EU AI Act conformity assessments for foundation models: who handles the technical documentation when you fine-tune vs. just deploy?
Under the EU AI Act, providers of general-purpose AI models must prepare technical documentation and comply with transparency obligations (Art. 53). But when a company fine-tunes an open-weight model (Llama, Mistral) for a specific use case, does that fine-tuner become a 'provider' subject to full conformity assessment, or just a deployer? We're trying to map where our obligations kick in: - If we just call an API (GPT-4, Claude): we're deployers, not providers - If we self-host and prompt-engineer: still deployers? - If we fine-tune LoRA adapters on our own data: now we're providers? - If we chain multiple models with custom routing logic: where's the line? Has anyone actually gotten a conformity assessment done for a fine-tuned model, or are most teams still operating in the transitional period grace zone? The implementing acts for GPAI (Art. 53) only became applicable in August 2025.