In brief
- The EU AI Act imposes obligations on providers and deployers of AI systems in the EU, with the requirements differing depending on the role of the relevant business, and the type of AI system involved.
- Businesses applying their trade mark to someone else's AI system may find that, by doing so, they become a provider, as opposed to deployer, thereby making them responsible for more onerous compliance and regulatory obligations. You need to know what you're signing up to before you apply your brand.
- Particularly significant compliance obligations relate to AI systems designated as "high-risk". Understanding where the relevant AI system sits can save expensive regulatory issues down the line.
- Protect your brand before you launch. Make sure your trade mark is registered where it matters, your contracts are watertight, and there is clear recourse if things go wrong.
Why would a business wish to white-label a third-party AI system?
Businesses wishing to offer AI-powered products or services under their own brand face two choices: developing an AI system in-house, which requires both expertise and investment that may not be readily available, or white-labelling an existing third-party AI system. While white-labelling offers a faster route to market, businesses considering this option where the relevant AI system or its outputs will be used in the EU, may be caught by regulatory obligations under the EU AI Act.
Consider the following scenario: a financial services firm does not have in-house AI development capabilities but wants to offer an AI-powered credit scoring tool to businesses in the EU that can be used to assess the creditworthiness of individuals applying for financial products. The firm sources a pre-existing AI credit assessment system that has already been put into service or made available in the EU, and agrees with the third-party provider that the financial services business may use its own 'wrapper' by branding the AI system with its own logo.
From a marketing perspective, this presents a seamless, professionally branded offering with immediate functionality. However, from a regulatory perspective under the EU AI Act, this seemingly straightforward business arrangement could trigger a fundamental shift in legal responsibility that may jeopardise the commercial viability of this arrangement.
What are the regulatory consequences of applying a trade mark to a third-party AI system?
The EU AI Act classifies systems by risk and applies to anyone offering AI systems, or their outputs, for use in the EU. Primary obligations under the Act fall upon a 'provider' (the entity that puts an AI system on the market under its own brand) while less stringent obligations fall upon other entities, including 'deployers', who use AI systems developed by others as part of their business. We discuss the differentiation between providers and deployers of AI systems in this article.
Under Article 25 of the Act, a deployer who puts their name or trade mark on a high-risk AI system is treated as the 'provider' of that system (with the original provider no longer being considered a provider of that specific AI system), thereby assuming full regulatory responsibility even if any customisation work needed to implement the rebranding was carried out by the original provider. These regulatory obligations are no small task, as they entail managing the entire lifecycle of the AI system and include ensuring compliance with technical standards, implementing a quality management system with post-market monitoring and incident reporting, maintaining comprehensive technical documentation, completing conformity assessments, and obtaining CE marking. Non-compliance with these obligations may result in fines of up to the higher of €15,000,000 or 3% of total worldwide annual turnover, corrective action orders, or withdrawal of the AI system from the market.
Even if the deployer attempts to reallocate these responsibilities in its contract with the original provider, it will remain liable under the Act for those obligations.
However, the reallocation of responsibility under the Act only applies in respect of high-risk AI systems. Examples of such high-risk AI systems include those that constitute a safety component of a regulated product and those whose use cases fall within categories specified in the Act (for instance, biometric identification systems and AI systems used to select candidates in recruitment rounds and to determine access to education and training).
To mitigate risk, businesses considering white-labelling should implement internal AI governance processes to ensure they only add their brand to AI systems that are clearly not high-risk. The narrow exemption under Article 6(3) of the EU AI Act may also be helpful, as certain systems which would otherwise be classified as high-risk can, in limited circumstances, be treated as non-high-risk – for example, where the system performs only a narrow procedural or preparatory task that does not materially influence decision-making outcomes. Documenting these classification assessments will also be essential, both to demonstrate compliance and to provide evidence if the conclusion is later challenged by regulators.
How can trade marks be best protected when white-labelling AI systems?
There are also several trade mark considerations to bear in mind when white-labelling AI systems.
First, the brand owner should review its current trade mark portfolio (which may only cover its core goods and services) to ascertain whether it may need to be extended to cover the use of its marks in relation to the AI system. This should also include considering where the AI system will be marketed, and ensuring that the relevant trade marks have been cleared for use and registered in relation to the AI system in those territories before deployment.
Second, it may be necessary to grant the original provider of the AI system a licence to apply the brand owner's trade marks to the AI system, for example in the user interface. It is important to ensure that such a licence is sufficiently limited, so that it only permits the application of the licensed marks to the AI system in accordance with agreed parameters and the brand owner's instructions, and does not permit any other use of the marks, for example in marketing. If the brand owner is willing to allow any other use of its trade marks, this should be expressly addressed in the licence.
Finally, it's worth considering what contractual safeguards are put in place with the original provider of the AI system in respect of operation of the system if the system goes wrong or causes harm to any third parties, and to mitigate any risk of the brand owner exposing itself to primary liability in respect of intellectual property infringement as a result of the deployment.
Key takeaway
White-labelling an AI system might feel like a simple branding exercise, but placing your business's logo on third-party technology could drastically increase your compliance burden without careful prior analysis. Before putting your name on an AI system for use in the EU, make sure you know what that name commits you to. Consider the potential impact to your brand and reputation before applying your trade mark to a third-party AI system, and make sure you have taken all necessary steps (including contractual safeguards with the original provider) to avoid inadvertent infringement or breach.
How Mishcon de Reya can help
Our AI and Brands teams advise businesses on all aspects of AI regulatory compliance and trade mark strategy, including the obligations imposed by the EU AI Act on providers and deployers of AI systems. For further insights and practical guidance, please visit our AI resource centre. If you have any questions about AI compliance or brand protection, please contact our Artificial Intelligence and Brands teams.