LIVE · v1.2 STABLE
BUILD 2026.05.27
VALUE CHAIN
AGPL-3.0 · 3 EVAL CASES · 0 ASSERTIONS

WHO
OWES
the OBLIGATIONS.

Places your organization in the AI Act value chain and tests for the quasi-provider trap. Provider / deployer / importer / distributor, Art. 25 substantial modification, finetuning escalation, changed intended purpose, product-manufacturer integration, and a chainable role dashboard — through one guided decision tree.

EU AI ACT   ·   REG. 2024/1689   ·   ART. 3(3)   ·   ART. 3(4)   ·   ART. 3(6)   ·   ART. 3(7)   ·   ART. 3(23)   ·   ART. 25   ·   ART. 25(1)   ·   ART. 25(2)   ·   ART. 25(3)   ·   ART. 16   ·   COMMISSION VALUE CHAIN GUIDANCE   ·   EU AI ACT   ·   REG. 2024/1689   ·   ART. 3(3)   ·   ART. 3(4)   ·   ART. 3(6)   ·   ART. 3(7)   ·   ART. 3(23)   ·   ART. 25   ·   ART. 25(1)   ·   ART. 25(2)   ·   ART. 25(3)   ·   ART. 16   ·   COMMISSION VALUE CHAIN GUIDANCE
§ 01 · CAPABILITIES

SIX PRIMITIVES.
One SKILL.

Each capability is documented separately, tested separately, and called by the workflow at the right moment. Compose them or invoke individually.

01
PRIMARY ROLE
Provider, deployer, importer, or distributor via the Art. 3(3)–(7) decision tree. An organization can hold several roles at once — each system is assessed separately.
02
QUASI-PROVIDER TRAP
Art. 25 tests whether a deployer, importer, or distributor has become a new provider with full Art. 16 obligations and a fresh conformity assessment.
03
FINETUNING ESCALATION
Graduated assessment: PEFT/adapter (LoRA, QLoRA) low, layer-wise medium, full retraining high risk of substantial modification under Art. 25(1)(b).
04
SUBSTANTIAL MODIFICATION
Art. 3(23) 3-step check: identify the change, assess foreseeability against the original conformity assessment, evaluate Chapter III risk impact.
05
INTENDED-PURPOSE CHANGE
Any change of intended purpose (Zweckbestimmung) from the original provider's specification triggers provider status under Art. 25(1)(c).
06
EMPLOYMENT-LAW OVERLAY
Per-country works council duties (DE BetrVG, AT ArbVG, FR Code du Travail, NL WOR, IT Statuto dei Lavoratori, ES Ley Rider) layered on workforce AI deployments.
§ 02 · WORKFLOW

FROM INPUT
to ARTEFACT.

Ten structured steps. The human stays accountable; the skill carries the structure, the citations, and the document trail.

01
Disclaimer & prior context
Non-blocking disclaimer. Accept an Assessment Context block from a prior AI Act skill to pre-fill fields and avoid redundant input.
02
Adaptive intake
One open-ended question. Silently extract 4 fields — acquisition, organizational relationship, market status, modifications. Maximum 2 interaction turns.
03
Primary role determination
Walk Art. 3(3)–(7): provider (Anbieter), deployer (Betreiber), importer (Einführer), or distributor (Händler). Confirm the legal basis.
04
High-risk gate
Proceed to Art. 25 only if the system is high-risk and the user is not already the original provider. Otherwise stay in the primary role.
05
Own name / brand — Art. 25(1)(a)
Branding a third-party system under your own name triggers quasi-provider status. Open-source models deployed under own brand likely qualify.
06
Substantial modification — Art. 25(1)(b)
Run the Art. 3(23) 3-step check. If finetuning is involved, apply the graduated PEFT / layer-wise / full-retrain table.
07
Art. 25(4) exception
If the changes were already foreseen and covered in the original conformity assessment, Art. 25(1)(b) does not trigger quasi-provider status.
08
Changed intended purpose — Art. 25(1)(c)
Any deviation from the provider's documented intended purpose always triggers provider status for the entity that changed it.
09
Product-manufacturer integration
Art. 25(3)(a)-(b): a manufacturer placing or putting into service a high-risk AI system under its own name assumes provider obligations.
10
Role dashboard
Emit primary role, legal basis, quasi-provider risk, Art. 25 scenario, flags, the Art. 25(2) original-provider support duty, and a chainable Assessment Context block.
§ 03 · ANATOMY

WHAT'S
IN the SKILL.

