Are you a provider or deployer under the AI Act?

Whether you are a provider or deployer under the EU AI Act decides which obligations fall on you, and the answer is given per AI system, not per company. One business can be the provider of its own product and a deployer of the tools it uses. The Commission’s AI Act overview summarises the differences.

The five roles in the AI Act

Legal requirement (EU AI Act, Art. 3). The AI Act defines these roles:

• Provider: develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. Putting into service includes supply for own use (Art. 3(11)): a company that builds a system just for internal use is its provider.
• Deployer: uses an AI system under its authority in a professional capacity.
• Importer: is established in the EU and places on the EU market an AI system bearing the name or trademark of a company established outside the EU.
• Distributor: makes an AI system available on the EU market without being its provider or importer, for example a reseller.
• Authorised representative: is established in the EU and acts under a written mandate from a provider outside the EU.

The law has no “integrator” role: a company that builds AI into its product or process is usually the provider of the resulting system, a deployer of someone else’s, or both.

When a deployer becomes a provider

Legal requirement (EU AI Act, Art. 25). A deployer, distributor, importer or other party becomes the provider of a high-risk AI system if it:

• puts its name or trademark on a high-risk system already on the market;
• makes a substantial modification to a high-risk system, so that it remains high-risk; or
• changes the intended purpose of a system that was not high-risk, so that it becomes high-risk.

Intended purpose covers the use, context and conditions specified by the provider across its instructions, technical documents, advertising, sales materials and statements (Art. 3(12)). In practice, how a product is described on a website and in sales can matter for its legal purpose. The high-risk provider obligations in Chapter III apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I Section A products; Section B products follow the sector route in Art. 2(2). The full timeline is in what the EU AI Act requires.

Hypothetical example: a company reconfigures a licensed text-analysis tool to score job applicants. Recruitment is a high-risk use under Annex III, so the company may now be that system’s provider.

Substantial modifications can build up through retraining or new features, so reassess a system when it changes (see monitoring AI after launch).

Models and systems are different things

Legal requirement (EU AI Act, Art. 3 and 53). A general-purpose AI (GPAI) model, such as a large language model, is not the same as an AI system built on it. A company that develops a GPAI model is its provider when it places the model on the market, with obligations including a copyright policy (Art. 53). A company that builds a chatbot on that model and offers it under its own name is the chatbot’s provider.

Decision tree: provider or deployer?

Recommendation. Answer these for one AI system at a time:

1. Did you develop the system, or have it developed, and place it on the market or put it into service under your own name or trademark, including for your own use? Yes: you are its provider; go to question 3. No: go to question 2.
2. Have you put your name on a high-risk system, substantially modified one, or changed a system’s purpose so that it became high-risk? Yes: you become its provider under Art. 25. Either way, go to question 3.
3. Do you use the system under your authority in your work? Yes: you are a deployer, as well as any role above. If you are not the provider, go to question 4.
4. Are you an EU company placing on the EU market a system under a non-EU company’s name? Yes: you are the importer. No: go to question 5.
5. Do you make the system available in the EU without being its provider or importer? Yes: you are a distributor.

If a vendor is involved, ask which role it claims (see questions to ask an AI vendor).

Next step: use the decision tree to fill in the company-role field for each entry in your AI inventory.

Sources and further reading

• Regulation (EU) 2024/1689 (AI Act) — Articles 2, 3, 25 and 53, and Annexes I and III
• EU AI Act Service Desk — Article 3
• European Commission — AI Act overview

This article is for general information and is not legal advice.