When is a product manufacturer the provider of a high risk AI system?

What does Article 25(3) say in outline?

Article 25(3) addresses high risk AI systems that are safety components of products covered by Union harmonisation legislation listed in Section A of Annex I. In that situation, the product manufacturer is considered to be the provider of the high risk AI system, and is subject to the obligations of the provider under Article 16, where either the high risk AI system is placed on the market together with the product under the name or trademark of the product manufacturer, or the high risk AI system is put into service together with the product under the name or trademark of the product manufacturer. The provision also addresses the position where a third party places the system on the market or puts it into service, with further conditions set out in the Article that must be read in full. The effect is that a manufacturer cannot separate itself from the AI provider duties by pointing to a separate AI supplier, where the conditions are met and the product is placed under the manufacturer's brand. The manufacturer must therefore obtain the information, documentation and access needed to meet the provider duties, through the supply agreement and through cooperation with the AI supplier, before the product is placed on the market.

How does the manufacturer role differ from the AI provider role?

The product manufacturer role and the AI provider role are distinct legal roles, even when the same organisation performs both. The manufacturer role under the sector legislation covers the design, manufacture, conformity assessment and placing on the market of the product, with the sector essential requirements and procedures. The AI provider role under Article 16 covers the quality management system, technical documentation, conformity assessment, registration, post market monitoring, corrective action and cooperation duties for the high risk AI system. The evidence for the two roles overlaps but is not identical. A sector test report does not by itself show that the AI data governance, human oversight or logging requirements are met, and an AI documentation file does not by itself show that the sector essential requirements are met. The conformity file should therefore have two strands, sector and AI, with cross references showing where one piece of evidence serves both strands and where separate evidence is needed. The person responsible for regulatory compliance under the sector legislation and the person responsible for the AI provider duties may be the same person or different people, but the responsibilities should be named in writing in both cases.

For the broader regulatory framework, see products, machinery and vehicles overview.

What about own brand and white label products?

Own brand and white label arrangements raise the Article 25(1)(a) question as well as the Article 25(3) question. Article 25(1)(a) provides that a distributor, importer, deployer or other third party that puts its name or trademark on a high risk AI system already placed on the market or put into service is considered to be the provider, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated. For products, the equivalent question is who places the product and the AI system on the market under whose name. A retailer or distributor that rebrands a product, a manufacturer that supplies a product for sale under another brand, and an integrator that combines a product with an AI system under its own brand must each examine the branding, the placing on the market and the supply agreement together. A contract that allocates obligations between the parties does not by itself change the regulatory position vis a vis the authorities, although it can allocate costs and cooperation duties between the parties. The supply agreement should therefore address documentation, information, access, change notification, incident reporting and cooperation, with named contacts and response times, rather than relying on a general statement that the supplier will cooperate.

What cooperation duties apply when roles change?

Article 25(2) provides that where a third party becomes the provider under Article 25(1), the provider that initially placed the system on the market or put it into service is no longer considered to be the provider of that specific system, and must closely cooperate with the new provider and make available the necessary information and reasonably expected technical access and other assistance required for fulfilment of the obligations, in particular for conformity assessment. Regulation (EU) 2026/1744 specifies that cooperation to include, where relevant, making available technical documentation sufficient to assess compliance, informing the new provider about known limitations and failure modes, and providing targeted technical access including for testing and validation. An exception applies where the initial provider has clearly specified that its system is not to be changed into a high risk system. The cooperation duty is therefore a practical duty, not a formality. A new provider that does not receive the documentation, the limitations and the test access will not be able to complete a conformity assessment, and a change should not be released until that material has been received and reviewed. The cooperation record should show what was requested, what was provided, when, and what remains outstanding.

How should supply agreements address the AI provider role?

Supply agreements for products with AI functions should address the intended purpose, the AI functions supplied, the data supplied or used, the documentation to be provided, the change notification duties, the incident reporting duties, the cooperation duties on modification or repurposing, the branding and placing on the market arrangements, the conformity assessment support, and the arrangements on termination or change of supplier. The agreement should state who is the provider for AI Act purposes for each system, who is the manufacturer for sector purposes, and who holds the conformity file. It should set out the information that must be shared before placing on the market, the testing that must be performed, and the action to be taken if a safety or compliance issue is found. It should also address updates: who can update the AI function, what testing is required, who approves the update, and how users are informed. An agreement that only addresses price, delivery and intellectual property will not support the regulatory duties, and a regulatory failure cannot be cured by a contractual claim after the product has been placed on the market. The agreement should be reviewed by a legal adviser with the regulatory file in hand.

Continue with Annex I Section A and Section B.

What does this guide not decide?

This guide does not decide whether a named manufacturer, distributor, importer or integrator is the provider for a specific product, and it does not reproduce Article 25 in full. The Article 25 provisions, the sector manufacturer definitions and the supply agreement must all be read together for the specific product and supply chain. For Section B products, the sector integration route must also be checked, because Article 25(3) is framed for Section A products. A manufacturer or integrator with a specific supply chain should confirm the role allocation, the cooperation duties and the conformity route with a competent authority or legal adviser before the product is placed on the market. Role allocation is a legal conclusion that needs the full facts, not a general statement from a guide.

Frequently asked questions

Continue through this AI Act cluster

• products, machinery and vehicles overview
• Annex I Section A and Section B
• substantial modification of products
• product conformity timelines
• providers
• deployers