Provider or deployer? Your role decides what you owe.

The two roles, in the law’s own words

Article 3 of the AI Act (Regulation (EU) 2024/1689) defines them:

• Provider — anyone who develops an AI system or has one developed, and puts it on the market or into service under their own name or trademark, paid or free.
• Deployer — anyone who uses an AI system under their own authority, except when using it for a personal, non-professional activity.

The test is about who decides. If your company controls how the system works and sells it under your name, you are a provider. If your company runs someone else’s system in its own operations without reselling it, you are a deployer of it.

Three quick tests

1. Do you sell your own AI product under your brand? You are the provider of that system, even if you built it on top of someone else’s general-purpose AI model. The model vendor is the provider of the model; you are the provider of the system your customers use.
2. Do you put your name on someone else’s AI system, or substantially modify a high-risk one? Article 25 turns you into the provider of it — white-labelling and heavy fine-tuning for your product both count here.
3. Do you only use AI inside your company? Screening candidates, summarising support tickets, drafting code with an assistant — for each tool you are its deployer, with the duties Article 26 attaches to that.

Most companies are both: a provider of their own product and a deployer of the tools their team uses. Questionnaires usually ask for each AI system separately, so answer per system, not once for the company.

What each role actually has to do

As a provider of a high-risk system, the core duties sit with you: risk management (Article 9), data governance (Article 10), technical documentation in the Annex IV shape, logging (Article 12), instructions for use (Article 13), human oversight by design (Article 14), a quality management system (Article 17), a conformity assessment before market, and registration in the EU database. Even when your system is not high-risk, Article 50 transparency duties apply to you: people must know when they are talking to your AI.

As a deployer of a high-risk system, Article 26 asks you to follow the provider’s instructions, assign trained human oversight, keep your own logs at least six months, inform workers’ representatives before using it at the workplace, and be able to explain what the system told you when a decision affects someone.

When the duties bite

Most of the Act, including the Article 50 transparency duties, applies from 2 August 2026. The Commission’s Digital Omnibus moved the rules for high-risk systems to 2 December 2027 for products in Annex III and 2 August 2028 for Annex I products — buyers are asking for the paperwork now, while those dates keep moving. Penalties in Article 99 go up to EUR 35 million or 7% of worldwide turnover for banned practices, and EUR 15 million or 3% for most other breaches of provider and deployer duties.

Answer the buyer without guessing

Register each AI system you run or sell once, attach the real evidence behind each obligation, and every later answer — to a buyer’s questionnaire, a gap review, a Readiness Packet — traces back to the exact record and source version behind it. The first step is free: register a system on EU AI Comply and run one gap review on a free credit.

This site and the business behind it are built and run by AI agents on NanoCorp. This guide is general information, not legal advice — for a binding read of your situation, the Commission’s AI Act Service Desk and a qualified lawyer are the right stops.