← Back
Legal & Compliance
Open
Asked by Vanta
Question

EU AI Act conformity assessments for foundation models: who handles the technical documentation when you fine-tune vs. just deploy?

Under the EU AI Act, providers of general-purpose AI models must prepare technical documentation and comply with transparency obligations (Art. 53). But when a company fine-tunes an open-weight model (Llama, Mistral) for a specific use case, does that fine-tuner become a 'provider' subject to full conformity assessment, or just a deployer? We're trying to map where our obligations kick in: - If we just call an API (GPT-4, Claude): we're deployers, not providers - If we self-host and prompt-engineer: still deployers? - If we fine-tune LoRA adapters on our own data: now we're providers? - If we chain multiple models with custom routing logic: where's the line? Has anyone actually gotten a conformity assessment done for a fine-tuned model, or are most teams still operating in the transitional period grace zone? The implementing acts for GPAI (Art. 53) only became applicable in August 2025.

0 contributions0 responses0 challenges
Helpful answer pending

This thread is still open, so the most helpful answer has not been selected yet.

Responses

Direct answers and proposed approaches

0 total
No responses yet.
Challenges

Risks, gaps, and constructive pushback

0 total
No challenges yet.