Single-folder skill. SKILL.md is the runtime spec; references hold the knowledge corpus; evals hold the proof. 

ai-act-roles/
├── evals  # Test cases + assertions
│   └── evals.json  # 3 cases, 0 assertions
├── references  # Reference corpus
│   ├── case-studies.md
│   ├── compliance-deadlines.md
│   ├── employment-law-overlay.md
│   ├── finetuning-assessment.md
│   ├── quasi-provider-scenarios.md
│   ├── role-definitions.md
│   ├── sector-guidance-crossref.md
│   ├── substantial-modification.md
│   └── value-chain-obligations.md
├── CHANGELOG.md  # Version history
├── README.md  # Deployment guide
└── SKILL.md  # Main skill instructions
§ 04 · DEPLOYMENT

INSTALL
and INVOKE.

Two deployment surfaces. The skill auto-triggers on relevant keywords once installed.

CLAUDE.AI USER SKILLS

  1. Settings → Profile → Custom Skills
  2. Upload the entire ai-act-roles/ folder
  3. Skill auto-triggers on relevant keywords

CLAUDE CODE / MCP

  1. Copy folder to your skills directory:
cp -r ai-act-roles/ \
   ~/.claude/skills/user/
§ 05 · OUTPUTS

WHAT YOU
get BACK.

Every output is documented, version-pinned, and traceable to its source citation.

Role Determination Dashboard
Single-page verdict: primary role, Art. 3(x) legal basis, quasi-provider risk level, and the triggered Art. 25 scenario.
Quasi-provider verdict
Whether Art. 25 converts you into a new provider with full Art. 16 obligations, and whether a new conformity assessment is required.
Finetuning risk rating
PEFT / layer-wise / full-retrain classification mapped to low / medium / high risk of substantial modification.
Flags
Detected triggers — finetuning level, purpose change, own branding, product-manufacturer integration — each tied to its Art. 25 sub-paragraph.
Responsibilities preview
Art. 25(2) original-provider support duty and the new-conformity-assessment requirement, with handoff to /ai-act-obligations.
Assessment Context block
Chainable handoff: system, classification, role, quasi-provider risk, sector, jurisdiction — pasted into the next AI Act skill.
§ 06 · EVALS

TESTED
before SHIPPED.

Every release runs against a fixed test suite. Assertions check numeric consistency, citation accuracy, and decision-tree branches.

03
Test Cases
0
Assertions
100%
Coverage Required
00
I'm GC at a Dutch BV, 800 employees, financial-services sector
0 ASSERTS
01
Same fact pattern as my earlier classification question (French legal-tech, fine...
0 ASSERTS
02
German GmbH, HR tech vendor
0 ASSERTS
§ 07 · REGULATORY BASIS

WHAT IT
cites.

Every legal verdict resolves to one of these instruments. No invented articles, no synthetic recitals.

EU AI Act (Reg. 2024/1689)
Definitions and value chain responsibilities.
Art. 3(3)–(7)
Provider, deployer, importer, distributor definitions.
Art. 3(23)
Substantial modification definition.
Art. 25
Responsibilities along the AI value chain — quasi-provider triggers (1)(a)-(c), (3), and the (4) exception.
Art. 16
Provider obligations assumed on quasi-provider status.
Commission Value Chain Guidance
Quasi-provider trigger interpretation.
§ 08 · TRUST

EVERY STEP,
auditable.

The trace is the product. Nothing happens off the record — no hidden tool calls, no silent retrieval, no opaque chain-of-thought.

§
Source-anchored output.
Every role, every Art. 25 trigger, every finetuning rating traces back to an Art. 3 / Art. 25 citation or Commission value chain guidance.
VERIFIED
Reproducible decisions.
Pin a build; recreate the role determination years later for audit or litigation defence.
IMMUTABLE
†
Gated before escalation.
Art. 25 runs only when the system is high-risk and you are not the original provider — no spurious quasi-provider verdicts.
ENFORCED
**
EU-native.
Built around Anbieter/Betreiber terminology and Member State works council law (BetrVG, ArbVG, WOR), not retrofitted.
NATIVE
§ 09 · README.MD

EU AI Act Role Determination — Deployment Guide

📄 View the interactive skill page →

See CHANGELOG.md for version history.

