The parties should document the French product separately from the underlying API and model. They should then connect their legal roles to the records, technical assistance and remedies each party must provide.
Executive Summary
- The French company is the provider of the finished system where it develops or commissions that system and supplies it under its name. Branding alone does not establish every element of that test for an unchanged, non-high-risk product. (AI Act, Art 3(3).)
- A Vietnamese supplier developing and supplying its own general-purpose AI model can remain its model provider. An API does not necessarily contain a general-purpose model; its capabilities determine that classification. (AI Act, Arts 2(1)(a), 3(3), 3(63), 53–54.)
- The July 2026 amendment changes the timetable. Article 25 and the other specified Chapter III provisions apply from 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) product systems. Current transparency and applicable model duties require separate attention. (AI Act, Arts 50, 111 and 113.)
- A contract must secure usable technical evidence, change control and incident cooperation. Article 25 expressly recognises certain contractual allocations, but a reseller label cannot resolve duties arising from the parties’ actual activities. (AI Act, Art 25(1)(a), (2), (4).)
- Personal-data processing and Vietnamese supply requirements can prevent the planned operation even where AI Act roles are settled. Complete the processing, transfer and service-permission checks before enabling the relevant data flow. (Regulation (EU) 2016/679, Arts 28, 44–46; Vietnam Decree No. 356/2025/NĐ-CP, Arts 21–25.)
The French product needs a defined purpose
The launch schedule should identify three objects: the underlying model, the supplier’s hosted API system and the French integrated product. Record who develops each object, whose name accompanies its supply, its version and its first EU market-placement date. An API describes an access method. It does not settle whether the supplied object is a model, an AI system or both. (AI Act, Arts 3(1), 3(3), 3(9)–(11), 3(63), 3(68).)
For the initial product, agree a bounded business-support purpose, such as drafting replies for staff review. Exclude candidate scoring and other unsupported decision uses from the product specification and sales materials. These are proposed launch restrictions, justified by the different compliance work those uses require.
The advertised purpose has legal consequences. Article 3(12) includes promotional statements, sales materials, instructions and technical documentation in the intended-purpose assessment. A contract describing an administrative assistant cannot neutralise sales claims that promise automated hiring recommendations. Product, sales and legal teams should approve the same use description before release. (AI Act, Art 3(12).)
Roles follow the model, API and finished system
The French integration supports provider status where it develops, or has developed, the finished system and places it on the market under its name. Choosing the product’s function, combining the API with workflows and supplying the resulting application are relevant development facts. The company should therefore budget for its own system obligations. A Vietnamese vendor’s compliance statement cannot replace that analysis. (AI Act, Art 3(3), (68).)
The supplier’s model role depends on separate facts. A general-purpose AI model must display significant generality and competently perform a wide range of distinct tasks. If the Vietnamese supplier develops that model and supplies it into the EU under its identity, it remains the model provider. If the French company commissions and markets the model itself, its role needs reassessment. Ownership language and the end product’s branding do not settle who provides the underlying model. (AI Act, Arts 3(3), 3(63), 53.)
The hosted API can itself be an AI system. If the Vietnamese supplier develops and supplies that system into the EU under its own name, it also provides that system. This role is separate from the French company’s role for its integrated product and does not depend on GPAI classification. (AI Act, Arts 2(1)(a), 3(1), (3), (68).)
Importer and distributor have narrower meanings. The French company is an importer where it first places a Vietnamese-branded AI system on the EU market. It is a distributor where it makes a system available without being its provider or importer. These definitions concern AI systems, rather than a freestanding model. The company can hold different roles for different products. It is also a deployer where it actually uses a system under its authority; resale alone does not establish that role. Business customers operating the finished product ordinarily act as deployers. (AI Act, Art 3(4), (6)–(7).)
The dates must be recorded per object. On 29 October 2026, Article 50 already applies to new systems within its scope. Direct interaction requires an AI disclosure unless the statutory obviousness exception applies. Providers of systems generating synthetic content must ensure machine-readable marking and detectability. Technical feasibility qualifies the required technical solutions; it is not a general exemption. Article 50(2) excludes standard editing assistance and systems that do not substantially alter the input or its semantics, subject to its terms. Staff review alone creates no exception. The French provider must ensure compliant final outputs and notices. Preserving supplier markings is one integration measure; a visible chatbot notice performs a separate function. (AI Act, Art 50(1)–(2), (5).)
