Why does it only ask about the trademark for some systems?

Because Article 25(1)(a) only applies to a high-risk system. On a system that is not high-risk, putting your trademark on it does not change your role.

Do I also have to log a minor change?

It is worth logging even if it is not substantial: it keeps the system traceable. Substantial changes and point (c) changes automatically flag that reclassification is needed; under point (a), the log warns of the provider's obligations under Article 16, and your organisation decides whether to re-run the classification.

Does the platform decide whether I become a provider?

No. It flags the circumstance, records it in the audit log with its point and marks it in the table. What your organisation decides goes into the decision log (GOB-4).

When does Article 25 apply from?

Article 25 applies from 2 December 2027 for the high-risk systems of Annex III and from 2 August 2028 for those of Annex I; it does not reach the products of Annex I, Section B (Article 113, third paragraph, point (c), and Article 2(2), as worded by Regulation (EU) 2026/1744).

What if the change is fine-tuning a general-purpose model?

GOB-5 includes a calculation aid with the indicative criterion from the Commission Guidelines on general-purpose models. It is a separate regime from Article 25, does not change the detector and does not store the data. Checking it is internal due diligence.

All features

Decide and assign

Change management for AI systems

A system changes version, data or purpose, and its obligations can change with it without anyone writing it down.

14-day free trial See the demo

What it is for

Log of changes to any AI system in the inventory and Article 25(1) assessment: it warns when a change would make your organisation the provider of a high-risk system.

GOB-5 answers two questions that are not the same. The first, whether the change is substantial, applies to any system in the inventory and is an Alethexis criterion, not a legal definition. The second, whether the change triggers any of the three circumstances in Article 25(1) of Regulation (EU) 2024/1689, all of which are limited to high risk.

Putting your trademark on a minimal-risk system does not make you a provider by way of Article 25.

How it works

Log the change

The system affected, the type of change (purpose, input data, deployment context, model update or change of provider), a description and the effective date. The Owner, AI Officer, DPO and Contributor can log changes.

Is it a substantial change?

Three questions: whether the intended purpose changes, whether the input data change substantially and whether performance or safety is affected. With two or more positive answers, the change is substantial and goes for approval.

Does it trigger Article 25(1)?

The questions depend on the system's current classification in VIS-2. If it is high-risk today, you are asked whether you put it under your name or trademark (point (a)), and a change that the Alethexis criterion treats as substantial is flagged as a possible point (b) case, for you to assess. If it is not, you are only asked whether the change of purpose makes it high-risk (point (c)).

You can override the result

If the detector's result does not fit your case, you can adjust it, but the platform asks you to record the reason in the notes. That way there is a trace of why it departed from the automatic criterion.

Decision and knock-on review

The Owner or the AI Officer records the approval or the rejection, and the act is kept in the approval history. If the change is substantial or falls under point (c), recording its approval moves the system's classification and VIS-2 to “Review needed”, as well as the system's FRIA and DPIA if it has them.

Basis

The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.

LCLegal obligation with a confirmed future date

LCLegal obligation with a confirmed future dateM3-HRA-008

Reclassification after a substantial modification (Article 25)

Article 25(1) makes the deployer a provider in three cases, all involving high risk: if it puts its name or trademark on a high-risk system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated; if it makes a substantial modification to it in such a way that it remains high-risk; or if it modifies the intended purpose of a system that was not high-risk in such a way that it becomes high-risk. If any of them applies, the system's classification should be re-run (an Alethexis methodological step) and the organisation should assess whether it becomes subject to the provider's obligations under Article 16. The obligations of Article 16 apply from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I ones; they do not reach the products in Annex I, Section B (Article 113, third paragraph, point (c), and Article 2(2), as amended by Regulation (EU) 2026/1744).

Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.

Available in

M2Governance
M3High-Risk Ready

Modules build on each other: M2 includes everything in M1, and M3 includes M1 and M2.

FAQ

Why does it only ask about the trademark for some systems?: Because Article 25(1)(a) only applies to a high-risk system. On a system that is not high-risk, putting your trademark on it does not change your role.
Do I also have to log a minor change?: It is worth logging even if it is not substantial: it keeps the system traceable. Substantial changes and point (c) changes automatically flag that reclassification is needed; under point (a), the log warns of the provider's obligations under Article 16, and your organisation decides whether to re-run the classification.
Does the platform decide whether I become a provider?: No. It flags the circumstance, records it in the audit log with its point and marks it in the table. What your organisation decides goes into the decision log (GOB-4).
When does Article 25 apply from?: Article 25 applies from 2 December 2027 for the high-risk systems of Annex III and from 2 August 2028 for those of Annex I; it does not reach the products of Annex I, Section B (Article 113, third paragraph, point (c), and Article 2(2), as worded by Regulation (EU) 2026/1744).
What if the change is fine-tuning a general-purpose model?: GOB-5 includes a calculation aid with the indicative criterion from the Commission Guidelines on general-purpose models. It is a separate regime from Article 25, does not change the detector and does not store the data. Checking it is internal due diligence.

Try it with your own systems