Provider or Deployer?

The legal framework

The AI Act (Regulation (EU) 2024/1689) places obligations on operators according to their role in the value chain. Article 3 defines the main roles:

• Provider: a person or body that develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
• Deployer: a person or body that uses an AI system under its authority, except for personal non-professional activity.
• Importer: an operator established in the EU that places on the market a system bearing the name of a person established outside the EU.
• Distributor: an operator in the supply chain, other than the provider or importer, that makes a system available on the EU market.
• Authorised representative: a person in the EU appointed by a provider established outside the EU.

For high-risk systems, the provider carries the heaviest load under Article 16: a risk management system, data governance, technical documentation, record-keeping, transparency towards deployers, human oversight by design, accuracy and robustness, a quality management system, a conformity assessment, the EU declaration of conformity, CE marking and registration. See conformity assessments.

The deployer's duties are set out in Article 26. They include using the system according to the instructions for use, assigning human oversight to competent and trained persons, ensuring that input data under the deployer's control is relevant and sufficiently representative, monitoring operation, keeping the automatically generated logs for at least six months, informing workers' representatives and affected workers before a high-risk system is used in the workplace, and informing natural persons that they are subject to the use of a high-risk system. Certain deployers, such as public bodies and those using AI for credit scoring or life and health insurance pricing, must carry out a fundamental rights impact assessment under Article 27.

When a deployer becomes a provider

Article 25 treats a deployer, distributor or other third party as the provider of a high-risk system if it:

• puts its name or trademark on a high-risk system already on the market;
• makes a substantial modification to a high-risk system so that it remains high-risk; or
• changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk.

The original provider is then no longer treated as the provider of that system, but must cooperate with the new provider. Regulation (EU) 2026/1744 spells out this duty to cooperate in more detail, including providing documentation and technical access, and extends the written agreements required between provider and suppliers of components to AI models. It also allows the original provider to exclude the duty by stating expressly that the system must not be turned into a high-risk system.

In practice

A Mechelen logistics company buys a licensed scheduling tool that allocates shifts to drivers. Shift allocation based on personal traits or behaviour falls under employment in Annex III. The company is a deployer. It must follow the supplier's instructions, appoint trained people for oversight, keep logs and inform the works council and the drivers.

A Leuven start-up takes a general-purpose language model from a large provider and builds a tool that ranks job applicants under its own brand. The start-up is the provider of the resulting high-risk system. The model provider is not, but must give the start-up the information required under the rules for general-purpose models.

A consultancy firm takes an HR tool from a vendor, rebrands it and resells it to clients. By putting its own name on the system, it becomes the provider under Article 25 and takes on the full set of provider duties.

Roles apply per system, and one company can be a provider of one system and a deployer of another. A register that records role per system avoids surprises (our register). Because deployer duties also involve personal data, they connect to your records of processing.

Frequently asked questions

Is a company that fine-tunes a model a provider?

Possibly. If it places a system under its own name on the market or puts it into service, it is a provider of that system. Whether it also becomes a provider of the model depends on the extent of the changes.

Does a company outside the EU have to comply?

Yes, if the system is placed on the EU market or its output is used in the EU. Providers outside the EU of high-risk systems must appoint an authorised representative.

Can the roles be allocated by contract?

The contract can distribute information and cooperation duties, but not change the legal role. A supplier cannot contract a deployer out of its Article 26 duties.

Does a deployer need to ask the provider for anything?

Yes: the instructions for use and the information needed to meet its own obligations. Ask for it in the purchase agreement.

How this connects

Our AI Act compliance service starts by determining your role per system. The risk classification tells you whether these duties apply at all, and the timeline tells you from when.