to both parties, because the usage policies of model suppliers frequently prohibit specified high-risk purposes, and such a reservation may relieve the supplier of the duty to hand over documentation. The integrator then stands as provider without the assistance the Regulation would otherwise secure. The duty to cooperate is also without prejudice to intellectual property rights, confidential business information and trade secrets, cf. AI Act Art. 25(5). According to the consolidated text, breaches of the obligations in Article 25(2) and (4) have now been added to the fining provision in AI Act Art. 99(4), with fines of up to 15 million euros or 3 per cent of worldwide annual turnover. This point has not been verified against the Official Journal.

What obligations follow from the provider role?

The provider of a high-risk system carries the heaviest obligations. Under AI Act Art. 16 the provider must ensure that the system complies with the requirements in Articles 8 to 15, operate a quality management system and keep documentation and logs. The provider must also carry out a conformity assessment, draw up an EU declaration of conformity, affix the CE marking, register the system and take corrective action. The presumption of conformity under harmonised standards is discussed in the article on EN 18286.

Importers and distributors have verification duties in respect of systems developed by others. Before placing a system on the market, the importer must verify that the conformity assessment has been carried out, that technical documentation exists, that the system bears the CE marking and that an authorised representative has been appointed, cf. AI Act Art. 23(1), and must keep the documentation for ten years. The distributor must check the CE marking, declaration of conformity and instructions for use, and must withhold systems it has reason to consider non-compliant, cf. AI Act Art. 24. The deployer’s obligations under AI Act Art. 26 are discussed in the article on AI vendor terms for high-risk use.

Outside the high-risk area, the transparency obligations in AI Act Art. 50 are the most relevant for downstream providers. A SaaS supplier offering a chatbot under its own name must ensure that users are informed that they are interacting with AI, and providers of systems generating content must mark it in a machine-readable format. These obligations apply in the EU from 2 August 2026 and are discussed further in the article on AI content labelling. The high-risk rules, including Articles 16 and 22 to 26, apply in the EU from 2 December 2027 for systems in Annex III and from 2 August 2028 for systems in Annex I, cf. AI Act Art. 113 as amended by the Omnibus.

What assistance must the general-purpose AI model provider give?

The provider of a general-purpose AI model must draw up, keep up to date and make available information and documentation to providers of AI systems who intend to integrate the model, cf. AI Act Art. 53(1)(b). The information must enable them to understand the capabilities and limitations of the model and to comply with their own obligations, and it must contain at least the elements set out in Annex XII. The obligation has applied since 2 August 2025 and is discussed further in the article on general-purpose AI models.

For high-risk systems, AI Act Art. 25(4) imposes stricter requirements on the contract between the provider and those supplying AI systems, tools, services, components or processes used in the system. The parties must specify by written agreement the necessary information, capabilities, technical access and other assistance, based on the generally acknowledged state of the art. The exemption for free and open-source licences does not extend to general-purpose AI models. The AI Office may develop voluntary model terms for such contracts. The major model suppliers in practice offer non-negotiable standard terms, and an integrator should therefore check before selling for high-risk purposes whether those terms provide the assistance the provision presupposes.

Do the rules on change of provider apply in Norway?

The AI Act and Regulation (EU) 2026/1744 have not been incorporated into the EEA Agreement, and EEA-Lex lists both as under scrutiny. On 30 October 2026 the Ministry of Digitalisation and Public Governance sent the Omnibus amendments for consultation with a deadline of 11 December 2026, as a supplement to the consultation on a draft Norwegian AI Act of 30 June 2025. The Ministry is preparing a bill but has not stated when it will be submitted.

Norwegian businesses are nevertheless covered when they offer AI systems in the EU. Under AI Act Art. 2(1) the Regulation applies to providers placing systems on the EU market irrespective of where they are established, and to providers and deployers in third countries where the output produced by the system is used in the EU. Until the Regulation is incorporated, a Norwegian provider is a third-country provider which, under AI Act Art. 22(1), must appoint an authorised representative in the EU before a high-risk system is made available there. A business in the EU reselling a Norwegian high-risk system under the Norwegian provider’s name will be an importer.

Which clauses should contracts for reselling AI contain?

The contract with the upstream supplier should reflect the roles under the Regulation. In our assessment it should in particular address the four matters set out below, since these are where the risk of an unintended change of provider arises.

• The supplier must provide documentation under Article 53(1)(b) and Annex XII, and under Article 25(2) and (4) where the service is used in high-risk systems.
• The supplier must give notice of model changes, deprecation of model versions and amendments to usage policies within a period that allows the business to assess whether the change is substantial.
• The parties must identify the purposes the supplier has excluded, so that the exception in Article 25(2) can be assessed before the sale.
• The supplier must not be able to suspend the service without prior notice and a reasonable period to remedy, cf. the article on cloud suspension clauses.

The contract with the customer should define the intended purpose and the purposes that are not permitted. It should provide that the customer itself becomes the provider and bears the obligations where it modifies the purpose or the system so that Article 25(1)(b) or (c) applies, and that the customer must indemnify the business for such changes. Usage policies from the model supplier must be flowed down to the customer, and the right to suspend the customer’s access should mirror the upstream supplier’s right against the business. Intermediaries giving customers direct model access must also consider OpenAI’s approval of intermediaries. The limitation of liability should contain a separate cap for regulatory requirements, cf. the article on limitation of liability in SaaS contracts.

What should the business do now?

Businesses that sell or build services on third-party AI models should map their role for each product before the high-risk rules apply in the EU. Further material on the regulatory framework is available on the artificial intelligence topic page.

1. Record for each product which model it is built on, under which name it is sold, and whether the business is provider, distributor, importer or deployer.
2. Review marketing, instructions for use and sales material, and remove wording that places the product in an Annex III purpose unless the business has addressed the provider obligations.
3. Establish a procedure for assessing whether fine-tuning, a change of model or new functionality is a substantial modification under Article 3(23).
4. Obtain the documentation under Article 53(1)(b) from the model supplier and check that it covers what customers will request.
5. Update customer contracts with a purpose limitation, provisions on customer modifications and a flow-down of usage policies.
6. Appoint an authorised representative in the EU before a high-risk system is offered to customers in the EU, for as long as the Regulation has not been incorporated into the EEA Agreement.

Questions and answers

Next legal review: 15 December 2026