Builds on AR-000200 (The EU AI Act Explained), AR-000210 (High-Risk AI Systems), AR-000240 (Provider Obligations), AR-000280 (Market Surveillance and Enforcement), and AR-000300 (Importers and Distributors) — none of their content is re-derived here. This article covers Article 25’s three reclassification triggers and corrects a citation error in AR-000240 identified during this research pass.
Executive summary
What this means
Who this applies to
Regulatory context
The statutory definition of substantial modification
Article 25’s cross-references to Article 6
Third-party supplier agreements (Article 25(4))
Savings clause
Correction to AR-000240
Requirements
What organizations must do
- Run the Article 25(1) test as a standing check, not a one-time assessment at acquisition — any of the three triggers can occur well after a system was first placed on the market.
- Document whether each planned update to a third-party high-risk system was contemplated in the original provider’s conformity assessment — a pre-planned change falls outside the substantial-modification definition; an unplanned change that affects compliance or intended purpose falls inside it.
- Original providers should use the Article 25(2) opt-out explicitly where appropriate — clearly specifying a system is not to be changed into high-risk relieves the initial provider of the documentation hand-over duty that otherwise attaches on reclassification.
- Formalise the Article 25(4) written agreement early in the supplier relationship, before a compliance gap surfaces — the AI Office’s voluntary model contract terms are designed to reduce negotiation burden here.
- New providers created through Article 25 reclassification should treat AR-000240’s full Article 16 checklist as immediately applicable from the point of reclassification, not as a transitional or reduced obligation set.
Common mistakes
Assuming any modification to a third-party system triggers reclassification is a common mistake — the Article 3(23) definition requires the change to have been unforeseen at the time of initial assessment and to affect compliance or intended purpose; routine, pre-planned updates do not qualify.
Assuming the initial provider retains any Article 16 obligations for a system after Article 25(2) reclassification is a second mistake — the text is explicit that the initial provider “shall no longer be considered to be a provider of that specific AI system,” replaced by a narrower cooperation duty rather than continuing shared responsibility.
Overlooking the open-source carve-out in Article 25(4) is a third mistake — the written-agreement requirement does not apply to third parties making non-GPAI tools, services, processes, or components publicly available under a free and open-source licence.
Treating general-purpose AI models as immune to Chapter III reclassification because they are governed by the separate Chapter V regime AR-000270 covers is a fourth mistake — Article 25(1)(c) explicitly includes GPAI models among the systems whose repurposing into a high-risk use can trigger reclassification of whoever makes that change.
Open questions
- Whether the Digital Omnibus changed Article 25’s reclassification triggers or the initial provider’s cooperation duty — the AI Act Service Desk page for Article 25 carries the Omnibus amendment disclaimer, unlike Articles 23 and 24 which AR-000300 confirmed clean. The text cited here is pre-Omnibus.
- Whether the AI Office has published the Article 25(4) voluntary model contract terms, and if so what they contain — not confirmed against a primary source on this research pass.
- How the Article 25(2) opt-out should be documented in practice — the statutory text does not elaborate on what “clearly specifying” requires; no Commission guidance on the point was identified.