EU AI Act (Regulation (EU) 2024/1689) Applicability and roles

Start with the unit you are assessing. Record the AI system or general purpose AI model, its intended purpose, the user group, the deployment context, and whether the output is intended to be used in the Union. Article 2 is wider than simple place of establishment. A provider or deployer outside the EU can still be in scope when the system output is intended for use in the Union.

Also document the carve outs. The Act excludes AI used only for military, defence, or national security purposes, systems and models developed only for scientific research and development before market placement or service use, and certain free and open source releases. That open source carve out does not protect systems that fall under Article 5, Article 50, or high risk categories.

Assign roles per system and per use case. You may be a deployer for one internal workflow, a provider for a customer facing feature, and an importer or distributor for a third party system you place on the Union market. The role drives the evidence you must hold and the obligations you must perform.

The provider role is not limited to the original developer. Under the Act, a distributor, importer, deployer, or another third party can become the provider if it puts its name or trademark on a high risk AI system, makes a substantial modification, or changes the intended purpose so that a previously non high risk system becomes high risk.

The role can change after launch. A fine tune that materially alters the intended purpose, a white label arrangement, or a substantial modification can shift responsibility. If your commercial model allows reselling or downstream customization, your contract and evidence model must anticipate that role shift.

Product manufacturers also need attention. Where an AI system is a safety component of a product covered by Union harmonisation legislation, the product manufacturer may carry provider obligations for the embedded AI component.

A good scoping file is short, versioned, and attributable. It should show why the Act applies or does not apply, which exclusions were considered, which role each operator holds, and what event would force reassessment.

This file is also the backbone for procurement, sales diligence, internal approvals, and regulator questions. Without it, later work on transparency, high risk controls, or GPAI obligations will drift.