Who Is the Provider When the Deployer Rebrands and Reconfigures a Hiring Model?

The decisive test is not what the contract calls Northwind; it is who places the system on the market or puts it into service under its own name or trademark, and whether Northwind makes a substantial modification. Northwind’s brand appears on the candidate portal and offer letters, which points toward provider status. Adjusting vendor-supplied weighting sliders is usually configuration; uploading its own interview notes and adding a separate culture-fit scoring layer changes the system’s behaviour and risk profile and may be a substantial modification. If it is, Northwind becomes a provider of a modified high-risk system and must satisfy provider duties: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, conformity assessment, CE marking and registration. If Northwind only uses default settings and the vendor brand remains, it is more likely a deployer, with duties to use per instructions, assign competent human oversight, monitor, keep logs, inform affected workers and, where applicable, conduct a fundamental rights impact assessment. Because the facts are borderline, the compliance lead should document the modification analysis, the intended purpose and the contractual allocation. The answer would change if the culture-fit layer were purely cosmetic, if Northwind had no branding, or if the vendor retained control of configuration.

Even a valid CE mark for TalentRank 3.1 does not automatically cover Northwind’s deployment. A CE mark and EU declaration of conformity attach to the system as the provider placed it on the market, including the intended purpose and instructions for use. They do not certify Northwind’s own data, its culture-fit layer, its candidate communications, or its actual use in 14 roles. If Northwind is a deployer, its obligations are independent: use the system in accordance with instructions, assign human oversight with authority to override, ensure input data are relevant and sufficiently representative, monitor for risks, keep automatically generated logs for the required period, inform workers and candidates as required, and cooperate with authorities. If Northwind’s configuration falls outside the provider’s stated intended purpose, the provider’s assessment may no longer be valid. Contractual assurances also do not transfer regulatory responsibility to the vendor. The practical file should therefore include a role determination memo, the vendor’s instructions for use, a gap analysis against deployer duties, a human-oversight procedure, and evidence that the culture-fit layer was tested for bias and accuracy. The vendor’s refusal to share weights is a limitation, but it does not remove Northwind’s own obligations.

Use a five-step decision rule. Step 1: record the intended purpose and deployment context, including the 14 roles and the EU launch date. Step 2: determine whether Northwind puts the system into service under its own name or trademark. Step 3: apply a substantial-modification test to the culture-fit layer and own-data training: does it change intended purpose, performance, or risk? Step 4: if provider status is triggered, list provider obligations and stop the launch until conformity assessment, technical documentation, and registration are planned; if deployer only, complete the deployer checklist. Step 5: escalate borderline cases to the AI governance committee with a written rationale, not an email. The rule should require evidence, not assertions: screenshots of branding, configuration logs, data-flow diagram, vendor contract clauses, and test results. It should also set a default: where the facts are unclear and the system is high-risk, treat Northwind as a provider until proven otherwise, because the cost of under-classification is higher than a two-week delay. The decision should be reviewed if the vendor changes version 3.1 or if Northwind expands to new roles.