Does every LLM provider fall under the Data Act?

Scope depends on the service facts and the Article 2 definition of a data processing service. Hosted services offering on-demand network access to shared configurable computing resources may qualify. Article 31 then changes the Chapter VI treatment for specified custom-built and temporary non-production services. The European Commission's Data Act overview describes switching between data processing providers as one of the regulation's main measures. Service-specific conclusions belong with counsel.

Does the Data Act require portable model weights?

The Act's switching chapter covers exportable data and digital assets under its definitions and contract requirements. Article 30 also protects provider intellectual property, trade secrets, security and service integrity. The correct answer depends on ownership, contract terms and the nature of the artifact. Customers should list model weights, adapters, fine-tuning datasets and evaluation material separately rather than treating "the model" as one portable object.

EU Data Act LLM Requirements for Hosted Inference and AI Platforms

A hosted LLM endpoint can sit inside the EU Data Act as a data processing service. That classification brings requirements around switching, contracts, exportable data, interfaces and international governmental access. It does not turn the Data Act into a model-safety law. The obligations attach to the service relationship and the data around the model call.

Regulation (EU) 2023/2854 has applied since 12 September 2025. I want to separate the requirements a hosted inference provider may owe from the controls an enterprise customer needs to preserve its own position.

TL;DR

Classify each hosted inference, vector, fine-tuning and observability service against the Act's data processing service definition.
Chapter VI requires switching terms, provider information, removal of obstacles and technical portability according to the service category.
From 12 January 2027, providers may impose no switching charges on customers.
Article 32 concerns conflicting third-country governmental access to non-personal data held in the Union. It is narrower than a universal EU-only routing rule.

The service classification sets the requirement set

Article 2 defines a data processing service as a digital service supplied to a customer that provides on-demand network access to a shared pool of configurable, scalable and elastic computing resources. Infrastructure, platform and software delivery models can fall within that language. A hosted LLM API, managed embedding store or fine-tuning platform may qualify on its facts.

Write the classification at service level. A company can run an LLM application using several providers with different roles. One provides inference, another stores vectors, and a third records evaluations. The customer-side application can also become a provider when it offers a hosted AI service to its own customers.

Article 31 narrows Chapter VI for certain custom-built services and excludes non-production services provided for testing and evaluation for a limited period. The provider must tell the prospective customer which Chapter VI obligations are inapplicable before contract formation. Counsel should confirm the result. A product name containing "AI" decides nothing.

Article 23 requires an exit path

Article 23 directs data processing providers to apply the measures in Articles 25, 26, 27, 29 and 30 so customers can change services, move to on-premises infrastructure or, where relevant, use several services at once. Listed commercial, technical, contractual and organisational obstacles that inhibit those outcomes must be removed.

For an LLM service, the exit path starts with a manifest. Identify prompt and completion history, uploaded files, embeddings, evaluation sets, fine-tuning artifacts, policy configuration, tool definitions and audit records. Then mark which items count as exportable data or digital assets under the contract.

The requirement concerns the service and its data. It creates no promise that another model will produce identical tokens, latency or quality. Functional behaviour can vary after a switch even when every portable artifact arrives intact. The Data Act compliance checklist gives procurement and engineering owners a practical test sequence.

Article 25 turns portability into contract text

Article 25 requires switching rights and provider obligations to appear clearly in a written contract available before signature. The contract must cover the switching route, assistance, continuity, security, notice, portable categories, exemptions, retrieval, erasure and any allowed charges.

Several numbers deserve a line in the implementation plan. The maximum notice period for starting a switch is two months. The ordinary mandatory maximum transitional period is 30 calendar days. If that period is technically infeasible, the provider has 14 working days after the request to notify the customer, justify the problem and identify an alternative period capped at seven months. A minimum retrieval period of 30 calendar days follows the agreed transition.

Those dates require product capabilities. The provider needs request intake, export generation, status tracking, customer notification, controlled retrieval and verified erasure. A clause copied into a contract at 11:55 p.m. creates work for several systems the next morning.

Article 26 requires usable provider information

Article 26 requires the provider to explain available switching and porting procedures, methods, formats, restrictions and known technical limitations. It also requires a reference to an up-to-date online register. That register details the structures and formats used for exportable data alongside relevant standards and open interoperability specifications.

