AWS SageMaker and the EU AI Act: When You Build the Model, You Are the Provider
Train your own models on AWS SageMaker? Under the EU AI Act you are the provider (Article 16) — no upstream GPAI vendor, so Article 10, 12 and 43 fall to you.
You train a gradient-boosted scorer on your own data and deploy it to a SageMaker endpoint. Who answers to the regulator? You do. When you build, train, and put a model into service under your own name, Regulation (EU) 2024/1689 treats you as the provider — SageMaker is the compute underneath, not a co-author. The build-your-own case differs from renting a foundation model: no third-party model to point at.
SageMaker is MLOps infrastructure, not a model — why that changes everything
Services that resell a foundation model let you call someone else's model via an API. SageMaker is different: it is a platform to build, train, fine-tune, and deploy your own model end to end — you own the training data, the artefact, the endpoint, and the documentation. A hosted foundation model usually has an upstream general-purpose AI (GPAI) provider carrying its own Chapter V duties; a model trained on SageMaker often has none — so you cannot inherit data governance, documentation, or a conformity assessment from a provider that does not exist.
The build-your-own-model layer vs the call-an-API layer
The right question is never "does SageMaker comply?" SageMaker is the compute, the training jobs, the model registry, and the hosting layer — infrastructure, not a provider of the model you trained on it. AWS's attestations cover its own layer, not your trained model.
The obligation attaches to your system and its intended purpose
The Act attaches to the AI system and its intended purpose, not the framework or the compute. Ask what you built, for whom, and what it decides; the risk tier follows from Article 6 and Annex III.
If you train and deploy under your own name, you are the provider (Article 16)
Article 3(3) defines a provider as a person that develops an AI system and places it on the market or puts it into service under its own name or trademark. Training your own model on SageMaker and deploying it as a product or internal tool puts you squarely there. When the system is high-risk, you carry the full stack: risk management (Article 9), data governance (Article 10), technical documentation (Article 11, Annex IV), transparency to deployers (Article 13), human oversight (Article 14), accuracy and cybersecurity (Article 15), conformity assessment (Article 43), the Article 47 Declaration of Conformity, Article 49 registration, and post-market monitoring with incident reporting (Articles 72–73).
Provider vs deployer for a model you trained yourself
You are a deployer under Article 26 only when you run a system someone else built under their name. If you trained your own model on SageMaker the deployer role rarely applies — you are the provider, and operating it internally too means you carry both sets of duties.
When fine-tuning an open-weight model makes you the provider
Article 25 governs role shifts. A deployer, distributor, or importer becomes a provider if it puts its name on a high-risk system, makes a substantial modification (Article 3(23)), or changes the intended purpose so the system becomes high-risk — so retrain or repurpose an open-weight model on SageMaker and you cross that line. A provider outside the Union must appoint an EU authorised representative under Article 22.
Classify the system by intended purpose, not by the platform
The Act classifies by use and intended purpose, never by the framework or the compute — a model trained on SageMaker is not inherently any risk tier.
Annex III functions a custom model commonly lands in
A stand-alone system is high-risk under Article 6(2) when it performs a function listed in Annex III. The points most relevant to custom models:
- Annex III point 4 (employment) — 4(a) recruitment and selection; 4(b) in-employment decisions, task allocation, and worker monitoring.
- Annex III point 5 (essential services) — 5(b) creditworthiness assessment and credit scoring (fraud detection excluded); 5(c) life and health insurance risk and pricing.
- Annex III point 2 (critical infrastructure) — AI safety components in critical infrastructure, including critical digital infrastructure, road traffic, and water, gas, heating, and electricity supply.
The Article 6(3) filter and the not-high-risk majority
Article 6(3) can pull an Annex III system back out of high-risk if it performs a narrow procedural task, improves a previously completed human activity, detects deviation from decision patterns without replacing human assessment, or does preparatory work only. One condition suffices — but a system that profiles natural persons is always high-risk regardless. Document the assessment and still register under Article 49.
