Map the relationships before assigning duties.
Identify the model supplier, application provider, integration components and organisation using the finished system. Record who changes the model or system, who controls the deployment and which information passes between the parties.
The same supplier can occupy more than one role, but that does not make every role interchangeable. A clear relationship map helps reviewers ask the right questions of the right party.
Recognise the model-provider framework.
Article 53 includes general-purpose model-provider duties concerning technical information, downstream documentation, copyright policy and training-content summaries. Some open-source provisions are conditional; models with systemic risk have additional considerations.
Those model-level rules should not be confused with the governance of every application using a model. An organisation integrating or deploying a product still needs to examine its own role and intended use.
Request information that supports the application review.
Ask which model or service version is used, what limitations are documented and how changes are communicated. Identify whether the application adds retrieval, tools, customer data or other behaviour that alters the context of evaluation. Keep unknown dependencies visible.
- Model and application identifiers where available.
- Supplier instructions and known limitations.
- Configuration and evaluation references.
- Change notices and ownership of follow-up actions.
Review the resulting business process.
A model's general capabilities do not explain whether a particular output is suitable for customer advice, employment decisions or internal drafting. Define the actual reliance, human checks and acceptable inputs for each use. Assess relevant transparency and high-risk questions at the appropriate system level.
EUAIC can help connect these records and review routes. Specific integrations and technical evaluations are agreed in scope; a supplier model card or governance dashboard is not a substitute for evaluating the deployed application.