EU AI Act Provider and Deployer Role Boundaries

A provider is the actor that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts the AI system into service under its own name or trademark. That test is about development control, commissioning, market placement, service launch, and branding, not only technical authorship.

A deployer is the actor using an AI system under its authority, except for personal non-professional use. A company can therefore be a deployer of a supplier system even when the supplier remains the provider, because the company controls the concrete use context, users, operating process, input data under its control, and internal oversight.

The AI Act uses 'operator' as an umbrella term that includes provider, product manufacturer, deployer, authorised representative, importer, and distributor. It is useful for scoping the full value chain, but it is not enough for assigning concrete duties because the named roles have different triggers.

An authorised representative is a Union-based person with a written mandate from a provider to carry out obligations and procedures on the provider's behalf. An importer places on the Union market an AI system bearing the name or trademark of a third-country person. A distributor is a supply-chain actor, other than provider or importer, that makes an AI system available on the Union market.

A product manufacturer can become the provider of a high-risk AI system when the high-risk AI system is a safety component of a product covered by listed Union harmonisation legislation and is placed on the market or put into service under the product manufacturer's name or trademark.

Article 25 is the role-shift rule for high-risk AI systems. A distributor, importer, deployer, or other third party is treated as the provider, and is subject to provider obligations, when one of three triggers is met: it puts its name or trademark on an already placed or put-into-service high-risk AI system; it makes a substantial modification to an already placed or put-into-service high-risk AI system so that it remains high-risk; or it changes the intended purpose of an already placed or put-into-service AI system, including a GPAI system, so that the system becomes high-risk.

When an Article 25 shift occurs, the initial provider is no longer considered the provider of that specific AI system for AI Act purposes, but must closely cooperate with the new provider and provide necessary information, technical access, and other reasonably expected assistance. That cooperation rule does not apply where the initial provider clearly specified that its AI system must not be changed into a high-risk system.

A GPAI model provider is not automatically the provider of every AI system that later integrates the model. The legal text defines a general-purpose AI model separately, and Annex XII requires transparency information for downstream providers that integrate the model into their AI systems.

Commission GPAI guidance gives practical examples: the actor that develops and places a GPAI model on the Union market is the provider; an actor that has a model developed on its behalf and places it on the market is the provider; and a downstream actor integrating a GPAI model into an AI system may be the provider of that AI system.

For downstream modifications, the Commission guidance says not every modification makes the modifier a GPAI model provider. The modifier becomes the provider of the modified GPAI model only where the modification leads to a significant change in the model's generality, capabilities, or systemic risk, with the guidance giving an indicative training-compute criterion for that assessment.

The evidence should prove the legal role, the factual trigger, and the boundary of responsibility. Avoid one generic AI owner record. Instead, keep a role matrix for each AI system and GPAI model version, because the same supplier relationship can involve several actors at different layers of the value chain.

For deployer duties, preserve records showing use according to instructions, human oversight assignment, monitoring based on instructions for use, incident escalation to provider/importer/distributor and authorities where relevant, logs under deployer control, worker information where workplace use is involved, and any required fundamental-rights impact assessment for covered high-risk deployments.