EU AI Act: provider or deployer?
The question most companies ask about the EU AI Act is which parts of it apply to them. The answer starts not with the technology but with the role: the same system creates different obligations for the company that built it and the company that uses it.
In short
A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses an AI system under its own authority in a professional context. Most companies are deployers of many systems and providers of a few. A deployer becomes a provider in three cases: it puts its own name or trademark on a high-risk system, makes a substantial modification after which the system remains high-risk, or changes the intended purpose so that the system becomes high-risk. Deployers of high-risk systems have their own list of duties: use the system according to instructions, ensure human oversight by competent people, monitor it, retain logs, and inform workers and affected people.
The roles
| Role | Who it is | Where defined |
|---|
| Provider | Develops an AI system or general-purpose model, or has it developed, and places it on the market or puts it into service under its own name or trademark | Article 3(3) |
| Deployer | Uses an AI system under its authority, except in a personal, non-professional activity | Article 3(4) |
| Importer | Established in the EU and places on the market a system bearing the name of a provider established outside the EU | Article 3(6) |
| Distributor | Makes a system available on the EU market, other than the provider or importer | Article 3(7) |
Definitions are in Article 3. One company can hold different roles for different systems, and often does.
When a deployer becomes a provider
Article 25 lists three situations in which a deployer, importer, distributor or other third party is treated as the provider of a high-risk system and assumes the provider's obligations:
- It puts its name or trademark on a high-risk AI system that is already on the market.
- It makes a substantial modification to a high-risk system so that it remains high-risk.
- It changes the intended purpose of an AI system, including a general-purpose one, so that the system becomes high-risk.
The third case catches companies by surprise. A general-purpose model used for drafting emails is not high-risk. The same model wired into a hiring or credit decision may be, and the company that wired it may now be the provider.
What a deployer of a high-risk system must do
The duties of deployers are set out in Article 26. In practice:
| Duty | What it means operationally |
|---|
| Use according to the provider's instructions | Keep the instructions and train the people who use the system on them |
| Human oversight by competent people | Designated people with the competence, training and authority to oversee and stop the system |
| Relevant input data | Where you control the input data, make sure it fits the intended purpose |
| Monitoring | Monitor how the system works; if there is a risk or serious incident, inform the provider and the authority, and suspend use |
| Log retention | Keep the logs the system generates, under your control, for at least six months unless other law says otherwise |
| Inform workers | Before using a high-risk system in the workplace, inform workers and their representatives |
| Inform affected people | Where the system makes or helps make decisions about people, inform them |
| Cooperate with authorities | Provide information and access when requested |
Some deployers, notably public bodies and certain private providers of public services, must also carry out a fundamental rights impact assessment under Article 27.
Duties that apply to almost everyone
- AI literacy (Article 4): providers and deployers must take measures to ensure that their staff dealing with AI systems have a sufficient understanding of them.
- Transparency (Article 50): people must be told when they are interacting with an AI system, and certain generated content must be marked. Some of these duties fall on providers, some on deployers.
- Prohibited practices: certain uses are banned outright, regardless of your role.
The Act applies in stages, and the dates for some obligations have been amended. Before relying on any date, check the current consolidated text.
How to establish your role in practice
- List the AI systems you build and the ones you use, including features in software you buy.
- For each one, write down whose name it carries on the market and who decided its purpose.
- Check whether any use falls within a high-risk area. If so, check the three provider triggers.
- Assign the duties by role and system, and give each duty an owner.
This exercise is also the first step in any governance program, whether under the AI Act or a standard such as ISO/IEC 42001.
Frequently asked questions
What is the difference between a provider and a deployer under the EU AI Act?
A provider develops an AI system, or has it developed, and places it on the market under its own name. A deployer uses an AI system under its own authority in a professional context. The obligations differ substantially between the two roles.
Can a deployer become a provider?
Yes. Under Article 25, a deployer becomes the provider of a high-risk system if it puts its name or trademark on it, substantially modifies it so that it remains high-risk, or changes the purpose of a system so that it becomes high-risk.
What must a deployer of a high-risk AI system do?
Use it according to the instructions, assign human oversight to competent people, ensure relevant input data where it controls it, monitor the system, keep its logs for at least six months, inform workers and affected people, and cooperate with authorities.
Does the EU AI Act apply to companies outside the EU?
It can. It applies to providers placing systems on the EU market and to deployers in the EU. It also applies where the output of a system is used in the EU, regardless of where the company is based.
Is AI literacy a legal requirement?
Article 4 requires providers and deployers to take measures to ensure the AI literacy of staff dealing with AI systems. It applies regardless of the system's risk class.