Chapter V model duties generally applied from 2 August 2025. Models placed on the EU market before that date have until 2 August 2027. The separate marking transition ends on 2 December 2026 for qualifying systems placed before 2 August 2026. Neither date should be inherited from an unrelated model or product release. Providers and deployers also retain the amended duty to support staff AI literacy. The EU market-access guide explains the wider scope and timetable. (AI Act, Arts 4, 111(3)–(4), 113.)
Recruitment and substantial changes require a fresh assessment
The changed product ranks job applicants and materially influences which candidates progress. For a recruitment system first placed on the EU market or put into service on or after 2 December 2027, that purpose engages Annex III, point 4(a), and the applicable high-risk provider requirements. Merely retaining a human final decision does not satisfy Article 6(3)’s limited exclusion. An Annex III system profiling natural persons is always high-risk under that provision. A tool confined to document formatting requires a different assessment. (AI Act, Arts 6(2)–(4), 113(c)(i), Annex III, point 4(a).)
Article 25 has three distinct routes. An operator can acquire high-risk provider duties by branding an existing high-risk system, substantially modifying one that remains high-risk, or changing an existing system’s purpose so it becomes high-risk. The French company may already be the provider of its integrated product under Article 3(3). Article 25 also addresses responsibility when it changes a system previously supplied by another provider. (AI Act, Art 25(1).)
The rebranding route expressly preserves contractual arrangements allocating obligations otherwise. That qualification deserves a specific clause, with identified tasks and responsible entities. It does not appear in the substantial-modification and changed-purpose routes. The parties should not rely on a general statement that the Vietnamese company remains responsible for everything. (AI Act, Art 25(1)(a)–(c).)
A substantial modification requires a post-placement change not foreseen or planned in the initial conformity assessment. It must affect compliance with Chapter III, Section 2 requirements or change the assessed intended purpose. A model replacement, retraining or workflow change must be tested against those elements. Where the test is met, a previously assessed high-risk system requires a new conformity assessment, including for continued use by its existing deployer. Predetermined learning changes documented in the initial assessment have a specific exception. (AI Act, Arts 3(23), 25(1)(b), 43(4).)
Fine-tuning also requires a separate model-role assessment. The Commission’s nonbinding guidance addresses when a significant model modification makes the modifier a GPAI provider. That inquiry differs from substantial modification of the finished system. (Commission Guidelines C(2025) 7719 final, paras 57–66.)
The July 2026 amendment postpones Chapter III, Sections 1–3, except Article 6(5), to the relevant 2027 or 2028 date. It does not postpone every AI Act obligation. Earlier high-risk systems need a separate Article 111(2) assessment of placement and subsequent significant design changes. That transition uses a different test from substantial modification. Preserve evidence of the actual system and release history before relying on it. (AI Act, Arts 111(2), 113(c); Regulation (EU) 2026/1744, Art 1(39)–(40).)
For the recruitment release, the French provider must assemble system-specific risk management, data-quality evidence, technical documentation, logs, instructions and human-oversight controls. It also needs the applicable quality-management and conformity work, declaration, CE marking and registration. Recruitment systems ordinarily follow Annex VI internal control without a notified body. Supplier model testing alone cannot establish compliance of the integrated hiring product. (AI Act, Arts 9–19, 43(2), 47–49, Annexes IV and VI.)
French employers must also address candidate information, confidentiality and recruitment-method relevance, with prior works-council information where the applicable rules require it. GDPR assessment and automated-decision restrictions apply on their own timetable. A prohibited practice must be removed from the intended use; conformity work cannot authorise it. (Code du travail, Arts L1221-8, L2312-38; GDPR, Arts 22, 35–36; AI Act, Art 5.)
