Determine whether a modification to a third-party model changes value-chain status
Draft
Determine whether a modification to a third-party model changes value-chain status
Layer 4. Control REGCompliance and regulatory
Allocation
| L4-REG-02 | |
|---|---|
| Decides | General Counsel |
| Consulted | DPO, Model Owner and Vendor Lead |
| Executes | Compliance |
| Evidence | Status determination describing the modification and the resulting obligation set |
In plain terms
Decide whether fine-tuning or repurposing has moved the organization from deployer to provider, and what obligations follow.
What is being judged
Whether the modification is substantial enough to change the role. Under EU AI Act Article 25, an organization that substantially modifies a high-risk system, or puts its own name on one, or changes its intended purpose, can acquire provider obligations it did not have.
The judgment is legal rather than technical, and the inputs are technical. The Model Owner describes what was actually done to the model; General Counsel decides what it means.
The trigger is the important part. A determination nobody requests never happens, which is why this decision is wired as a mandatory consultation on L3-01, the model release to validation, wherever the model derives from a third-party base. That places the trigger on a technical act that always occurs rather than on someone remembering a legal question exists.
What this decision does not cover
It does not determine applicability generally, which is L4-REG-01, though a status change usually forces that determination to run again.
When it fires
On event. On L3-01 release to validation where the model derives from a third-party base. On a change of intended purpose for a third-party model. On white-labelling or placing the organization’s name on a system.
On cycle. None.
What you need before deciding
What the base model was and what was done to it: fine-tuning, retrieval augmentation, prompt scaffolding, distillation. Whether intended purpose changed. What the vendor contract says about modification and provenance. The current applicability determination.
How this goes wrong
The silent flip: a team fine-tunes a purchased model, the technical work is unremarkable and the status change is never assessed. This is the failure the trigger exists to prevent. Technical judgment on a legal question: an engineer concluding the modification is minor. Contract assumed to settle it: a vendor agreement stating the organization remains a deployer, which does not bind a regulator.
Related decisions
Triggered by L3-01.
Upstream L2-02 third-party admission, L4-VEN-01 licensing.
Downstream L4-REG-01 re-determination, L4-POL-03 obligations.
Instrument references
EU AI Act Article 25 creates the obligation and names no owner for detecting it. Crosswalk gap 3.
Correction
The maintainer answers corrections. There is no service level. Responses are best-effort and opportunistic within a reasonable time: a correction raised on a Monday is answered that week or sooner.