Under the EU AI Act, the same AI system can create very different obligations for different companies. What matters is your role. The two roles that matter most are provider and deployer, and getting this wrong means either over-engineering compliance or missing obligations entirely.
The definitions in plain English
Provider: the organisation that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether paid or free.
Deployer: the organisation that uses an AI system under its authority in a professional context. Purely personal, non-professional use doesn’t count.
Put simply: the provider makes it and puts its name on it. The deployer uses it at work.
Examples
- A software company builds a CV-screening tool and sells it to employers. Software company = provider. Employers = deployers.
- A bank uses that tool to shortlist applicants. The bank is a deployer.
- A retailer adds a chatbot from a vendor to its website. Vendor = provider. Retailer = deployer.
- A start-up builds a product on top of a large language model from a big AI lab and sells it under its own brand. The start-up is the provider of its AI system. The lab is the provider of the general-purpose AI model underneath.
- A company builds an internal AI tool for its own staff. It’s both the provider and the deployer, because putting a system into service for your own use counts.
When a deployer becomes a provider
This catches many companies out. Under Article 25, a deployer, importer or distributor is treated as the provider of a high-risk system if it:
- Puts its own name or trademark on a high-risk AI system already on the market,
- Makes a substantial modification to a high-risk system so it stays high risk, or
- Changes the intended purpose of an AI system, including a general-purpose one, so that it becomes high risk. For example, a general chatbot repurposed to rank job candidates.
When that happens, you inherit the full provider obligations.
What each role must do (high-risk systems)
Provider obligations, in brief
- A risk management system across the whole lifecycle
- Data governance for training, validation and test data
- Technical documentation and automatic logging
- Instructions for use and transparency for deployers
- Designed-in human oversight
- Accuracy, robustness and cybersecurity
- A quality management system, a conformity assessment, CE marking and registration in the EU database
- Post-market monitoring and serious incident reporting
Deployer obligations, in brief
- Use the system according to the provider’s instructions
- Assign human oversight to people with the competence, training and authority to do it
- Make sure input data you control is relevant and representative
- Monitor operation and report risks and serious incidents
- Keep automatically generated logs for at least six months, unless other law says otherwise
- Inform workers and their representatives before using high-risk AI at work
- Inform people when high-risk AI is used to make decisions about them
- Certain deployers, including public bodies and those doing credit scoring or life and health insurance pricing, must carry out a fundamental rights impact assessment
How to work out your role
For each item in your AI inventory, ask:
- Did we build it, or have it built, and do we offer it under our name? Provider.
- Do we use it at work? Deployer. (You can be both.)
- Have we rebranded, substantially changed or repurposed a system into a high-risk use? You may now be the provider.
Record the answer and the reasoning. It’s the foundation for everything else.
Official sources
- EU AI Act, Regulation (EU) 2024/1689: the official text on EUR-Lex
- AI Act Service Desk: the European Commission’s AI Act explorer, compliance checker and FAQs
More primary sources, with a short note on each, are on our Sources page.
Last reviewed October 2026. Based on Articles 3, 25, 26 and 27 of Regulation (EU) 2024/1689. This article is general information, not legal advice.