The agreement must deliver evidence and operational support
Documentation must reach the entity that needs it
A proprietary GPAI provider subject to Article 53 must maintain the authority-facing Annex XI file and supply downstream system providers with the Annex XII information. It must also maintain the Union copyright policy and publish the required training-content summary. A non-EU provider ordinarily needs a separately mandated EU representative under Article 54. The reseller does not acquire that appointment automatically. Apply the model’s transition before treating these documents as already due. (AI Act, Arts 53–54, 111(3).)
The French company should obtain versioned capabilities, limitations, integration instructions, relevant evaluation results and known failure modes. Article 53 does not give every buyer an unrestricted right to source code, weights or the raw training corpus. Specify additional testing access contractually and protect confidential information while preserving required disclosure. Systemic-risk model status, if established, adds Article 55 evaluation, risk-management, incident and cybersecurity duties. (AI Act, Arts 51–55, Annexes XI–XII.)
For the applicable high-risk branch, amended Article 25(4) requires a written agreement covering necessary information, capabilities, technical access and assistance. Where Article 25(2) applies, the initial system provider must supply relevant documentation, known limitations and targeted testing access. Its role can cease for that specific system, while separate model duties remain. The paragraph contains an exception where that provider clearly excluded conversion to high-risk use. Obtain agreement to the recruitment use before depending on compulsory cooperation. (AI Act, Art 25(2), (4)–(5).)
The responsibility schedule should name the French company as owner of the complete system file, customer instructions and release decision. The supplier should deliver component evidence, investigate defects and support updates. Once the high-risk regime applies, the provider needs post-market monitoring and serious-incident procedures. The contract should require prompt supplier escalation and evidence preservation so statutory reporting deadlines remain achievable. Keep AI incident reporting separate from GDPR breach reporting. (AI Act, Arts 20, 72–73; GDPR, Art 33.)
Personal-data roles and Vietnam access need separate terms
For customer-directed business processing, the customer can be controller, the French company processor and the Vietnamese supplier subprocessor. The required authorisation and Article 28 terms must follow that chain. Each company can separately control account, security or other processing where it determines the purposes and means. Supplier reuse of customer prompts for its own model training requires a new role and lawful-purpose assessment. An AI Act provider is not automatically a GDPR controller. (GDPR, Arts 4(7)–(8), 5–6, 9, 28.)
Vietnam has no EU adequacy decision. Sending personal data to the API, or giving a separate Vietnamese supplier remote access to EU-hosted records, requires a valid Chapter V route. The 2021 standard contractual clauses can support appropriate transfers, with the module chosen for the actual parties. Their scope excludes importer processing already directly subject to the GDPR. The parties must assess destination-country laws and practices and any necessary supplementary safeguards. Suspend the transfer where compliant safeguards cannot be maintained. (GDPR, Arts 3, 44–46; Commission Implementing Decision (EU) 2021/914, Art 1 and Annex, clauses 14–16; EDPB Guidelines 05/2021, version 2.0, example 11.)
EU hosting reduces transfers only if the actual support and inference arrangements prevent the relevant overseas access. Specify processing locations, authorised subprocessors, permitted support access, retention and deletion. For recruitment, the employer must address any required data-protection impact assessment and the Article 22 conditions for solely automated significant decisions. Human review must work in the decision process. (GDPR, Arts 22, 25, 28, 32, 35–36.)
Vietnamese supply conditions must be cleared separately
Vietnam’s AI Law No. 134/2025/QH15 has applied since 1 March 2026. The supplier must assess its Vietnamese activities and actual system under that law and Decree No. 142/2026/NĐ-CP. A standalone model and a hosted AI system require different classification treatment. Medium-risk interaction systems can trigger documentation, notification and transparency duties. Vietnam’s high-risk list requires a separate assessment; EU recruitment classification does not establish the local result. Record any applicable transition under AI Law Article 35 and Decision No. 33/2026/QĐ-TTg, Article 4. French branding does not remove obligations arising from development or operation in Vietnam. (Law No. 134/2025/QH15, Arts 1–3, 10–15; Decree No. 142/2026/NĐ-CP, Arts 6, 8–9, 11–14.)
