--- title: "Provider or Deployer? | Pitch" description: "The AI Act allocates duties by role. Who counts as provider, deployer, importer or distributor, and when does a deployer become a provider?" url: https://www.pitch.law/academy/provider-vs-deployer-ai-act --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # Provider or Deployer? The AI Act allocates duties by role. Who counts as provider, deployer, importer or distributor, and when does a deployer become a provider? - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework The AI Act (Regulation (EU) 2024/1689) places obligations on operators according to their role in the value chain. Article 3 defines the main roles: - **Provider**: a person or body that develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. - **Deployer**: a person or body that uses an AI system under its authority, except for personal non-professional activity. - **Importer**: an operator established in the EU that places on the market a system bearing the name of a person established outside the EU. - **Distributor**: an operator in the supply chain, other than the provider or importer, that makes a system available on the EU market. - **Authorised representative**: a person in the EU appointed by a provider established outside the EU. For high-risk systems, the provider carries the heaviest load under Article 16: a risk management system, data governance, technical documentation, record-keeping, transparency towards deployers, human oversight by design, accuracy and robustness, a quality management system, a conformity assessment, the EU declaration of conformity, CE marking and registration. See [conformity assessments](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems). The deployer's duties are set out in Article 26. They include using the system according to the instructions for use, assigning human oversight to competent and trained persons, ensuring that input data under the deployer's control is relevant and sufficiently representative, monitoring operation, keeping the automatically generated logs for at least six months, informing workers' representatives and affected workers before a high-risk system is used in the workplace, and informing natural persons that they are subject to the use of a high-risk system. Certain deployers, such as public bodies and those using AI for credit scoring or life and health insurance pricing, must carry out a fundamental rights impact assessment under Article 27. ### When a deployer becomes a provider Article 25 treats a deployer, distributor or other third party as the provider of a high-risk system if it: - puts its name or trademark on a high-risk system already on the market; - makes a substantial modification to a high-risk system so that it remains high-risk; or - changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. The original provider is then no longer treated as the provider of that system, but must cooperate with the new provider. Regulation (EU) 2026/1744 spells out this duty to cooperate in more detail, including providing documentation and technical access, and extends the written agreements required between provider and suppliers of components to AI models. It also allows the original provider to exclude the duty by stating expressly that the system must not be turned into a high-risk system. ## In practice A Mechelen logistics company buys a licensed scheduling tool that allocates shifts to drivers. Shift allocation based on personal traits or behaviour falls under employment in Annex III. The company is a deployer. It must follow the supplier's instructions, appoint trained people for oversight, keep logs and inform the works council and the drivers. A Leuven start-up takes a general-purpose language model from a large provider and builds a tool that ranks job applicants under its own brand. The start-up is the provider of the resulting high-risk system. The model provider is not, but must give the start-up the information required under the rules for general-purpose models. A consultancy firm takes an HR tool from a vendor, rebrands it and resells it to clients. By putting its own name on the system, it becomes the provider under Article 25 and takes on the full set of provider duties. Roles apply per system, and one company can be a provider of one system and a deployer of another. A register that records role per system avoids surprises ([our register](https://www.pitch.law/technologies/ai-act-governance-toolkit)). Because deployer duties also involve personal data, they connect to your [records of processing](https://www.pitch.law/technologies/privacy-register). ## Frequently asked questions ### Is a company that fine-tunes a model a provider? Possibly. If it places a system under its own name on the market or puts it into service, it is a provider of that system. Whether it also becomes a provider of the model depends on the extent of the changes. ### Does a company outside the EU have to comply? Yes, if the system is placed on the EU market or its output is used in the EU. Providers outside the EU of high-risk systems must appoint an authorised representative. ### Can the roles be allocated by contract? The contract can distribute information and cooperation duties, but not change the legal role. A supplier cannot contract a deployer out of its Article 26 duties. ### Does a deployer need to ask the provider for anything? Yes: the instructions for use and the information needed to meet its own obligations. Ask for it in the purchase agreement. ## How this connects Our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) service starts by determining your role per system. The [risk classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) tells you whether these duties apply at all, and the [timeline](https://www.pitch.law/academy/ai-act-compliance-timeline) tells you from when. ## In short - Duties differ by role, per system - Providers carry the heaviest load for high-risk AI - Deployers have their own duties under Article 26 - Rebranding or modifying a system can make you a provider ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) [Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control.](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)