Provider vs deployer

The AI Act makes a fundamental distinction between providers and deployers. The provider develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge (Article 3(3)). The deployer uses an AI system under its authority, except for personal non-professional use (Article 3(4)). This distinction determines which obligations apply to you.

The AI Act spreads the obligations for high-risk AI systems across the whole chain, from development to use. The provider carries the heaviest obligations (Article 16). If it is established outside the EU, it appoints an authorised representative in the EU by written mandate before making the system available (Article 22). The importer places the system of a non-EU provider on the European market and first verifies the conformity assessment, the technical documentation, the CE marking, the EU declaration of conformity with instructions for use and the authorised representative (Article 23). The distributor makes the system available further and verifies the CE marking, the declaration of conformity and the instructions for use (Article 24). Importers and distributors only place a non-conforming system on the market once it has been brought into conformity. The deployer uses the system and has the obligations of Article 26. An importer, distributor or deployer can itself become the provider under Article 25(1).

Question 1: did you develop the AI system or have it developed? If not, you are probably a deployer. If so, go to question 2. Question 2: do you place it on the market under your own name or trademark? If so, you are a provider. If not, go to question 3. Question 3: do you only put it into service internally? You are still a provider, because putting into service for own use also counts (Article 3(3) and (11)). Note: if you buy a high-risk system and put your own name or trademark on it, or substantially modify it, you can become its provider (Article 25(1)).

As a provider of a high-risk AI system, you have extensive obligations (Article 16). You set up a risk management system that runs through the whole lifecycle, draw up technical documentation before placing on the market, carry out the conformity assessment, affix the CE marking and register the system in the EU database where Article 49 requires it. After placing on the market, you monitor the system and report serious incidents.

As a deployer of a high-risk AI system, you have fewer obligations than a provider, but they are no less important. You use the system according to the instructions for use, assign human oversight to competent people, control the input data to the extent you manage it, monitor operation and keep the logs for at least six months. Where you see a risk, inform the provider or distributor and the market surveillance authority and suspend use; report a serious incident immediately, to the provider first (Article 26(5)). Public bodies and certain other deployers also carry out a FRIA (Article 27). The full list by paragraph, with a checklist, is on the Article 26 page.

Sometimes your role is not immediately clear. If you buy a high-risk system and put your own name or trademark on it, substantially modify it, or change the intended purpose of an AI system so that it becomes high-risk, you become its provider (Article 25(1)); if you use the system yourself, you are also its deployer. If you build your own application on a general-purpose AI model and place it on the market or put it into service under your own name, you are the provider of that application. Importers and distributors have their own obligations in Articles 23 and 24.

The Digital Omnibus on AI is Regulation (EU) 2026/1744 and has applied since 27 July 2026. For providers and deployers, mainly the timeline shifts: the high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. EU database registration for systems that are not high-risk under Article 6(3) remains, with fewer data fields. Article 4 now requires providers and deployers to take measures that support AI literacy. The allocation of roles itself, with the definitions of Article 3 and the routes of Article 25, has not changed.