You put your brand on OpenAI or Gemini: are you a provider? (Art. 25)

One of the most common confusions in HR-techs is assuming that, because they use someone else's model, the regulatory responsibility lies with the model provider. Article 25 of Regulation (EU) 2024/1689 says something quite different, and it is worth reading carefully before building on that assumption.

When a deployer becomes a provider

Article 25 establishes that a deployer, distributor or importer is treated as a provider, with the regulation's heaviest obligations, in several situations:

• When it puts its name or brand on a high-risk system.
• When it makes a substantial modification to the system.
• When it changes the system's intended purpose.

Article 3, in turn, defines the difference between provider and deployer. The distinction is not cosmetic: the provider bears the bulk of the documentation, risk-management and conformity obligations.

The typical HR-tech situation

Now map this onto the usual case. You integrate a general-purpose model (OpenAI, Gemini) inside your hiring product, offer it under your brand and present it to the market as your matching or screening feature. The "we only call the OpenAI API" argument does not exempt you on its own: by putting your brand on a high-risk system, or adapting it to a hiring purpose, you may cross the line that makes you a provider.

The practical consequence is that you need to document your position with evidence, not intuitions. Which model you use and in which version, what you have changed relative to default behaviour, for what purpose you present it and under which brand. That record is what lets you defend your classification if a client, or an authority, asks about it.