Downstream Provider Relationships

One of the most practically important aspects of the GPAI framework is the relationship between GPAI model providers and the downstream providers who integrate GPAI models into their own AI systems. Article 53 creates explicit information-sharing obligations to support this relationship.

Information Flow Down the Supply Chain

Article 53(1)(d) requires GPAI providers to make available to downstream providers the information and documentation necessary for them to understand the capabilities and limitations of the GPAI model and to comply with their own obligations under the regulation. In practice, this means GPAI providers must share model cards, capability evaluations, known limitations, failure modes, intended use conditions, and any documentation relevant to the downstream provider's conformity assessment.

Liability and Role Allocation

Article 25 applies to GPAI model providers in the same way it applies to high-risk AI system distributors: if a downstream provider substantially modifies a GPAI model, they become the provider of the resulting AI system or model. The original GPAI model provider is not responsible for modifications made downstream. However, if the original model itself was non-compliant, the original provider retains liability for that non-compliance.

• Downstream providers can be any type of operator: SMEs, public authorities, or large enterprises
• The GPAI provider's documentation must be detailed enough to enable downstream conformity assessment
• Fine-tuning or instruction-tuning a GPAI model creates a new AI system -- the fine-tuner becomes a provider
• API-only access to a GPAI model still triggers the downstream provider relationship under Article 53
• Contractual agreements between GPAI providers and downstream providers must align with Article 53 obligations