The classic trap
Recital 86 sheds light on an explosive scenario: an integrator, distributor or deployer substantially modifies your AI system and becomes itself the provider under Article 25. You think you are out of scope, but the recital reminds you that you remain bound to technically cooperate with the new provider for conformity assessment. The trap the EU AI Office and national market surveillance authorities will sanction: an initial provider who simply states we are no longer responsible and refuses access to weights, training datasets, Annex IV technical documentation, or logs needed by the new conformity assessor.
The practical test: must I cooperate, or can I refuse ?
Recital 86 raises a duality that practice will have to clarify:
- Express contractual exclusion: if your terms of use or license agreements explicitly prohibit transformation into a high-risk system (e.g. no high-risk repurposing clause), you may refuse cooperation.
- Absence of exclusion: contractual silence equals an obligation to cooperate, transmit Annex IV technical documentation, and provide API access or ML artefacts.
- Reasonably expected technical access: a vague notion covering model cards, datasheets, performance metrics and training logs, but likely not the full proprietary source code.
- Other required assistance: answering notified body questions, signing attestations, providing a technical point of contact.
- Written trail: each refusal or acceptance must be documented to mount a defense before the EU AI Office or the Luxembourg AI market surveillance authority (to be designated).
Why contractual clauses become the battlefield
Recital 86 turns your terms of use and AI license contracts into legal defense instruments. A well-drafted high-risk exclusion clause takes you out of the forced cooperation regime. A missing clause traps you in it, sometimes years after the initial placement on the market. Luxembourg providers of generative AI and foundation models must urgently revise their contracts before August 2026.
How Luxgap automates this risk
Our Luxgap AI Provider Shield turns the contractual uncertainty of Article 25 and Recital 86 into an opposable legal defense. The tool continuously analyses your license agreements, terms of use, distribution contracts and API conditions via a specialised LLM agent trained on the 113 articles and 180 recitals of the AI Act, and automatically detects the absence or presence of a no high-risk repurposing clause compliant with Recital 86.
- Scans your contracts in Odoo, DocuSign, Ironclad and SharePoint and identifies every agreement making available an AI system that could be transformed by a third party.
- Detects the absence of an express exclusion clause and automatically generates the no high-risk repurposing template clause to insert, tailored to Luxembourg and EU law.
- Maintains a timestamped registry of active cooperation obligations per counterparty, with an inventory of technical artefacts (datasheets, model cards, logs) to provide on request.
- Alerts on Teams or Slack as soon as a new customer changes the declared usage via your API beyond the initial contractual scope.
- Produces a cryptographically sealed PDF report, opposable to the EU AI Office and the future Luxembourg AI market surveillance authority, demonstrating your legal position on each AI system placed on the market.
- Pre-fills the Annex IV technical file shared with the new provider in case of mandatory cooperation, redacting sensitive proprietary content.
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real contracts, with a free 48-hour blind audit to measure your contractual exposure before any engagement.