Personal-data processing creates a separate launch condition. Vietnam’s Personal Data Protection Law and Decree 356 apply from 1 January 2026. The decree’s service categories include automated personal-data processing using AI and operating automated systems for a controller. A supplier performing that covered business must meet the applicable service conditions and obtain the required certificate. The parties also need the processing contract and applicable impact-assessment and transfer filings. A GDPR contract does not supply the Vietnamese certificate. For filings from 15 November 2026, account for Decree 392’s procedural changes and its transition for already-received dossiers. These changes do not remove the personal-data service conditions. (Law No. 91/2025/QH15, Arts 20–22, 37; Decree No. 356/2025/NĐ-CP, Arts 17–25; Decree No. 392/2026/NĐ-CP, Arts 42–49.)
The supplier should classify any core or important data and identify outward transfers. Core or important personal data follow the personal-data assessment route under Decree 356, Article 42(3). Reconcile retention and access promises with the actual cybersecurity requirements; Vietnamese localisation rules do not cover every French customer’s data automatically. Check the separate pre-activity notice for a covered data-analysis service. (Law No. 60/2024/QH15, Art 23; Law No. 116/2025/QH15, Art 25; Decree No. 333/2026/NĐ-CP, Arts 16, 19–20; Decree No. 169/2025/NĐ-CP, Art 31(5), as amended by Decree No. 347/2026/NĐ-CP.)
If delivery expands into technology rights or know-how, assess technology-transfer registration and restrictions separately. Pure hosted access and a transfer enabling the French buyer to operate the technology can produce different results. (Law No. 07/2017/QH14, as amended by Law No. 115/2025/QH15, Arts 2, 4, 24, 31; Decree No. 101/2026/NĐ-CP.)
Customer remedies need an enforceable supplier recourse
Negotiate warranties tied to the identified release, permitted uses, rights and evidence. Allocate losses caused by supplier defects or inaccurate records, and separately address unauthorised French use changes or sales claims. The agreement needs claim notification, defence control, settlement consent, repair or replacement, and an exit where lawful performance cannot continue. These are proposed commercial protections; their scope and liability limits require agreement.
An upstream indemnity does not extinguish customer rights. French-law contracts can expose the reseller to damages for non-performance. A clause stripping an essential obligation of substance can be ineffective. Consumer digital-service sales bring additional conformity duties if that customer category is admitted. GDPR compensation and contribution follow Article 82’s responsibility conditions. The financial allocation must therefore support the French company’s customer promises and preserve mandatory rights. (Code civil, Arts 1170, 1231–1231-1; Code de la consommation, Art L224-25-12; GDPR, Art 82.)
If the API or French hosted product qualifies as a data-processing service, the EU Data Act adds switching and exit requirements. Its provider must reflect the applicable rights in the contract. Check the partial custom-built-service exception and separate non-production testing exclusion. Covered switching charges are limited to directly incurred switching costs before 12 January 2027 and prohibited from that date. Their statutory definition excludes standard service fees and early-termination penalties. (Regulation (EU) 2023/2854, Arts 1(3)(f), 2(8), 2(36), 23–31 and 50.)
Launch with a defined use and a documented release decision
The recommended initial structure is a French-provided business-support product using a specified Vietnamese API release. The contract should make these steps conditions of production access:
- Both parties sign the product-layer and intended-purpose schedule, including excluded uses and the relevant release dates.
- The supplier delivers the applicable model information, permitted-use rights and evidence supporting its Vietnamese service and data obligations.
- The French company completes its interface disclosures, output-marking integration, staff instructions and customer terms.
- The parties approve the actual processing chain and transfer safeguards before personal data becomes accessible in Vietnam.
- Both parties agree change approval, incident escalation, suspension, record preservation and migration assistance.
Open the recruitment branch only after a separate purpose, supplier-support and high-risk readiness decision for its applicable date. If necessary evidence or lawful data access cannot be secured, retain the narrower product, change the affected component or suspend that use. A commercial launch date cannot cure the missing condition.
Map reseller roles and documentation with Licentium. Scope a review of the product layers, intended uses and evidence gaps, with an obligation map identifying the documents needed for the proposed French launch.