For LLM platforms, generic language about "standard formats" is weak implementation. Name the format per artifact. Publish schema versions for conversation records, evaluation results and audit events. Explain how model-specific tool calls, safety settings and fine-tuning references appear in the export. Document identifiers and timestamp semantics.

Customers should capture that register at contract signature and review it after material service changes. The Data Act audit-evidence guide describes the export manifest, rehearsal result and decision-record sample that make the provider statement testable.

Article 30 sets technical switching duties

Article 30 separates infrastructure-only services from other data processing services. Infrastructure providers must take reasonable measures so a customer switching to a service of the same type achieves functional equivalence, and must provide information, documentation, support and suitable tools.

Other providers must make open interfaces available free of charge to customers and destination providers to facilitate switching. The interfaces need enough information for software to communicate with the service for portability and interoperability. Where applicable common specifications or harmonised standards have yet to be published in the central Union repository, a customer can request all exportable data in a structured, commonly used and machine-readable format.

For a hosted LLM platform, test the interface with a real export and importer. A 4 GB archive of JSONL files on a laptop is concrete delivery. The stronger test is rebuilding caller, destination, policy and decision history in a neutral store without proprietary lookups. The Data Act controls mapping maps that test to the relevant evidence.

Switching charges reach zero in 2027

Article 29 phases out switching charges. From 12 January 2027, providers of data processing services may impose no switching charges on customers for the switching process. Before that date, reduced charges may cover only costs directly linked to the switch.

The rule affects pricing design and instrumentation. Providers need to distinguish ordinary service fees, early termination penalties and switching charges, then give prospective customers clear information before contract formation. Services involving highly complex or costly switching, or a switch that would significantly interfere with data, digital assets or service architecture, require relevant customer information.

My opinion is straightforward: an LLM provider that cannot itemise a switching charge probably cannot defend it. Finance needs the cost record, while engineering needs a workflow that will still operate when the charge reaches zero.

Article 32 covers non-personal data and government access

Article 32 requires providers to take adequate technical, organisational and legal measures, including contracts, against third-country governmental access to or transfer of non-personal data held in the Union where compliance would conflict with Union or member-state law. The article sets conditions for third-country decisions, requires the minimum permissible disclosure when its conditions are met and ordinarily requires customer notice before compliance.

An LLM platform may hold non-personal source code, manufacturing parameters, pricing plans and prompt logs in the Union. The provider needs a request-review process, legal escalation, data minimisation and customer notice procedure. The enterprise customer needs accurate provider identity, data location and access terms.

Runtime routing adds another evidence problem. A configured region shows intended placement, while an independent request record names the endpoint actually called. AI data residency controls covers region-scoped enforcement without recasting Article 32 as a blanket localisation rule.

Customer requirements preserve optionality

A customer can turn the statutory provider duties into acceptance criteria:

Maintain a current component register with the classification and contract for each service.
Define exportable data and digital assets before signing, including policy and audit material.
Run a sample export into a neutral store and record fields that lose meaning.
Test continuity, security, retrieval and erasure during a switching rehearsal.
Keep an independent record of authenticated LLM traffic so provider replacement does not erase operational history.

Model quality evaluation remains part of the migration plan because outputs can change. AI risk classification, accuracy, transparency and prohibited practices belong under the EU AI Act and other applicable regimes. The Data Act work here concerns access, switching and the service relationship.

DeepInspect

DeepInspect operates on authenticated HTTP traffic deliberately routed between users or agents and LLM endpoints. It uses identity and policy context supplied by the application, inspects prompt and response content, applies per-role and per-route policy, records the selected model destination, and writes a per-decision audit record outside the calling application.

That independent record can survive a model-provider switch and export in a documented format, giving the customer continuity for caller, route, policy and decision history. It also provides request-level destination evidence for an Article 32 assessment. DeepInspect leaves provider contracts, switching assistance, model-weight portability, fine-tuning exports, legal review of government requests, local execution, STDIO and bypass traffic with the teams and systems that own them.

Book a technical deep dive at deepinspect.ai.