A regulatory analysis under the AI act
The rapid global proliferation of open-weight AI models developed by Chinese technology companies, most notably Alibaba Cloud’s Qwen family, DeepSeek and Kimi, has raised a series of practical compliance questions under the EU AI Act (Regulation (EU) 2024/1689, hereinafter the Regulation). Two distinct categories of market actors face this tension. First, EU-based companies routinely integrate these models as foundation layers into commercial AI systems. Second, companies established in third countries, including jurisdictions across Central Asia, the Middle East, and Southeast Asia, build AI products on Chinese foundation models and deploy them to clients on the EU market, triggering the Regulation’s extraterritorial reach under Art. 2(1)©. In both cases, the models’ upstream developers have no formal presence on the EU market. This practice raises a deceptively simple question with far-reaching compliance consequences:
who bears the regulatory obligations of a general-purpose AI (GPAI) model provider under the Regulation when the model’s developer has not itself placed the model on the EU market, and what obligations attach to the AI system provider regardless of where it is established?
Article 3(3) of the Regulation defines a provider of a GPAI model as “a natural or legal person […] that develops a general-purpose AI model and places it on the market.” Two cumulative conditions apply: (i) development of the model, and (ii) placing it on the market. Under Art. 2(1)(a), these obligations apply irrespective of whether the provider is established within the Union or in a third country (Guidelines, §50).
The Commission’s July 2025 Guidelines resolve a textual ambiguity that had generated significant uncertainty: what happens when a model is made available outside the EU but subsequently integrated into a system placed on the EU market?
If a model is made available outside the EU but is later incorporated into a system placed on the EU market, the model is considered placed at that point. The upstream actor is then considered the provider of the model, unless the upstream actor has excluded, in a clear and unequivocal way, the distribution and use of the model on the Union market. If the upstream actor has done so, the downstream actor that integrates the model into a system and places the system on the Union market is considered the provider of the model (Guidelines, § 59).
This rule creates a binary outcome:
The Qwen model family is distributed under the Apache-2.0 licence, which contains no EU-specific territorial restrictions. The licence includes a general export-compliance clause requiring users to adhere to applicable law, but this does not constitute an explicit exclusion of EU use within the meaning of the Guidelines. Accordingly:
| Question | Analysis |
|---|---|
| Is Alibaba Cloud the provider of the Qwen GPAI model? | It developed the model and has not excluded EU use; integration by an EU-market actor constitutes placing on the EU market (Guidelines) |
| Does the EU downstream provider become the GPAI model provider? | No rebrand, no substantial modification, no explicit EU exclusion in the Apache 2.0 licence. No basis under the Arts. 53–54 or the Guidelines for re-attribution of GPAI provider obligations |
Nevertheless, the downstream provider does not assume the obligations of a GPAI model provider; it remains fully subject to the Regulation as a provider of an AI system in accordance with the system’s risk classification under the Regulation
Scenario: An EU startup integrates DeepSeek-R1 (MIT licence, no EU exclusion) into an automated CV-screening tool used by employers to shortlist candidates.
Regulatory outcome:The system falls within Annex III, point 4(a) (AI systems used for recruitment or selection of natural persons). The EU startup must fulfil all the necessary obligations for high-risk AI system providers.
DeepSeek’s developer retains the status of GPAI model provider: the MIT licence contains no exclusion of the distribution and use of the model on the Union market within the meaning of Guidelines §59, and the EU startup makes no modification meeting the one-third compute threshold under Guidelines §62–63. Accordingly, GPAI model provider obligations under Chapter V do not flow down to the AI system provider.
Scenario: A company established in Central Asia builds a customer-facing chatbot on top of Qwen2.5-72B (Apache 2.0), without modifying the model, and deploys it to business clients in the EU as a SaaS product.
Regulatory outcome: The Regulation applies by virtue of Art. 2(1)(c): the output of the system is intended to be used in the Union, regardless of where the provider is established. The Central Asian company is a provider of an AI system within the meaning of Art. 3(2) and subject to the full scope of the Regulation.
The chatbot is not listed in Annex III and does not exhibit features triggering Art. 6. Art. 50(1) applies: the system must be designed and developed such that end users can be informed that they are interacting with an AI system. In a B2B deployment model, the Central Asian company, as the provider, bears the obligation to design the system to enable this disclosure and to provide the deployer with the technical means necessary for its implementation. The EU business client as deployer bears the obligation to implement the notice to end users under Art. 50(5). These obligations cannot be contractually displaced.
Alibaba Cloud retains the status of GPAI model provider: the Apache 2.0 licence contains no exclusion of the distribution and use of the model on the Union market within the meaning of Guidelines §59, and the Central Asian company makes no modification meeting the one-third compute threshold under Guidelines §62, the Apache 2.0 licence contains no explicit EU exclusion, and the Central Asian company makes no substantial modification to the model. Accordingly, no basis for re-attribution of GPAI model provider obligations arises under the Commission’s July 2025 Guidelines.
The EU AI Act’s provider identification framework, as clarified by the July 2025 Guidelines, produces a legally coherent but operationally demanding regime for companies building on Chinese open-weight models. Three conclusions merit emphasis.
First, licence analysis is mandatory, not discretionary. Whether the upstream GPAI model developer has explicitly excluded EU use is the pivotal threshold question. In the absence of explicit exclusion, as with Qwen under Apache 2.0, the upstream developer retains GPAI model provider status regardless of its formal presence on the EU market.
Second, obligations at the model and system levels are separate and must be analysed independently. Obligations of the GPAI model provider under Chapter V do not automatically flow down to the AI system provider. Conversely, AI system provider obligations are fully operative regardless of the upstream compliance status of the model developer, and their scope is determined solely by the system’s risk classification, not by the regulatory status of the underlying model.
Third, extraterritoriality is not an exception to compliance. Companies established outside the EU that deploy AI systems to EU clients fall within the Regulation’s scope by virtue of Art. 2(1)(c). As national market surveillance authorities begin enforcement operations under Chapter IX, this will rapidly move from academic analysis to live compliance risk.
