A deployer becomes the provider of a high-risk AI agent under the EU AI Act if it puts its own name on it, substantially modifies it, or changes the purpose of an agent so that it becomes high-risk. Rewriting an agent's decision criteria or turning a general assistant to credit decisions are the likeliest routes; change control should catch both.
What does the EU AI Act say about substantial modification?
The EU AI Act (Regulation (EU) 2024/1689) defines a substantial modification, in substance, as a change to an AI system after it has been placed on the market or put into service that the provider did not foresee or plan in its initial conformity assessment, and that either affects the system's compliance with the high-risk requirements or changes the intended purpose for which it was assessed.
The Act then says that a distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system, with all of the provider's obligations, if it:
- puts its name or trademark on a high-risk system already on the market or in service;
- makes a substantial modification to a high-risk system in a way that it remains high-risk; or
- changes the intended purpose of an AI system, including a general-purpose one, that was not high-risk, so that it becomes high-risk.
When that happens, the original provider is no longer the provider of that specific system, but must cooperate and supply the information the new provider needs, unless it clearly specified that its system should not be turned into a high-risk one. Changes that the provider planned for in advance, and assessed at the outset, are not substantial modifications.
For the basic split between the roles, see provider or deployer: your role under the EU AI Act.
Who does it apply to?
Any firm that uses, distributes or resells an AI system in the EU and changes it. For agents, the firms most exposed are deployers that buy an agent or agent platform and then customise it heavily, especially in uses listed as high-risk in Annex III, such as creditworthiness assessment of individuals and pricing of life and health insurance.
Which agent changes can make you the provider?
Agents are built to be customised, which makes this risk sharper than for most AI systems. Sort changes into three groups.
Likely to change the intended purpose. Taking a general customer service agent and giving it the job of assessing whether applicants can repay a loan. Or extending an agent that answers insurance questions so that it sets premiums for life cover. The original system was not high-risk; your change makes it high-risk, and you become its provider.
Possibly a substantial modification. For an agent that is already high-risk, rewriting the criteria in its brief that drive decisions; connecting tools that let it take decisions it was designed only to draft; replacing the underlying model with one the provider did not plan for. Each can affect compliance with requirements such as accuracy, human oversight or risk management, which the provider assessed on a different design.
Usually within the provider's plan. Configuration the provider documents as permitted in its instructions for use: setting limits within stated ranges, choosing which of your own documents the agent reads, tightening rather than loosening what it may do, switching between model versions the provider has approved.
The line depends on what the provider foresaw. That is why the provider's instructions for use, which Article 13 requires for high-risk systems, matter so much to a deployer: they define the space in which you can change things without taking on the provider's role.
How do you manage the risk?
Take an illustrative case. A consumer lender buys an agent platform for customer service. A product team proposes letting the agent pre-approve personal loan applications. The change board flags it: creditworthiness assessment of individuals is listed in Annex III, so this would change the agent's purpose into a high-risk one. The lender has two options. Keep the agent drafting information for underwriters, who decide, and record why that keeps it outside the high-risk use. Or accept the provider role and its obligations: risk management, data governance, technical documentation, logging, oversight design, accuracy testing, a quality management system and conformity assessment. It chooses the first for now and records the decision.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Know the provider's planned changes | Instructions for use and permitted configuration obtained from each provider | Provider documentation file |
| Screen every change | Change control asks whether a change alters intended purpose or affects compliance | Change records with role assessment |
| Purpose changes into high-risk uses | Annex III screen on any new capability | Annex III screening record |
| Contractual clarity | Contract defines permitted customisation and cooperation if roles shift | Contract terms |
| Decision when crossing the line | Formal decision to avoid the change or accept provider duties | Signed decision record |
| Provider obligations if accepted | Full provider programme for the modified agent | Technical documentation; conformity records |
If you remain a deployer, your duties stay as described in how to meet deployer obligations for an AI agent.
What will a market surveillance authority or auditor ask?
- What changes have you made to agents you bought, and why?
- How did you decide none of them made you a provider?
- Did any change move an agent into an Annex III use?
- What does the provider's documentation say you may change?
- If you became a provider, where is your technical documentation and conformity assessment?
What does the substantial modification rule not cover?
It does not decide whether an agent is high-risk in the first place; that depends on its use. It does not override duties under GDPR, sector rules or DORA. And it applies per system, so a firm can be provider of one agent and deployer of another. For short answers on who holds which role, see who is the provider and who is the deployer of an AI agent. For the full regulatory map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does editing an agent's prompt count as a substantial modification?
It can, if the agent is high-risk and the edit changes how it decides in ways the provider did not plan for. Routine wording changes within the provider's permitted configuration usually do not. Assess each edit that touches decision criteria.
Does switching the underlying model make a deployer a provider?
It depends on whether the provider foresaw the switch. Moving between model versions the provider has approved is unlikely to count; replacing the model with one the provider never assessed, in a high-risk agent, may.
Can a contract with the vendor prevent a deployer becoming a provider?
A contract cannot override the Act. It can define permitted changes clearly, so you know where the line sits, and secure the vendor's cooperation if you cross it.