EU AI Act Art. 25: responsibilities along the AI value chain

Responsibilities along the AI value chain: when a distributor, importer or deployer becomes a provider, and the information a provider must pass to actors downstream

By Jorge García Aibar Reviewed 2026-09-24

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART25. Drawn from chapter 08.

Text alternative

Clause: EU AI Act, Art. 25.
Duty holder: Provider + value-chain actors.
Applies from: 2027-12-02, Deferred.
Artefact: Value-chain due-diligence gate.
Layers: Layer 02, Layer 05.
Evidence record: Vendor due-diligence response, +2 more.
Record schemas: Vendor due-diligence response , Deployment decision record , Classification decision record .
The same topic in 17 other frameworks; the crosswalk section below links each clause.

Id

AIGE-OBL-EUAIA-ART25

Instrument

EU AI Act (post-Omnibus) law

Compared side by side

ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act

Clause

Art. 25

Duty holder

Provider + value-chain actors

Authority

National MSA

Applies from

2027-12-02 Deferred · Annex III

Later dates

2028-08-02 Applies to Annex I embedded (product safety-component) systems
2030-08-02 Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

System class

High-risk (Annex III) · High-risk (Annex I)

The artefact that evidences it

Value-chain due-diligence gate; provider/deployer responsibility allocation; AIBOM and model/data cards collected from upstream providers.

Patterns that build it

Vendor / Model Due-Diligence Gate (layer 2 and 5)
Downstream Use Register (layer 2 and 1)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Supply chain and third parties

ISO 42001 A.10 Third-party and customer relationships (core)
NIST AI RMF GOVERN 6 GOVERN 6: Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues (core)
NIST AI RMF MAP 4 MAP 4: Risks and benefits are mapped for all AI system components including third-party software and data (core)
NIST AI RMF MANAGE 3 MANAGE 3: AI risks and benefits from third-party entities are managed (core)
TC260 Framework 3.0 TC260 App. 2 II.4 Supply chain and tool management (core)
GDPR Art. 28 Processor (core)
NIST AI RMF MANAGE 3.1 MANAGE 3.1: AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented (core)
CSA AICM STA-10 Supply Chain Risk Management (core)
CSA AICM STA-09 Service Bill of Material (BOM) (core)
OWASP LLM LLM04:2026 Supply Chain (core)
OWASP Agentic ASI04 Agentic Supply Chain Vulnerabilities (core)
EU AI Act Art. 26 Obligations of deployers of high-risk AI systems
TC260 Framework 3.0 TC260 4.4.4 Open-source ecosystem
China GenAI Measures GenAI Art. 7 Lawful data and model sources
China Deep Synthesis DeepSyn Art. 14 Providers and technical supporters
EU AI Act Art. 22 Authorised representatives of providers of high-risk AI systems
EU AI Act Art. 23 Obligations of importers
EU AI Act Art. 24 Obligations of distributors
EU AI Act Art. 54 Authorised representatives of providers of general-purpose AI models
GPAI Code Transparency 1.2 Providing relevant information
GDPR Arts. 44–46 Transfers to third countries
NIST AI RMF GOVERN 6.2 GOVERN 6.2: Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk
UK ATRS ATRS 2.1.4 Third party involvement
G7 Code G7 Action 11 Implement data input measures and protect personal data and intellectual property
GAO AI Accountability 2.6 Dependency: assess interconnectivities and dependencies of data streams that operationalize the AI system

Deployment, change and decommissioning

EU AI Act Art. 26 Obligations of deployers of high-risk AI systems (core)
ISO 42001 A.6.2.5 AI system deployment (core) (clause not verified)
ISO 42001 A.6.2.6 AI system operation and monitoring (core) (clause not verified)
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use (core)
NIST AI RMF MANAGE 4.1 MANAGE 4.1: Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management (core)
NIST AI RMF GOVERN 1.7 GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness (core)
CSA AICM AIS-06 Secure Application Deployment (core)
EU AI Act Art. 43(4) New conformity assessment on substantial modification
EU AI Act Art. 20 Corrective actions and duty of information
EU AI Act Art. 79 Procedure at national level for dealing with AI systems presenting a risk
EU AI Act Art. 86 Right to explanation of individual decision-making
ISO 42001 A.9 Use of AI systems
CSA AICM CCC-01 Change Management Policy and Procedures
CSA AICM DSP-02 Secure Disposal
Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test
CoE Convention CoE Art. 16(2)(g) Testing before first use and when significantly modified
OECD AI Principles OECD 1.4 Robustness, security and safety
TC260 Framework 3.0 TC260 5.3 Operators' safety guidelines
TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
GAO AI Accountability 4.4 Ongoing assessment: assess the utility of the AI system to ensure its relevance to the current context
GAO AI Accountability 4.5 Scaling: identify conditions, if any, under which the AI system may be scaled or expanded beyond its current use

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-AGENT-018 MCP server admission gate (Agent runtime profile)
AIGE-CTL-AGENT-019 Local MCP servers sandboxed (Agent runtime profile)
AIGE-CTL-DATA-012 Registered Downstream Consumers of Outputs (Data admission and privacy profile)
AIGE-CTL-DEPLOY-007 Re-assessment when a change goes beyond what was foreseen (Deployment and monitoring profile)

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-euaia-art25.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 25: responsibilities along the AI value chain (AIGE-OBL-EUAIA-ART25). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art25. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 25: responsibilities along the AI value chain (AIGE-OBL-EUAIA-ART25)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art25},
  note         = {Version 0.5.0}
}