EU AI Act Are you the provider or the deployer?

A provider develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark. Development, commissioning, branding and first supply or use all matter. Writing the code alone does not decide the role.

A deployer uses an AI system under its authority, except for purely personal, non-professional use. A company using a supplier's system can be the deployer while the supplier remains the provider. Check who controls the use, operating process, users, relevant input data and oversight.

Operator is the umbrella term for a provider, product manufacturer, deployer, authorised representative, importer or distributor. Identify the specific role before assigning duties.

An authorised representative is EU-based and has a written provider mandate. An importer first places on the EU market a system bearing a third-country person's name or trademark. A distributor makes a system available on the EU market and is neither its provider nor importer.

A product manufacturer is treated as the provider of a high-risk AI system that is a safety component of a product covered by the Union harmonisation legislation in Section A of Annex I when the system is placed on the market together with the product under the manufacturer's name or trademark, or is put into service under that name or trademark after the product has been placed on the market.

Article 25 has three triggers for a system already on the market or in service. A party becomes the provider if it puts its name or trademark on a high-risk system, substantially modifies a high-risk system while it remains high-risk, or changes a non-high-risk system's intended purpose so it becomes high-risk. The last trigger also covers general-purpose AI systems. The branding trigger preserves contractual arrangements allocating obligations differently.

The initial provider then ceases to be the provider of that specific system for AI Act purposes. It must cooperate closely with the new provider and supply necessary information, technical access and reasonably expected assistance. That cooperation duty does not apply where the initial provider clearly said its system must not be changed into a high-risk system.

Article 25, as amended by Regulation (EU) 2026/1744, specifies that this cooperation includes, where relevant, technical documentation sufficient to assess Article 16 compliance, known limitations and failure modes, and targeted technical access for testing and validation.

Use contracts to agree work, access, assistance, confidentiality and liability. Under amended Article 25(4), a high-risk system provider and a supplier of an integrated system, model, tool, service, component or process must specify the necessary information, capabilities, technical access and assistance in writing. Publicly accessible free and open-source tools, services, processes and components are excluded from that paragraph; general-purpose AI models are not.

Keep the model provider separate from the provider of a system built with it. A general-purpose AI model provider does not automatically provide every downstream system. Annex XII requires model information for system builders.

Commission guidance gives three examples: developing and marketing a general-purpose model; commissioning one and marketing it; or integrating a model into a system. The first two can make the organisation the model provider. The third can make it the system provider.

Modifying a model does not automatically make you its provider. Commission guidance looks for significant changes to generality, capabilities or systemic risk and gives an indicative training-compute criterion. Keep the change evidence and apply the guidance to the actual modification.

Keep a role matrix for each system and model version. Record the legal role, the facts that create it and the responsibility assigned. A single AI-owner field cannot describe a supplier relationship with several model and system roles.

For deployer duties, preserve records showing use according to instructions, human oversight assignment, monitoring based on instructions for use, incident escalation to provider/importer/distributor and authorities where relevant, logs under deployer control, worker information where workplace use is involved, and any required fundamental-rights impact assessment for covered high-risk deployments.