If your company fine-tunes an open model with its own data, this is for you. More and more companies are making the leap from using AI to tuning it: they take an open model —Llama, Mistral or another— and fine-tune it with their own data so it speaks their language, knows their catalogue or follows their tone. It's a reasonable technical move, and an increasingly accessible one. What almost nobody tells them is that this move has a regulatory reading: under the AI Act, the distance between using a model and modifying it can be the distance between being a deployer and being a provider. And the obligations of one and the other don't look anything alike.
The ladder: using, modifying, rebranding
The AI Act allocates obligations according to the role you play in the chain. Simplifying, there are three rungs:
Using. You license or download a model and use it as it is, even with your own prompts and integrations. For the system you use under your own authority, you're a deployer. The obligations of providers of general-purpose AI (GPAI) models — Articles 53 to 55 — aren't yours, and the information and documentation under Article 53(1)(b) is owed to providers of AI systems who integrate the model, not to deployers; what reaches you, as any deployer, is the AI literacy duty in Article 4, the prohibitions in Article 5 and whatever the specific use triggers. One nuance that's easy to miss: if you develop an AI system on top of that model and put it into service under your own name or trademark, even for your own use, you're also the provider of that system — not of the model — (Article 3, points 3 and 11).
Modifying. You retrain or fine-tune the model with your data. This is where this article's question opens up: at what point is the modification substantial enough that you become answerable as the provider of what you've created?
Rebranding. You put your name or trademark on a high-risk system already placed on the market or put into service — without prejudice to contractual arrangements allocating the obligations otherwise —, you substantially modify a high-risk system so that it remains high-risk, or you change the intended purpose of a system that wasn't high-risk — including a general-purpose AI system — so that it becomes so. In these three scenarios Article 25(1) is clear: you are considered the provider of the high-risk system, subject to the provider obligations in Article 16. Putting your brand on a minimal-risk system doesn't make you a provider by this route; your status is then assessed under the definition in Article 3, point 3.
The figure walks through the three circumstances in Article 25(1), in order, all confined to high risk: putting your name or trademark on a high-risk system already placed on the market or put into service, substantially modifying it so that it remains high-risk, or changing the intended purpose of a system — including a general-purpose one — that was not high-risk so that it becomes so. If the system is not high-risk and the change does not make it so, none of them applies, and provider status is assessed under the definition in Article 3, point 3. The figure does not show the compute threshold for general-purpose AI models, which is a separate test.
The threshold the Commission set
For the GPAI case, the European Commission's guidelines on the obligations of general-purpose AI model providers gave that line a quantitative criterion, which they themselves call indicative, that the text of the Regulation didn't spell out: a modifier becomes a provider when the compute used in the modification exceeds one third of the training compute of the original model.
Two nuances make the criterion workable in practice:
- If you don't know the original's compute —the usual case with open models—, the guidelines offer fallback reference values by model type, so the assessment doesn't depend on a figure the original provider may never have published.
- The obligations are limited to your modification. If you cross the threshold, you don't inherit responsibility for the whole original model: you answer as the provider of the part you created. It's a proportionate split, and it's worth citing it that way.
If the compute of your fine-tuning stays below that third, the practical reading is reassuring: on that criterion, fine-tuning the model doesn't make you the provider of the general-purpose AI model. But it's a conclusion you need to be able to support with the estimate for your own case, not one you can assume.
The two duties that are never waived
If you work on open models, it's worth knowing another piece — and this one isn't in the guidelines but in the Regulation itself: Article 53(2) lifts the two documentation obligations in Article 53(1) — the technical documentation for the AI Office and the national competent authorities, point (a), and the information for providers who integrate the model into their systems, point (b) — for providers of models released under a free and open-source licence that allows for the access, usage, modification and distribution of the model, and whose parameters, including the weights, the information on the model architecture and the information on model usage, are made publicly available. The exception doesn't apply to general-purpose AI models with systemic risk, and there are two provider obligations that are never waived, under any circumstance: the policy to comply with Union law on copyright and related rights, point (c), and the public summary of the content used for training, point (d). If your modification did turn you into a provider, "it's open source" wouldn't get you out of those two.
And there's a complementary warning: fine-tuning and continuous learning by the deployer can also trigger the change of role on the high-risk side, where the test isn't a compute threshold but Article 25(1): substantially modifying a high-risk system so that it remains high-risk, or changing the intended purpose of a system — including a general-purpose one — so that it becomes high-risk. The GPAI line and the high-risk line are two different tests; both are worth passing.
What to document if you're fine-tuning models
The operational takeaway fits into three lines of a file:
- Record the modification: which base model, which data, which technique, and a reasonable estimate of the compute used against the threshold. You don't need laboratory precision; you need documented judgement.
- Record the purpose: what it's being fine-tuned for, and what it isn't. This is what supports the case that there's no change of purpose towards high risk.
- Anchor the conclusion: "one-third compute criterion assessed; well below the threshold; deployer role unchanged; review if the technique or the scale changes". A sentence like that, dated and signed, is the difference between a defensible position and an assumption.
It's the same principle that runs through the whole Regulation, as we already noted when talking about the role of whoever coordinates AI governance at an SME: the AI Act's questions almost never demand heroic answers — they demand documented ones. And to answer them, you first need to know which models and systems the house actually has: the inventory, once again, is the foundation.
This article is for informational purposes only and does not constitute legal advice.