Most general business machine learning built on SageMaker is not high-risk: demand forecasting, churn prediction, recommendation, internal search, marketing scoring, operations routing. There the realistic duties are Article 4 AI literacy, Article 50 transparency where output reaches third parties, and data governance.
The Annex I product route (and the Section B carve-out)
If your SageMaker-built model is a safety component of a regulated product, the product route under Article 6(1) and Annex I applies instead. For Annex I Section A products (medical devices under MDR/IVDR, toys, lifts, radio equipment under Directive 2014/53/EU), Article 43(3) routes conformity assessment through the sectoral acts. For Annex I Section B products (motor vehicles under Regulation (EU) 2018/858, aviation, rail, marine equipment), Article 2(2) means only Article 6(1), Articles 102–109, and Article 112 apply directly — requirements reach manufacturers through the AI-Act-amended sectoral framework, not the Articles 8–15, 16, and 43 stack.
Data governance (Article 10) and logging (Article 12) are squarely yours
Why Article 10 cannot be delegated upstream
Article 10 requires training, validation, and testing datasets for high-risk systems to meet data governance criteria — relevance, representativeness, error-minimisation, and completeness — with bias examination. With a model you trained yourself there is no upstream provider to inherit this from; the obligation is yours, full stop.
Designing SageMaker pipelines for Article 12 traceability
Article 12 requires high-risk systems to technically allow automatic event logging over a lifetime appropriate to the intended purpose — so the pipeline must capture data lineage, model versions, inputs, outputs, and oversight events.
Article 11 and Annex IV documentation must cover model architecture, training methodology, dataset provenance, subgroup metrics, and the SageMaker configuration, retained ten years under Article 18. Article 15 accuracy, robustness, and cybersecurity sit at the model and endpoint level, which infrastructure hardening does not discharge.
AWS is your host, not your conformity assessor
AWS's certifications and attestations cover its own infrastructure layer. They are not a conformity assessment under Article 43 of the model you trained — the provider performs and signs that.
Self-assessment (Annex VI) vs notified body (Annex VII)
Most stand-alone Annex III systems use the Annex VI internal self-assessment route; biometrics generally require the Annex VII notified-body route. Either way the obligation is yours, ending in the Article 47 EU Declaration of Conformity and Article 49 registration. AWS EU regions and data processing agreements support GDPR and the data-flow side of Article 10, but residency neither classifies nor assesses it.
When could YOU become a GPAI provider?
Your custom model has no third-party GPAI provider carrying the Articles 51–55 duties. Train a genuinely general-purpose model of your own and place it on the market, and you could yourself fall within those obligations, in force since 2 August 2025 — though this is situational.
Worked example: a 600-person lender builds an in-house credit-scoring model on SageMaker
Lumen Crédit, a 600-employee EU consumer lender, trains a gradient-boosted credit-scoring model on SageMaker from its own loan-book data and serves it from a real-time endpoint to loan officers.
From intended purpose to risk tier
The function is creditworthiness assessment of natural persons — Annex III point 5(b) (scoring, not the excluded fraud detection) — so it is high-risk under Article 6(2), and profiling means the Article 6(3) exemption is unavailable. Lumen developed it under its own name, making it the provider under Article 16; its loan officers are internal deployers, so Lumen is both.
The provider obligation table for the credit-scoring build
| Article | Obligation for Lumen Crédit |
|---|---|
| Article 9 | Risk management with bias and disparate-impact testing |
| Article 10 | Data governance over the loan-book datasets |
| Article 11 / Annex IV | Technical documentation of model, data, configuration |
| Article 12 | Logging of scores, overrides, and oversight events |
| Article 13 | Instructions for use if licensed onward |
| Article 14 | Human oversight — officers see rationale and override |
| Article 15 | Accuracy, robustness, endpoint cybersecurity |
| Article 43 / Annex VI | Internal self-assessment route |
| Articles 47 / 49 | Declaration of Conformity and EU database registration |
| Articles 72–73 | Post-market monitoring and incident reporting |
Timeline and penalties: what to plan against in 2026
The deadlines to plan against now
Article 5 prohibitions have applied since 2 February 2025 (two further bans, on non-consensual intimate imagery of an identifiable person and on CSAM, apply from 2 December 2026; Article 50 content marking has applied since 2 August 2026), Article 4 AI literacy since 2 February 2025, and the GPAI obligations in Articles 51–55 since 2 August 2025.
