How to Check Article 25 Provider-Status Shifts (2026)

Before you procure a system that may be high-risk, mark a rebrand, a substantial modification, or a change of purpose, then list the documents, limits, test access, logs, and incident help the contract delivers. A role label is not that list.

Name the system, the version if one is printed, and the intended purpose before you read the role label. The label is what the pack offers first, and it is the wrong start.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

What do you name, and which application date does the timeline give?

Before the role label, write the system, any printed version, and the intended purpose. Record whether the use is on the Union market, in service in the Union, or use of the output in the Union. If the pack is silent, mark scope open. Write the timeline’s date, not the date in Slack.

Under Article 3, a provider develops a system or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses it under its authority, except personal non-professional use. Intended purpose is the use named in the instructions.

Cadi at Taff Claims Desk Ltd, a fourteen-person firm in Cardiff, holds Northline’s draft for Lumen Rank on motor-claim files. Reviewers sit in Ireland. No version is printed. Whether Lumen Rank is high-risk stays open. Slack on 9 October 2026 treats 2 August 2026 as the high-risk start, before signature on Friday 16 October. The Service Desk timeline gives 2 August 2026 to Article 50 transparency and enforcement of rules already applicable. The Commission notice of 27 July 2026 sets Annex III for 2 December 2027 and Annex I for 2 August 2028.

Can a sole-liability sentence transfer provider status?

A contract may allocate tasks. A role label cannot stop Article 25 from treating the party that puts its name or trademark on a high-risk system as the provider. Read clause 11 as an allocation, then test the schedules.

Clause 11 says the vendor is the sole provider and the sole party liable under Regulation (EU) 2024/1689, the customer is a deployer only, and the system is “AI Act compliant”. A typical mistake is to treat that as a transfer of status. Article 25(1)(a) says the shift is without prejudice to a contract that allocates the obligations otherwise. Regulation (EU) 2026/1744 has applied since 27 July 2026. If a trigger is yes and the system is high-risk, Article 16 names duties you would owe. Do not draft them here.

Which of the three status triggers is yes, no, or unknown?

Mark name or trademark, substantial modification, and change of purpose as yes, no, or unknown. A yes, if the system is high-risk, puts the buyer under Article 16 even where clause 11 says otherwise.

Article 25(1)(a) is the name or trademark. Article 25(1)(b) is a substantial modification that leaves the system high-risk under Article 6. Article 25(1)(c) changes the intended purpose, including of a general-purpose AI system, so it becomes high-risk. Article 3(23) is an unplanned change that affects Chapter III, Section 2, or the assessed purpose.

Schedule 2 puts Taff’s name and mark on the portal: mark yes. In practice the white-label is the trigger, not a marketing note. For example, it stays yes beside the clause 11 deployer label. Schedule 4 allows a fine-tune on claim notes with no pre-determined list. Article 13(3)(c) is where those changes belong. Mark the modification unknown. A mismatch between who is scored and the vendor’s purpose is an Article 25(1)(c) question, not branding.

Who must deliver written assistance, and what must that writing name?

If a trigger is yes or unknown, Article 25(2) must name technical documentation sufficient to assess Article 16, known limitations and failure modes, and targeted test access. The warranty names none of them. Mark assistance absent.

The initial provider must still cooperate unless it clearly said the system is not to become high-risk. Clause 11 is not that sentence. Article 25(4) is the written agreement with the upstream supplier of the AI system, model, tool, service, component, or process. A deployer still needs Article 13 instructions. Open-source tools are excluded, except a general-purpose AI model.

The 5 March 2025 public-buyer clauses pre-date the July 2026 list. A 3 July 2025 checklist rejects the one-line warranty. Prefer the Service Desk text.

Where do logs, oversight, incident notice, and exit sit?

Give logs, human-oversight instructions, incident notice, and exit their own rows. Vendor-held logs and “promptly” do not meet those rows.

Article 13 must cover purpose, limits, human-oversight measures, and how the deployer reads logs. Those pages are missing, so oversight is absent. Article 26(6) requires logs under the deployer’s control for at least six months, unless data-protection law or other law says otherwise. “Retained by Vendor” fails that row.

Under Article 26(5), inform the provider first, immediately, then the importer or distributor and the market-surveillance authorities. Article 73 sets 15 days, two days for a widespread infringement or Article 3(49)(b), and 10 days where a person has died. Promptly is none of those, so notice is partial. Exit says nothing about exporting logs and instructions. Mark exit absent.

How do you mark the pack present, partial, or absent?

This first-pass — a gap mark on one order form, not a sign-off — labels each row present, partial, or absent. Rewrite absent and partial rows, or walk.

The order is name the system, test the three triggers, demand written assistance, mark the deployer rows, then rewrite or walk. Do not sign because 2 August 2026 has passed. On this timeline, Annex III applies from 2 December 2027. A version pin, training rights, and output ownership are separate checks: a version-pin review, a training-rights review, and an output-ownership review.