AI provider vs deployer under the EU AI Act: which are you?
Hephaestus Technology7 min read
Under the EU AI Act, a provider is the organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name, while a deployer is anyone using an AI system under its authority in a professional context. Providers carry most of the obligations; deployers have lighter but real ones. A business shipping an AI feature in its own product is usually a provider, and a business using AI tools in its operations is a deployer.
Key takeaways
- A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name; a deployer uses an AI system under its authority in a professional context.
- Providers carry most obligations: for high-risk systems, conformity assessment, documentation, quality management and CE marking; for generative and interactive systems, Article 50 design duties.
- Deployers have lighter but real duties: AI literacy, labelling deepfakes and public-interest AI text, and for high-risk systems human oversight, log keeping and informing workers and affected people.
- You can become a provider without building anything, by rebranding a high-risk system, substantially modifying it or repurposing a general AI system for a high-risk use (Article 25).
- A SaaS company that ships an AI feature under its own brand is normally a provider of that system, even if the underlying model comes from someone else.
What exactly is an AI provider and an AI deployer?
Both definitions are in Article 3 of the AI Act.
- Provider (Article 3(3)): a natural or legal person, public authority, agency or other body that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
- Deployer (Article 3(4)): a natural or legal person, public authority, agency or other body using an AI system under its authority, except where the AI system is used in a personal non-professional activity.
The Commission's Article 50 guidelines add a helpful gloss: "authority" means taking responsibility for the decision to deploy the system and for how it is used, and does not require technical control over it. Employees acting for a company are not separate deployers; the company is.
How do provider and deployer obligations compare?
The table summarises the main duties by tier, with dates from the consolidated Article 113.
| Obligation area | Provider | Deployer | Applies from |
|---|---|---|---|
| AI literacy (Article 4) | Take measures to support staff AI literacy | Same | 2 February 2025 |
| Prohibited practices (Article 5) | Must not place on market | Must not use | 2 February 2025 |
| Chatbots and interactive AI (Article 50(1)) | Design so users are told they are interacting with AI | Not directly, but check vendor compliance | 2 August 2026 |
| Generative output (Article 50(2)) | Machine-readable marking of synthetic content | n/a | 2 August 2026 |
| Deepfakes and public-interest text (Article 50(4)) | n/a | Disclose AI generation or manipulation | 2 August 2026 |
| High-risk systems | Risk management, data governance, technical documentation, logging, human oversight design, quality management, conformity assessment, CE marking, registration (Article 16) | Use per instructions, trained human oversight, monitor and report risks, keep logs at least six months, inform workers and affected people (Article 26) | 2 December 2027 (Annex III); 2 August 2028 (Annex I) |
| Fundamental rights impact assessment (Article 27) | n/a | Public bodies, private entities providing public services, and deployers of credit-scoring and life or health insurance systems | With high-risk rules |
The difference in effort is largest for high-risk systems: the provider must prove conformity before market entry, while the deployer must use the system properly and keep a human in charge.
Which role am I in? A decision guide
| Your situation | Your role for that system |
|---|---|
| Staff use ChatGPT, Copilot or Gemini for work | Deployer |
| You buy a vendor's AI recruitment tool and use it as supplied | Deployer of a high-risk system |
| You build an AI feature into your SaaS product and sell it under your brand | Provider of that AI system |
| You build an internal chatbot in-house and use it under your name | Provider and deployer |
| You white-label a vendor's high-risk system under your own brand | Provider (Article 25(1)(a)) |
| You fine-tune a vendor's high-risk system so it changes substantially | Provider (Article 25(1)(b)) |
| You use a general chatbot to score loan applicants | Provider, because you changed its purpose to a high-risk one (Article 25(1)(c)) |
| You release a model others build on | Provider of a general-purpose AI model (Articles 53 and 55) |
When does a deployer become a provider?
Article 25(1) lists three triggers. A distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system if it:
- puts its name or trademark on a high-risk system already on the market;
- makes a substantial modification to a high-risk system so that it remains high-risk; or
- modifies the intended purpose of an AI system, including a general-purpose one, that was not high-risk, so that it becomes high-risk.
The third is the trap for SMEs. Using a general-purpose assistant to rank job applicants or decide on credit can turn an ordinary deployer into the provider of a high-risk system, with all of Article 16's obligations. Our high-risk AI checklist helps you spot those uses.
The Digital Omnibus also added a specific fine point for breaches of Article 25(2) and (4) in Article 99, which deal with cooperation between the original and new provider along the value chain.
What about the company that makes the underlying model?
It is the provider of a general-purpose AI model, a separate category. Under Article 53 it must keep technical documentation, give downstream providers the information they need to integrate the model, maintain a copyright policy and publish a summary of training content; models with systemic risk carry extra duties under Article 55. Those obligations have applied since 2 August 2025.
If you build a product on that model, you are a downstream provider of your own AI system. The model provider's documentation helps you, but it does not discharge your obligations. For example, the Commission's guidelines say a company that modifies an existing generative system and puts it into service under its own name becomes the provider of the new system. Our worked example on adding an AI assistant to an existing SaaS shows what that looks like in practice, and our guide to the AI Act transparency rules for chatbots covers the most common provider duty.
Does it matter if my company is outside the EU?
Not much. Article 2 applies the Act to providers placing AI systems on the EU market wherever they are established, and to providers and deployers in third countries where the AI output is used in the EU.
What should I do with this?
- List every AI system you build or use.
- Assign a role to each, provider, deployer or both, using the decision guide above.
- Flag any Article 25 triggers: rebranding, substantial modification, repurposing.
- Map obligations and dates for each role.
- Put role allocation into contracts with AI vendors and customers, including who handles disclosures and incident reporting.
Frequently asked questions
Can a company be both a provider and a deployer?
Yes, and it is common. A company that builds an AI system in-house and uses it under its own name is both: it puts the system into service as a provider and uses it as a deployer. The Commission's Article 50 guidelines give exactly this example for an in-house chatbot.
If I build on OpenAI, Anthropic or Google models, who is the provider?
The model vendor is the provider of the general-purpose AI model, with its own obligations under Article 53. If you integrate that model into a product you offer under your own name, you are normally the provider of the resulting AI system and responsible for that system's obligations, such as Article 50 disclosures.
Does using an AI tool for free change my role?
No. The provider definition applies whether the system is supplied for payment or free of charge, and the deployer definition depends on using the system under your authority, not on paying for it. Only purely personal, non-professional use by individuals falls outside.
What counts as a substantial modification?
Article 3(23) of the AI Act defines it as a change after the system is placed on the market or put into service that was not foreseen in the provider's initial conformity assessment and that affects compliance or the assessed intended purpose. If you substantially modify a high-risk system so it stays high-risk, Article 25 makes you its provider. Fine-tuning or retraining a system you then put out under your name deserves careful review.
Are importers and distributors treated as providers?
Not by default. They have their own, lighter obligations under Articles 23 and 24, mainly checking that the provider has done its job. They become providers under Article 25 in the same situations as deployers, such as putting their own name on a high-risk system.
If you are not sure which role your product puts you in, book a free 30-minute call and we can talk it through.
Cover photo by ThisIsEngineering on Pexels.