The Article 25 role flip, and what generative systems add

The heaviest obligation set in the EU AI Act arrives at organisations that never decided to take it on. Article 25 is the mechanism, and generative systems are the environment in which it is triggered most often, usually by a product decision rather than a legal one.

Three ways a deployer becomes a provider

Under Article 25 a deployer becomes a provider, with the full provider obligation set, where it:

• puts its name or trade mark on the system, which is what white-labelling a bought assistant does;
• makes a substantial modification, for which meaningful fine-tuning is the common route;
• changes the intended purpose so that the system becomes high-risk.

Nobody sends a notification when this happens. It is discovered later, usually by someone assembling a technical file that does not exist. The provider obligation set includes the Article 17 quality management system, the Article 11 and Annex IV technical documentation, the Article 9 risk management process, Article 10 data governance, conformity assessment and registration. That is a programme, not a task.

The three triggers have different detection profiles. Branding is visible to marketing and invisible to compliance, so it must be caught at design review. Fine-tuning is visible to engineering, so the control is a release gate. Purpose change is visible to nobody, because it happens when someone points an existing tool at a new job.

Purpose change is the one to build a control for

A general-purpose assistant licensed for internal productivity is repointed to screen job applications. The tool did not change. The intended purpose did, into an Annex III employment use, and the organisation is now the provider of a high-risk system.

In insurance and banking the equivalents are worth naming in your policy: a general summariser used to assess claim validity; an analytics assistant producing output that informs creditworthiness; a document tool extracting health information that feeds life or health pricing, which is Annex III 5(c) territory. Each starts as a helpful idea in a team with no reason to know Article 25 exists. The control is an intake question that fires on use rather than on purchase, and an owner who can say no.

What generative systems add

Four things change in kind, not merely in degree.

The output is not the reasoning. A model that produces a recommendation and a paragraph of justification produced both by the same process. The paragraph reads as a reason and is not one. In regulated decisions this matters twice: it cannot be used as the explanation of the decision, and it should not be quoted in an adverse action notice.

Fluency and correctness are unrelated. Confident fabrication is intrinsic rather than a defect to be patched. Controls therefore sit at verification of the output rather than at suppression of the behaviour, which changes the shape of the oversight design: the reviewer needs the source document, not just the summary.

The disclosure duties are live now. Article 50 applied from 2 August 2026 and was not deferred by the Digital Omnibus. People must be informed they are interacting with an AI system unless it is obvious. Providers of systems generating synthetic audio, image, video or text must mark output in a machine-readable format, detectable as artificially generated. Deployers of emotion recognition or biometric categorisation must inform exposed persons. Deepfake disclosure applies, with a limited exception for evidently artistic, creative, satirical or fictional work, and disclosure applies to text published to inform the public on matters of public interest unless human review with named editorial responsibility applies. Information is given at the latest at first interaction or exposure, clearly and distinguishably.

Two traps there. A deployer cannot discharge the Article 50(4) deepfake disclosure duty by relying on the provider's machine-readable marking: the Commission's guidance requires a visible or audible label understandable without a detection tool. And the marking grace period for systems on the market before 2 August 2026 ends 2 December 2026.

The attack surface moves to the model. The OWASP Top 10 for LLM Applications 2026 is the working taxonomy. The control that most often fails is scope: a penetration test written for the application and excluding the model tests the part of the system that was already understood.

Where the deferral does and does not help

The Digital Omnibus, Regulation (EU) 2026/1744, in force 27 July 2026, deferred Annex III standalone high-risk obligations to 2 December 2027 and Annex I embedded systems to 2 August 2028. Prohibitions, GPAI obligations and Article 50 were not deferred; GPAI obligations have applied since 2 August 2025. Planning on the deferral alone is a mistake: the work that takes longest is data governance and documentation, and a system that becomes high-risk in December 2027 needs a dataset record reaching back to how it was built. The deferral moves the deadline, not the lead time.

Worked example: a broker white-labels an assistant

An insurance broker licenses a commercial assistant, rebrands it in the client portal under its own name, and configures it to answer questions about policy coverage using the client's documents.

The branding alone engages Article 25: the broker has put its own trade mark on the system and is a provider. That conclusion does not depend on how the system is configured or how good it is.

Separately, Article 50(1) requires the client to be told they are interacting with an AI system unless it is obvious, and the rebrand makes it less obvious rather than more. The broker adds a persistent disclosure at first interaction rather than a line in the terms of use.

The harder question is purpose. Answering coverage questions edges towards advice, and output used to assess a claim or inform pricing moves towards Annex III. The broker writes an explicit intended purpose, builds a refusal path, and monitors what clients actually ask, because the record of real use is the evidence of what the purpose became.

As of 24 September 2026.