← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Article 25: when a distributor or deployer becomes a provider

Article 25 says a distributor, importer, deployer, or other third party is treated as the provider — and takes on the full set of Article 16 obligations — in three cases: putting their name or trademark on a high-risk system already on the market, making a substantial modification to a high-risk system, or modifying the intended purpose of a system (including a general-purpose AI system not originally classified as high-risk) so that it becomes high-risk. The original provider is no longer considered the provider for that system, unless the contract clearly reserves the obligations to them, but must cooperate and make necessary information available.

Who it applies to

Anyone building on top of someone else's model or agent framework and shipping it under their own name, fine-tuning it into a new use case, or wrapping a general-purpose model with tools and a system prompt that turns it into a high-risk application — for example, a hiring or credit-scoring agent built on a general-purpose model.

What evidence this implies

You need to be able to show what you changed relative to the upstream system: which model or component you started from, what modifications you made, and when the intended purpose shifted. Without that record, it is hard to argue where the original provider's responsibility ends and yours begins.

Gaps to state honestly

Article 25 does not define "substantial modification" with a bright line; it is a judgment call that depends on whether the change affects compliance with the requirements or changes the intended purpose. Vetro records what happened at runtime — it does not tell you whether a given fine-tune or prompt change counts as substantial.

How Vetro helps

Vetro's hash-chained, ed25519-signed ledger records the model, tool calls, and policy version behind every run, which is the raw material for showing what you built and when it changed. Vetro Attest verifies a ledger or OTLP GenAI trace for free and, for 49 USD, issues a counter-signed report mapping the evidence to the EU AI Act. This is technical evidence, not legal advice.

If you are unsure whether your modified system counts as high-risk, try the high-risk classifier, or estimate exposure with the penalty calculator.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.