Free template · Word · English and Dutch

Provider or deployer? AI Act role determination template (Word)

Role determination under the AI Act means establishing, per AI system and per use, whether your organisation is the provider, deployer, importer, distributor or authorised representative (Article 3). The role decides which obligations apply. Under Article 25(1) a deployer can itself become the provider of a high-risk AI system, for example through its own trademark or a new purpose.

Last checked against the law: 6 October 2026
Editor: Zahed Ashkara, jurist, privacy and AI
Version and template ID: 2.0 · praxikon:template:provider-deployer-determination
Legal basis: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR)

Who is this template for?

Owner of AI governance or the AI registerRecords the role per system as the basis for the obligations of the provider (Article 16) or the deployer (Article 26)
Procurement and contract managementUses the model clauses to avoid becoming the provider unnoticed and to secure the supplier's information and assistance (Article 25(2) and (4))
Product and IT teams that build or integrate AIDetermine whether they are a provider or a downstream provider, with the obligations of Article 50(1) and (2)
Resellers, importers and distributorsCheck their own obligations (Articles 23 and 24) and the point at which they become the provider (Article 25(1))
Data protection officer or privacy officerDetermines the GDPR role separately: controller or processor (Article 4(7) and (8) and Article 28 GDPR)

What is inside

Chapter 1: the roles and key terms of Article 3 in plain words, the exclusions in Article 2 and the relationship with the GDPR
Chapter 2: decision tree with seven questions per AI system and two rules of thumb for in-house development and purchasing
Chapter 3: the Article 25 role shifts, with four model clauses for the contract with your supplier
Chapter 4: your position with general-purpose AI models, including the one-third compute threshold (Articles 53 to 55)
Chapter 5: obligations of importers, distributors and authorised representatives (Articles 22 to 24)
Chapter 6: which rules apply when, the obligations of providers and deployers of high-risk AI systems (Articles 16 and 26) and the Article 99 fines
Chapter 7: seven fictional worked examples
Chapter 8: role record per AI system, an overview for several systems and a checklist of when to reassess

How to use the template

Take one AI system and one use at a time; the role belongs to the system and its use, not to your whole organisation.
Work through the decision tree in chapter 2 to the end, including question 7, and note every question that leads to a role.
If you work with a large language model or another general-purpose AI model, also work through chapter 4.
Look up the obligations for your role and their dates in chapter 6, and record the outcome in chapter 8.
Add the role to your AI register and repeat the assessment after every change on the checklist, such as a new purpose or retraining.

Common mistakes

Determining the role per organisation instead of per system and per use. One organisation can be the provider of one system and the deployer of another.
Assuming you are not the provider of an AI system built in-house because you do not sell it. Putting a system into service for your own use makes you the provider (Article 3, points 3 and 11).
Using a general AI assistant for an Annex III purpose, such as ranking job applicants, without realising that this makes you the provider of a high-risk AI system (Article 25(1)(c)).
Assuming the contract decides the role. Only where you put your own name or trademark on the system (Article 25(1)(a)) does the law allow the obligations to be allocated otherwise.
Equating the GDPR role with the AI Act role. A provider can be a processor and still be the controller for training its own model.

When do you need legal advice?

Your role shifts because of what you do. You put your name or trademark on a high-risk AI system, make a substantial modification to it, or use a system for an Annex III purpose the supplier did not intend. Under Article 25(1) you then become the provider, with the provider obligations of Article 16, and your supplier is no longer the provider of that specific system.
The chain crosses the EU border or runs through a model. The provider is established outside the EU and you may be the importer (Article 23), or the provider needs an authorised representative in the EU (Article 22 or 54). Or you modify a general-purpose AI model so extensively that you may become the provider of the modified model, with the obligations of Article 53.
Contract and law diverge. Your supplier's terms place obligations on you as deployer that the AI Act places on the provider, or the contract does not cover the information and assistance of Article 25(2) and (4). Your GDPR role (controller or processor) may also differ from your role under the AI Act.

Frequently asked questions

What is the difference between a provider and a deployer under the AI Act?

The provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Article 3, point 3). The deployer uses an AI system under its authority, other than in a purely personal, non-professional activity (Article 3, point 4). One organisation can have both roles for the same system.

Can a contract decide whether we are the provider?

No, the role follows from the facts. Only where you put your name or trademark on a high-risk AI system (Article 25(1)(a)) does the AI Act leave room for contractual arrangements that allocate the obligations otherwise. After a substantial modification or a new high-risk purpose (points (b) and (c)) you become the provider by operation of law. A contract can secure the documentation, access and assistance of Article 25(2).

We built an AI system only for internal use. Are we a provider?

Yes. Putting an AI system into service for your own use makes your organisation the provider (Article 3, points 3 and 11), and using it makes you the deployer as well. Whether heavy obligations apply depends on whether the system is high-risk or falls under Article 50.

Does fine-tuning a language model make us the provider of the model?

As a rule, only if the modification uses more than one third of the compute with which the original model was trained. That is an indicative criterion in the European Commission guidelines of 18 July 2025. Fine-tuning on your own documents usually stays far below it. If you build the model into your own AI system, you are a downstream provider of that system (Article 3, point 68).

From when do these obligations apply?

As at 6 October 2026: the Article 5 prohibitions have applied since 2 February 2025, the obligations for providers of general-purpose AI models since 2 August 2025 and the Article 50 transparency obligations since 2 August 2026. The high-risk rules, including Article 25, apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for systems covered by Annex I. For systems already on the market or in service before then, Article 111(2) applies.

Can an importer or distributor become the provider?

Yes, if it puts its own name or trademark on a high-risk AI system, makes a substantial modification to it or changes its purpose so that it becomes high-risk (Article 25(1)). The original provider is then no longer the provider of that specific system, but must provide information and assistance (Article 25(2)).

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, Provider or deployer? AI Act role determination template (Word), version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/provider-deployer-determination

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597