Short answer. Fine-tuning takes a pretrained language model and continues training it on a smaller, domain-specific dataset so it adopts your terminology, format, and behavior. It changes the model’s weights, unlike prompting or retrieval, which leave the model untouched. For a regulated business, one line matters most: fine-tuning a general-purpose AI model on more than one-third of its original training compute can make you its legal provider under the EU AI Act, with the compliance duties that follow.
A pretrained model such as an open-weight LLM already knows general language. Fine-tuning adds a second, shorter training stage on your own examples, so the model internalizes a task rather than being told about it at query time. The result is a new set of weights that reflects your data. This is different from writing a longer prompt or attaching documents, because the knowledge and behavior are baked into the model itself.
There are two broad approaches. Full fine-tuning updates every parameter in the model, which is expensive and hardware-heavy. Parameter-efficient fine-tuning updates only a small added set of weights and leaves the original model frozen, cutting cost and memory by a large margin. Most enterprise teams use the second approach because it is cheaper to run and easier to govern.
Teams reach for fine-tuning when they need consistent tone, a fixed output format, or fluency in specialist vocabulary that a base model handles poorly. Typical uses include:
Fine-tuning is common in production AI work. Across Ableneo’s 2025 portfolio, 94% of projects use LLMs, and choosing whether to fine-tune, retrieve, or prompt is one of the first architecture decisions on each of them.
In financial services and insurance, a fine-tuned model is not just an engineering artifact. It is a regulated asset. The dataset you train on may contain personal or confidential data, the resulting weights may memorize some of it, and the act of fine-tuning can shift your legal role under the EU AI Act. Since 2 August 2025, providers of general-purpose AI models carry specific obligations under the Act, including technical documentation and a summary of training content. A bank that fine-tunes such a model needs to know whether it has stepped into that provider role.
DORA adds a second layer. If the base model or the fine-tuning platform comes from a third party, the arrangement falls under ICT third-party risk management, with contractual and monitoring duties. Fine-tuning on customer data also raises GDPR questions about lawful basis, purpose limitation, and the right to erasure, because deleting a record from a training set does not remove what the model already learned from it.
Fine-tuning changes a model’s weights to lock in behavior, format, and vocabulary, unlike prompting or retrieval, which leave the model unchanged.
Fine-tuning changes the model’s weights so behavior and knowledge are stored inside the network. Retrieval-augmented generation leaves the model unchanged and instead fetches relevant documents at query time, placing them in the prompt so the model reasons over current, source-linked content. The practical split is clean: fine-tuning teaches the model how to behave, retrieval tells it what is true right now.
For facts that change often, such as prices, policies, or regulations, RAG wins because you update a knowledge base instead of retraining. For fixed behavior, format, and tone, fine-tuning wins because the model applies the pattern without being reminded. Many production systems combine both: a lightly fine-tuned model for style and structure, wrapped in a retrieval layer for live facts.
Start with the cheapest option and escalate only when it fails. Prompting is free to change and needs no training. Retrieval handles knowledge that must stay current and auditable. Reach for fine-tuning when prompting and retrieval cannot hold a consistent format, when latency or cost from long prompts becomes a problem, or when the model must speak a specialist dialect it keeps getting wrong.
Fine-tuning carries costs the other two avoid: a labeled dataset, training infrastructure, evaluation, and a new model version to govern and re-approve whenever the base model changes. In a regulated setting, treat every fine-tuned model as a versioned, documented artifact with an owner, not a one-off experiment.
It can. Article 25 sets out responsibilities along the AI value chain, and a party that substantially modifies a system or model can take on provider obligations. For general-purpose AI models, the European Commission’s 2025 guidelines give an indicative threshold: you become a provider when your fine-tuning uses more than one-third of the original model’s training compute, or, if that figure is unknown, more than 3.33 x 10^22 FLOP.
Most enterprise fine-tuning sits well below that line, so a typical bank adapting an open model for tone or format does not usually become the model’s provider. The obligation, when it applies, attaches only to the modification, not the whole original model. The point for a compliance team is to measure and document the training compute used, so the classification is a recorded fact rather than an assumption.
Fine-tuning on records that contain personal data can cause the model to memorize parts of it. Research shows that models trained on structured pairs, such as names and email addresses, can later reproduce them, which turns a training convenience into a privacy exposure. Under GDPR, that raises questions of lawful basis and data minimization before training even starts.
The harder problem is erasure. Removing a customer’s record from the source dataset does not unlearn what the model already absorbed, so a deletion request cannot be satisfied by deleting a row. Sound practice is to minimize and pseudonymize training data, restrict who can query the fine-tuned model, and keep the ability to retrain a clean version. Treat the fine-tuned weights themselves as data that can carry personal information.
Parameter-efficient fine-tuning, or PEFT, freezes the original model and trains only a small set of added weights. LoRA, the most common method, inserts low-rank matrices into the model and trains those, which cuts compute and storage sharply while keeping most of the model’s general ability intact.
PEFT also reduces catastrophic forgetting, the effect where fine-tuning on a narrow task degrades the model’s broader skills. Full fine-tuning updates every weight and tends to forget more; LoRA updates far fewer and forgets less, though research confirms it does not remove the effect entirely. For regulated teams, PEFT has a governance benefit too: the small adapter weights are easy to version, swap, and roll back without touching the base model.
Fine-tuning is a tool, not a default. Ableneo shipped 34 production AI projects in 2025 with roughly 4 of 5 reaching production, and on most of them the right answer was retrieval or disciplined prompting, with fine-tuning reserved for cases where consistent behavior justified the training and governance cost. That judgment is where value is won or lost. We treat every fine-tuned model in a regulated environment as a documented, versioned asset with a clear owner, a measured training-compute figure, and a privacy assessment on its data. For the retrieval side of the same decision, see our explainer on retrieval-augmented generation.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.