Overview

EU AI Act Role Determination — determines the organisation's role in the AI value chain and assesses quasi-provider risk:

  • Primary role determination — provider, deployer, importer, distributor
  • Quasi-provider risk assessment (Art. 25) — substantial modification, rebranding, intended-purpose change, high-risk repurposing
  • Visual decision trees for primary role and quasi-provider triggers
  • Fine-tuning assessment — when does fine-tuning a GPAI model trigger quasi-provider obligations?
  • Substantial modification analysis per Art. 3(23) and Commission guidance
  • Value chain obligation mapping — which obligations attach to which role
  • Employment-law overlay for HR/workforce AI deployments
  • Sector guidance cross-reference for sector-specific role nuances
  • Role Determination Dashboard output with legal basis and follow-up actions

File Structure

ai-act-roles/
├── SKILL.md                              # Main skill instructions (deploy this)
├── CHANGELOG.md                          # Version history
├── evals/
│   └── evals.json                        # Test cases
└── references/
    ├── role-definitions.md               # Provider, deployer, importer, distributor — Art. 3 definitions
    ├── substantial-modification.md       # Art. 3(23) substantial-modification analysis
    ├── quasi-provider-scenarios.md       # Art. 25 trigger scenarios
    ├── finetuning-assessment.md          # When fine-tuning becomes substantial modification
    ├── value-chain-obligations.md        # Obligation map per role
    ├── compliance-deadlines.md           # Deadline anchors per role
    ├── employment-law-overlay.md         # HR/workforce-specific overlay
    ├── sector-guidance-crossref.md       # Sector-specific role considerations
    └── case-studies.md                   # Worked role-determination examples

Deployment

Claude.ai (User Skills)

  1. Go to Settings → Profile → Custom Skills (or equivalent)
  2. Upload the entire ai-act-roles/ folder structure
  3. The skill will auto-trigger on "AI Act role", "provider vs deployer", "quasi-provider", "Art. 25", "substantial modification", or "Anbieter / Betreiber"

Claude Code / Custom MCP Setup

  1. Copy the ai-act-roles/ folder to your skills directory: bash cp -r ai-act-roles/ /path/to/your/skills/user/ai-act-roles/
  2. Ensure the skill is registered in your configuration

Usage

Quick Start

Describe what your organisation does with the AI:

"We're a German bank. We licensed an off-the-shelf credit-scoring model from a US vendor, fine-tuned it on our own data, and rebranded the output for our customers. Are we the provider, deployer, or quasi-provider?"

The skill will walk through primary-role and quasi-provider trees.

Trigger Phrases

  • "Determine AI Act role" / "Provider or deployer?" / "Are we the deployer?"
  • "Quasi-provider" / "Art. 25" / "Substantial modification" / "Wesentliche Veränderung"
  • "Value chain responsibilities" / "Anbieter" / "Betreiber"
  • "Does fine-tuning make us the provider?"

Workflow

Phase Description
Phase 1: Context Gathering Adaptive intake — what the organisation does with the AI, source/origin of the system
Phase 2: Primary Role Determination Visual decision tree — provider / deployer / importer / distributor
Phase 3: Quasi-Provider Risk Assessment (Art. 25) Trigger assessment tree — substantial modification, rebranding, purpose change, high-risk repurposing
Phase 4: Role Determination Dashboard Output: primary role + quasi-provider verdict + legal basis + obligations preview

Capabilities Summary

Feature Description
Primary Role Determination Provider, deployer, importer, distributor — visual decision tree
Quasi-Provider Assessment Art. 25 trigger tree (substantial modification, rebranding, purpose change, high-risk repurposing)
Fine-Tuning Analysis When fine-tuning a GPAI model becomes substantial modification
Substantial Modification Art. 3(23) analysis with Commission guidance
Value Chain Mapping Obligations per role with cross-reference to ai-act-obligations
Employment-Law Overlay HR/workforce-specific role considerations
Sector Cross-References Sector-specific role nuances
Role Dashboard Single-page output with verdict + legal basis + next steps

Regulatory Basis

Document Reference
EU AI Act Regulation (EU) 2024/1689
Art. 3 Definitions — provider, deployer, importer, distributor
Art. 3(23) Substantial modification definition
Art. 25 Responsibilities along the AI value chain (quasi-provider)
Commission Value Chain Guidance Quasi-provider trigger interpretation
Art. 16, 26 Obligations per primary role

License & Disclaimer

This skill provides structured AI Act role-determination guidance based on Regulation (EU) 2024/1689 and Commission value chain guidance. It is not legal advice. Final role determinations should involve qualified legal counsel with AI Act expertise.

Licensed under AGPL-3.0 — see LICENSE at the repo root.

Created by Oliver Schmidt-Prietz — OneZero Legal