Yes, building on an open AI model can change your role under the EU AI Act. A business that only uses a model is usually a deployer. One that substantially modifies it, puts its own name on the system or turns it to a high-risk purpose can become a provider, with heavier duties. Boards should know each system’s role.
This question is now being asked openly by AI investors and technology leaders, as ever larger open models are released. This article is AIPEX’s own governance guidance on what building on such models means for a business under EU law. It is governance guidance, not legal advice.
Why does role matter so much under the EU AI Act?
The EU AI Act assigns duties by role (Regulation (EU) 2024/1689, 13 June 2024). Providers, the organisations that develop an AI system or model and place it on the market under their own name, carry most of the weight: technical documentation, risk management, conformity assessment for high-risk systems and ongoing monitoring. Deployers, the organisations that use a system under their authority, have lighter duties such as human oversight, using the system as instructed and informing people where required.
Many boards assume that because they did not build the underlying model, they are deployers. That is often right. It stops being right when the business changes what it received.
When does a deployer become a provider?
For high-risk AI systems, Article 25 of the Act treats a distributor, importer or deployer as a provider if it does any of three things: puts its name or trademark on a high-risk system already on the market, makes a substantial modification to such a system so that it remains high-risk, or changes the intended purpose of an AI system so that it becomes high-risk. The third is the one to watch. A general-purpose assistant built on an open model is not high-risk in itself. Put it to work screening job candidates or assessing creditworthiness, uses listed in Annex III, and the business that made that choice may be the provider of a high-risk system.
Under the Act as amended by Regulation (EU) 2026/1744 (Regulation (EU) 2026/1744, the Digital Omnibus on AI), duties for Annex III high-risk systems apply from 2 December 2027. That gives time to plan, not time to wait.
What if we fine-tune the model itself?
Separate rules cover general-purpose AI models, and they have applied since 2 August 2025. The European Commission’s guidelines explain when a business that modifies such a model becomes its provider. The indicative test is whether the modification uses more than one third of the training compute of the original model. If it does, the modifier becomes the provider of the modified model, though its obligations are limited to the modification (European Commission, Guidelines on the scope of obligations for providers of general-purpose AI models, July 2025).
Most business fine-tuning uses far less compute than that, so most will stay below the line. The point for a board is that someone must check, record the answer and repeat the check when the work grows.
Open licensing also matters. Article 53(2) exempts providers of models released under a free and open-source licence, with their parameters made public, from some technical documentation duties, unless the model poses systemic risk. The exemption applies to the original provider’s documentation. It does not remove the duties of a business that builds a high-risk system on top.
How should the board keep track?
The simplest control is a role column in the AI inventory. For each system, record:
| Question | If the answer is yes |
|---|---|
| Did we develop it, or have it developed, and put it on the market under our name? | We are likely the provider |
| Did we put our name on a high-risk system someone else built? | We may be the provider |
| Did we substantially modify a high-risk system? | We may be the provider |
| Did we use a general-purpose system for an Annex III purpose? | We may be the provider of a high-risk system |
| Did our fine-tuning of a general-purpose model exceed one third of its original training compute? | We may be the provider of the modified model |
| None of the above, and we use it under our authority? | We are likely a deployer |
“Likely” and “may” matter here. Role depends on facts, and borderline cases need legal advice. The board’s job is to make sure the question is asked for every system and that the answer is owned.
What does this mean for enforcement exposure?
Getting role wrong is expensive because provider duties are extensive and cannot be assembled quickly. A business that discovers in 2027 that it is the provider of a high-risk system faces documentation, testing and oversight work it may not finish in time. Our article on EU AI Act fines and enforcement explains the penalty tiers and who enforces them. UK businesses are not exempt: the Act applies where an AI system is placed on the EU market or its output is used in the EU.
Where to start
Our briefing on the EU AI Act deadline and what boards must do before December 2027 sets out five actions for the board. The action that answers this question is the second, Classify it: place each system in a risk tier and record your role for it, whether provider, deployer, importer or distributor. The EU AI Act Board Checklist below takes management through it. AIPEX provides governance guidance and does not certify compliance.
Frequently asked questions
Can a deployer become a provider under the EU AI Act?
Yes. For high-risk systems, a deployer is treated as a provider if it puts its name on the system, substantially modifies it, or changes its intended purpose so that it becomes high-risk. Provider duties are far heavier. This is governance guidance, not legal advice.
Does fine-tuning a general-purpose AI model make us its provider?
Only in some cases. European Commission guidelines give an indicative test: if the modification uses more than one third of the original model's training compute, the modifier becomes provider of the modified model, with duties limited to the modification. Most business fine-tuning falls well below that.
How should a board track EU AI Act roles?
Add a role column to the AI inventory, recording for each system whether the business is provider, deployer, importer or distributor, and why. Review it when a system is modified or put to a new use. See Has Anyone Been Fined Under the EU AI Act? →
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.