{"id":5116,"date":"2026-09-01T09:00:00","date_gmt":"2026-09-01T07:00:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=5116"},"modified":"2026-10-20T18:48:49","modified_gmt":"2026-10-20T16:48:49","slug":"when-does-an-organization-become-an-ai-provider","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/when-does-an-organization-become-an-ai-provider\/","title":{"rendered":"When does an organisation using AI become the provider of a system?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for the board and management \u2022 published September 1, 2026 \u2022 updated October 20, 2026 \u2022 9 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

An organisation is a provider from the outset when it develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark (Article 3(3)). This also applies to a tool built on another company\u2019s model and used only internally. Such a provider already has obligations under Article 4, and for systems that interact directly with people or generate synthetic content also under Article 50(1) and (2).<\/p>\n\n\n\n

An organisation also takes over the role of provider of a high-risk AI system in three circumstances set out in Article 25(1). It puts its own name or trademark on such a system, makes a substantial modification to it, or changes the intended purpose of a system so that it becomes a high-risk AI system. Where it puts its own name or trademark on the system, a contract may allocate the obligations differently. The change of role follows from the law and needs no board decision. The obligations of a provider of a high-risk AI system start to apply on 2 December 2027 (Annex III) or 2 August 2028 (Annex I). The original provider has a duty to cooperate under Article 25(2) unless it has clearly specified that its system is not to be changed into a high-risk AI system. The scope of documentation needed to perform the provider obligations is therefore worth agreeing in the contracts signed today.<\/p>\n<\/div>\n\n\n\n

Why the question comes up at all<\/h2>\n\n\n\n

Artificial intelligence rarely enters an organisation by a board decision. It arrives as a new feature in software bought years earlier, or as a tool built in-house on a general-purpose model. In neither case does anyone ask about the role, because nobody feels they are placing anything on the market or putting anything into service.<\/p>\n\n\n\n

The Regulation does not ask whether an organisation is in the AI business. It asks about the role towards a specific system. The same organisation can be a deployer of one tool and a provider of another.<\/p>\n\n\n\n

\n\n

Remember<\/p>\n\n\n\n

The role is a property of the relationship with the system, not of the company.<\/p>\n\n<\/div>\n\n\n\n

On top of that sits the confusion around the July 2026 change to the timetable. The postponement covered Chapter III Sections 1, 2 and 3, with the exception of Article 6(5) on the Commission\u2019s classification guidelines. Those are classification, requirements, and the obligations of providers and deployers of high-risk systems. It did not cover the prohibited practices or the AI literacy duty. The transparency obligations in Article 50 have applied since 2 August 2026. The same amendment did, however, give providers of systems generating synthetic content that were placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2) (Article 111(4)). The market took one sentence from this \u2014 \u201cthe AI Act has been postponed\u201d \u2014 and stopped counting deadlines.<\/p>\n\n\n\n

What to establish before deciding<\/h2>\n\n\n\n

When an organisation is a provider from the outset<\/h3>\n\n\n\n

The definition of a provider in Article 3(3) does not require the system to be sold or made available externally. Putting into service includes supplying a system for own use (Article 3(11)). A model supplied by another company does not take the provider role away from the organisation (Article 3(68)). In its guidelines on Article 50 the European Commission gives the example of an organisation that has developed a chatbot in-house and puts it into service for its own use under its own name (paragraph 11). According to the Commission, such an organisation is a provider. The risk category does not matter for this role.<\/p>\n\n\n\n

The obligation in Article 4 has bound the provider since 2 February 2025. From 2 August 2026 the provider ensures that a system intended to interact directly with people is designed and developed so that they are informed that they are interacting with an AI system (Article 50(1)). Among other exceptions, the obligation in Article 50(1) does not apply where the interaction with AI is obvious to a reasonably well-informed, observant and circumspect person. Obviousness is assessed taking into account the circumstances and the context of use. The provider of a system generating synthetic text, images, audio or video ensures that the outputs are marked in a machine-readable format (Article 50(2)). The exceptions in Article 50(2) include an assistive function for standard editing. Providers of such systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking obligation (Article 111(4)). The provision mentions only systems placed on the market. In its guidelines on Article 50 the European Commission describes that period as also covering systems put into service before 2 August 2026 (paragraph 153).<\/p>\n\n\n\n

Three circumstances in which the role changes<\/h3>\n\n\n\n

Article 25(1) names the distributor, the importer, the deployer and any other third party. Each of them is considered a provider of a high-risk AI system if any of three circumstances arises.<\/p>\n\n\n\n

Own name or trademark.<\/strong> The organisation puts its brand on a high-risk system already placed on the market or put into service. The provision attaches a qualifier to this circumstance. This applies without prejudice to contractual arrangements allocating obligations differently.<\/p>\n\n\n\n

Substantial modification.<\/strong> The organisation makes a substantial modification to a high-risk system already placed on the market or put into service. After the modification it remains a high-risk system under Article 6. The point is therefore a change within the same category, not an exit from it.<\/p>\n\n\n\n

Change of intended purpose.<\/strong> The organisation changes the intended purpose of a system that was not classified as high-risk and has already been placed on the market or put into service. After the change it becomes a high-risk system under Article 6. The provision names general-purpose AI systems explicitly.<\/p>\n\n\n\n

The third circumstance is the hardest to notice. The HR department starts using a purchased general-purpose assistant to evaluate job candidates (Annex III, point 4(a)). The system has not changed. Its intended purpose has, and with it the role of the organisation. It is different when a team has built the assistant itself on another company\u2019s model. The organisation is then its provider from the outset (Article 3(3)). The new purpose changes the category of the system, not the organisation\u2019s role.<\/p>\n\n\n\n

Article 25(3) contains a separate rule for the manufacturer of a product covered by the Union harmonisation legislation listed in Section A of Annex I. The manufacturer is considered the provider of a high-risk AI system that is a safety component of its product. This happens when the system is placed on the market together with the product or put into service after the product has been placed on the market, in both cases under the manufacturer\u2019s name or trademark.<\/p>\n\n\n\n

What the original provider owes the new one<\/h3>\n\n\n\n

Article 25(2) sets out what happens to the original provider. After the change of role the original provider is no longer considered the provider of that particular system. In exchange it has a duty of close cooperation with the new provider.<\/p>\n\n\n\n

The provision names, by way of example, three elements of that cooperation where they are relevant to its purposes.<\/p>\n\n\n\n