Downstream provider #1: The Matryoshka-Challenge

The downstream providership according to the EU AI Act arises as soon as “any” AI model is integrated into “any” AI system. Similar to Matryoshka dolls, however, there are not only simple but also complex multi-level nestings in AI practice. Here is an overview with suggestions for terminological differentiation of various downstream provider variants.

• Article 3 No. 68 EU AI Act governs downstream providership with respect to AI models.
• However, a definition of what actually constitutes an AI model is missing from the EU AI Act.
• Additionally, there is the common practice of multiple nesting of AI models and AI systems.
• At a minimum, it is therefore necessary to differentiate between four variants, hereinafter referred to as IMP, SMP, GMP, and GMP-SR.

Articles of the EU AI Act mentioned in this post (German):

• Artikel 3 EU AI Act
• Artikel 6 EU AI Act
• Artikel 16 EU AI Act
• Artikel 25 EU AI Act
• Artikel 53 EU AI Act.
• Anhang XII EU AI Act

Downstream Providers – The Bottomless Pit!

One of the greatest challenges in AI regulation is the (multiple) nesting of AI systems and AI models. This is particularly important with respect to determining who holds the overall responsibility for an AI system, including all its integrated components, within AI value chains.

The simple answer is:

• It is always the provider of the highest-level AI system!
• In other words, the provider of the AI system as defined in Article 3 No. 1 EU AI Act, which integrates other AI systems and/or AI models within itself.

At first glance, the wording of Article 3 No. 68 of the EU AI Act seems clear and unambiguous:

For the purposes of this Regulation, the following definitions apply:

‘downstream provider’ means a provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether the model is provided by themselves and vertically integrated or provided by another entity based on contractual relations.

Caution: Read carefully! The wording “that integrates an AI model” is the critical aspect of this provision! It refers to “any” AI model. However, a general definition of AI models is missing in the EU AI Act – it simply does not exist! Thus, the definition of downstream provider is tied to a legal term that is, in many respects, undefined. What may initially seem “simple” with regard to downstream providers becomes quite cryptic upon closer examination!

For an introduction to the missing definition of AI models, the following two articles are recommended:

1. Different Levels of AI Providers

To better understand the issues stemming from, among other things, the lack of a definition for AI models, at least four different types of AI models must be distinguished in terms of downstream providers:

• Integrated Model Providers (IMP)
  These AI models exist only within a single AI system.
• Specific Model Providers (SMP)
  These AI models can be used within different AI systems.
• GPAI Model Providers (GMP)
  These AI models, when integrated into an AI system, create general-purpose AI systems as per Article 3 No. 66 of the EU AI Act.
• GPAI Model Providers with Systemic Risks (GMP-SR)
  These AI models also meet the requirements of Article 3 No. 66 EU AI Act but possess additional specific characteristics.

Below is an initial overview of the different types and the resulting (potential) transparency obligations with regard to downstream providers as defined in Article 3 No. 68 EU AI Act:

2. “Multiple Nesting”

The four basic types of AI models previously outlined lead in practice, in combination with the different risk classes for AI systems, to further highly complex multi-level nesting arrangements.

The practical complexity of such multiple nesting typically arises from the need to commercialize AI: IMAs, as outlined above, generally bear the full cost of both the AI model and the AI system. Given the speed of AI innovation, this is rarely attractive.

The same applies to GMA and GMA-SR models: Here too, the balance between cost pressure and innovation speed leads to GPAI models evolving into GPAI systems as per Article 3(66) of the EU AI Act, which are then integrated into other AI systems (see the wording of the regulation: “for direct use as well as for integration into other AI systems”).

The same applies to GMA and GMA-SR models: Here too, the balance between cost pressure and innovation speed leads to GPAI models evolving into GPAI systems as per Article 3(66) of the EU AI Act, which are then integrated into other AI systems (see the wording of the regulation: “for direct use as well as for integration into other AI systems”).

2.1 Integration Level IMP & SMP

The following overview illustrates the complexity that may arise in terms of downstream providers when dealing with IMAs & SMAs:

2.2 Integration Level GMP & GMP-SR

When GPAI models are integrated, the general-purpose attribute extends to all further levels of AI systems:

2.3 Integration into AI Systems with Harmonization Legislation

Another variant arises directly from Article 6(1) of the EU AI Act:

• An AI system that fulfills one of the aforementioned integration variants of AI models is integrated as a safety component into a product that is subject to the harmonization requirements of Annex I.
• An AI system that fulfills one of the aforementioned integration variants of AI models is directly subject to the harmonization requirements of Annex I.

This is especially important in cases related to the Medical Device Regulation (MDR).

As can be seen: The topic of “downstream providers” is not as straightforward as one might hope.

3. Further Articles on the Topic

Further articles on this topic will address each of the different use cases outlined above, providing case scenarios combined with relevant checklists.

About the author:

Oliver M. Merx