EU AI Act Art.25: Responsibilities along the AI value chain
Article 25 of the EU AI Act binds the operator (see the article). It requires Distributors/importers/deployers/other third parties become providers when they place on the market or put into service under their own name or. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.25 |
| Binds | Operator (see the article) |
| Group | High-Risk Operator Obligations |
| Evidence items | 2 |
| Linked NIST AI RMF controls | 3 |
| Linked ISO/IEC 42001 controls | 3 |
| Last updated |
Who does Art.25 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.25 require?
Distributors/importers/deployers/other third parties become providers when they place on the market or put into service under their own name or trademark, substantially modify the system, or modify the intended purpose making it high-risk. The original provider shall cooperate with the new provider, providing access to information, technical access and other assistance reasonably needed.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.25 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.25?
| Category | Evidence to keep |
|---|---|
| Value chain | Documented allocation of provider status across the value chain |
| Value chain | Cooperation agreements between original and new providers |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.25?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-6.1 | Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third party's intellectual property or other rights Written arrangements governing information, technical access and assistance from value-chain third parties. | high |
AIRMF-MP-4.1 | Approaches for mapping AI technology and legal risks of its components, including the use of third-party data or software, are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights Value-chain provisions map the legal position of third-party components and who carries provider duties. | high |
AIRMF-MP-4.2 | Internal risk controls for components of the AI system including third-party AI technologies are identified and documented The written agreement specifying capabilities and technical access is the internal control over the component. | high |
Which ISO/IEC 42001 controls line up with Art.25?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.10.2 | Allocating responsibilities Allocates provider, deployer, importer and distributor responsibilities across the AI value chain. | high |
A.10.3 | Suppliers Original provider must supply information and technical assistance to downstream parties. | medium |
A.9.4 | Intended use of the AI system Changing the intended purpose makes the modifying party a provider. | medium |
What does the conformance kit add for Art.25?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.