Developing AI Products: Obligations for Providers

Home › AI law › AI providers

Anyone who develops AI systems and offers them under their own name bears the main responsibility under the AI Act. This applies to start-ups with their own model, to software houses integrating a language model via API, and to machinery manufacturers with AI-based controls. We advise providers from product idea to market surveillance.

When are you a provider under the AI Act?

A provider develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trade mark, whether for payment or free of charge (Art. 3(3)). Building your own product on a third-party model accessed via an interface also makes you the provider of that system. The model provider remains responsible for the model.

Fine-tuning: does it make you a provider?

Two levels must be distinguished. At the level of the AI system, you become the provider of a high-risk system if you market a third-party system under your own name, substantially modify it or change its intended purpose so that it becomes high-risk (Art. 25(1)). The original provider must then supply information and technical access.

At the level of the GPAI model, the Commission’s guidelines of July 2025 state that modifying or retraining a model only makes you a model provider if the change is significant. As an indicator, the Commission names compute of more than one third of the original training compute. The obligations are then limited to the modification. Ordinary fine-tuning on company data or RAG connections rarely reach this threshold.

Classification and conformity assessment

First comes classification: prohibited, high-risk, subject to transparency obligations or other. An Annex III system is exceptionally not high-risk if it only performs a narrow procedural task or merely prepares a human decision (Art. 6(3)). You must document this assessment and still register the system.

For most Annex III high-risk systems, internal control under Annex VI is sufficient. A notified body is mainly required for biometric systems without harmonised standards. AI in Annex I products, such as medical devices or machinery, goes through the conformity assessment of the relevant product legislation, supplemented by the AI requirements.

Technical documentation and quality management

The technical documentation under Annex IV describes purpose, architecture, training data, tests, performance metrics, known limitations and human oversight measures. It must exist before placing on the market and be kept for ten years. A quality management system (Art. 17), logging, instructions for deployers, EU declaration of conformity, CE marking and registration are added.

Under the Digital Omnibus, SMEs and small mid-caps can use a simplified Commission form for the documentation, and quality management may be proportionate to their size. The high-risk obligations apply from 2 December 2027 for Annex III and from 2 August 2028 for Annex I.

Post-market monitoring and incident reporting

After placing on the market, providers must systematically monitor the performance and risks of their system (Art. 72). Serious incidents must be reported to the market surveillance authority within 2, 10 or 15 days depending on severity (Art. 73); in Germany this is usually the Federal Network Agency (Bundesnetzagentur). In case of non-conformity, corrective action up to recall is required.

Transparency for all generative systems

Even without a high-risk link, chatbots must disclose that they are AI, and synthetic audio, image, video and text output must be marked in machine-readable form (Art. 50(1) and (2)). For systems on the market before 2 August 2026, the transition period for marking ends on 2 December 2026.

Contracts with model and component suppliers

If you build on third-party models, you need documentation, information on training data and limitations, and support with conformity assessment and incidents from your supplier. The Omnibus extended the duties of cooperation in the supply chain in Art. 25. The standard terms of large providers often do not cover this. We negotiate supplementary agreements and draft your customer contracts so that responsibility and liability match your role.

Liability of AI providers

The new German Product Liability Act applies from 9 December 2026. Software and AI systems will expressly be products; providers are strictly liable for personal injury, property damage and loss of data of consumers. A breach of AI Act safety requirements can indicate a defect. Missing security updates also give rise to liability as long as the manufacturer retains control over the product.

FAQs

Are we a provider if we only use GPT or Claude via API?

Yes, for your own AI system. The model provider remains responsible for the underlying model. Your obligations depend on the risk class of your system.

Do we always need a notified body for high-risk AI?

No. Internal control is sufficient for most Annex III systems. For AI in Annex I products, the relevant product legislation applies.

Does the AI Act apply to open-source models?

There are exemptions for free and open-source AI, but not for high-risk systems, prohibited practices, transparency obligations and GPAI models with systemic risk.

Related topics

• AI Act
• Software, SaaS and cloud contracts
• AI contracts (in German)
• AI liability (in German)
• Cyber Resilience Act (in German)