substantial modification
In plain wordsA change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker.
Under the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., an unplanned change made to an AI systemAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it. once it is already on the market or in service: one the provider's original conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used. did not anticipate, and which either bears on whether the system still meets the requirements for high-risk systemshigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks. or changes the purpose for which it was assessed. A substantially modified high-risk system needs a new conformity assessment, and a deployer, distributor or other third party that makes such a change, while the system remains high-risk, becomes its provider with all the corresponding duties. Changes to a system that keeps learning after deployment are not substantial if the provider predetermined and documented them at the time of the initial assessment.
Retraining the triage model on another hospital's data may count as a substantial modification.
Origin
Adapted from EU product-safety law, where substantially modifying a product can make the modifier its manufacturer, and included in the 2021 AI Act proposal. For general-purpose models, the Commission's July 2025 guidelines use a compute-based test for when a modifier becomes a provider.
Usage note
A major source of legal uncertainty for fine-tuningfine-tuning, n.: Taking an AI model that has already learned a lot and training it a little more on a smaller, focused set of examples so it gets better at one job or behaves a certain way. and system integration, since whether a change is substantial depends on facts that providers and deployers may dispute.
Related
- provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes.
- conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used.
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
- post-market monitoringpost-market monitoring, n.: The duty of an AI system's maker to keep watching how it performs after release, gathering evidence from real use so that problems are found and fixed.
- fine-tuningfine-tuning, n.: Taking an AI model that has already learned a lot and training it a little more on a smaller, focused set of examples so it gets better at one job or behaves a certain way.
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 3(23); Art. 25(1)(b); Art. 43(4)
Mentioned in
conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used., provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes., intended purposeintended purpose, n.: The use a maker says its AI system is meant for. In EU law, the rules that apply to a system depend largely on this declared purpose.