For stand-alone high-risk Annex III systems under Article 6(2), obligations now apply from 2 December 2027, deferred from the original 2 August 2026 by the Digital Omnibus — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), published in the Official Journal on 24 July 2026 and in force since 27 July 2026. The deferral uses fixed calendar dates, not the Commission's standards-linked "stop the clock" proposal, so not everything is delayed. Product-embedded Annex I systems (Article 6(1)) move from 2 August 2027 to 2 August 2028.
Penalty exposure and SME proportionality
Penalty tiers are set in Article 99. High-risk and most obligation breaches carry up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)); prohibited practices carry up to €35 million or 7% (Article 99(3)); and incorrect or misleading information to authorities up to €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage or the fixed amount.
How Confir helps
Register each SageMaker-built system, classify it under Article 6 and Annex III with the Article 6(3) filter, derive the provider or deployer role, and generate the Article 11 and Annex IV documentation and the Article 47 Declaration of Conformity from one intake. The synthesis engine is deterministic and rule-based — no model inference, no hallucination — so the same intake produces the same finding and the rule that fired is human-readable.
Frequently asked questions
Does building on AWS SageMaker make AWS responsible for my EU AI Act compliance?
No. SageMaker is MLOps infrastructure — compute, training, hosting. When you train a model and put it into service under your own name, Article 3(3) makes you the provider, and the obligations in Article 16 are yours. Your custom model has no upstream GPAI provider, and AWS's attestations are not a conformity assessment under Article 43 of what you built.
I trained my own model on SageMaker — am I the provider or the deployer?
Almost certainly the provider. Article 3(3) defines a provider as one who develops an AI system and puts it into service under its own name, which training and deploying your own model meets. You are a deployer (Article 26) only when you run a system someone else built under their name; if you trained it, you also wear the deployer hat internally.
Is a model I build on SageMaker automatically high-risk?
No. The Act classifies by intended purpose, not by platform. Your model is high-risk only if it performs an Annex III function — for example employment decisions (point 4), creditworthiness or credit scoring (point 5(b)), or critical-infrastructure safety components (point 2) — under Article 6(2). Even then, the Article 6(3) filter can exempt narrow or preparatory tasks, unless it profiles people. Most business ML is not.
Who owns the Article 10 data governance and Article 12 logging duties for a custom model?
You do, unambiguously. Because you assemble the training, validation, and testing data, Article 10's requirements — relevance, representativeness, error-minimisation, and bias examination — fall on you; no upstream provider exists to inherit them from. Article 12 then requires the high-risk system to technically allow automatic event logging, so the SageMaker pipeline must capture data lineage, model versions, inputs and outputs, and oversight events.
When do high-risk obligations apply, and can I rely on the 2027 deferral?
Not for a plain SageMaker inference deployment. Stand-alone high-risk Annex III obligations under Article 6(2) now apply from 2 December 2027, deferred from the original 2 August 2026 by the Digital Omnibus, adopted by the European Parliament and the Council in June 2026.
Could training my own model on SageMaker make me a GPAI provider?
It can, but it is situational rather than the common case. If you train a genuinely general-purpose AI model and place it on the market, you may fall within the GPAI provider obligations in Articles 51–55, in force since 2 August 2025. Most teams build narrow, task-specific models — a forecaster or classifier — assessed under Article 6 as AI systems, not GPAI models.
What are the penalties if I misclassify or skip the high-risk provider obligations?
Penalty tiers are set in Article 99. Breaching high-risk provider obligations carries up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Prohibited practices under Article 5 carry €35 million or 7% (Article 99(3)), and incorrect or misleading information to authorities €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps it at the lower amount.
Related guides
- provider vs deployer roles explained
- build your AI system inventory
- AWS Bedrock and the EU AI Act
- Azure OpenAI and the EU AI Act
- when you become a GPAI provider
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →