The Deployer-to-Provider Requalification Risk — Law Firms Need to Check Their Vendor Contracts

A compliance risk that DLA Piper's August 6 analysis identifies as underappreciated is the deployer-to-provider requalification trap: when an organisation customises, fine-tunes, retrains, rebrands, or substantially modifies a third-party AI system, it can move from the comparatively lighter deployer regime into the full provider regime, with documentation obligations, conformity assessment, registration duties, and provider-level enforcement exposure. For law firms, the requalification scenarios that apply most immediately are white-labelling a conversational AI under the firm's own name or branding, fine-tuning a commercial model on the firm's own matter files or client data, and embedding a third-party model in a proprietary practice management or document generation tool that the firm sells or licenses to clients. The compliance action is to audit every vendor AI contract for clear allocation of provider and deployer roles, warranties that outputs are marked as artificial under Article 50(2), commitments to provide disclosure functionalities, indemnities for supplier-attributable non-compliance, and audit rights during authority inspections. Law firms that have built custom interfaces on top of OpenAI, Anthropic, or Harvey without clearly documented role allocations are the most immediate candidates for requalification risk assessment.