EU AI Act: Deployer vs Provider — Who Bears Which Obligation

What Is a Provider? (Article 3(3))

A provider develops an AI system or general-purpose AI model — or has one developed — and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.

• Develops or commissions the AI system or GPAI model
• Places it on the EU market or puts it into service under its own name or trademark
• Carries the bulk of the high-risk obligations: risk management (Article 9), data governance (Article 10), technical documentation (Article 11 / Annex IV), record-keeping (Article 12), transparency to deployers (Article 13), human oversight design (Article 14), and conformity assessment
• Applies whether the system is supplied commercially or free of charge

What Is a Deployer? (Article 3(4))

A deployer uses an AI system under its own authority — except where the system is used in the course of a personal, non-professional activity.

• Uses the system in a professional context, under its own authority (formerly called the 'user' in earlier drafts)
• Must use the system in accordance with the provider's instructions for use
• Carries deployer-specific duties: assigning competent human oversight, monitoring operation, keeping the automatically generated logs it controls, and informing affected persons where required
• Certain deployers must also run a Fundamental Rights Impact Assessment (Article 27) before first use

How to Tell Which Role You Hold

Work through the distinction rather than assuming. The test is who put the system on the market under their name versus who is operating it:

• Did you build or brand the system? If it goes to market under your name or trademark, you are the provider — even if a third party wrote the code for you.
• Are you only running someone else's system? If you operate a system placed on the market by another company, under their name, you are the deployer.
• You can be both at once. An enterprise that builds an in-house agent (provider) while also using a vendor's agent platform (deployer) holds both roles for different systems.
• Provider obligations are heavier; deployer obligations are operational — oversight, monitoring, logging you control, and transparency to the people affected.

Importers, distributors and product manufacturers are separate operator roles with their own obligations — see the scope page for the full list.

When a Deployer Becomes a Provider (Article 25)

Article 25 sets out the situations where a deployer, distributor, importer or other third party takes on the full obligations of a provider for a high-risk AI system already on the market:

• Rebranding — you put your own name or trademark on a high-risk system already placed on the market, unless a contract allocates the obligations otherwise
• Substantial modification — you make a substantial modification to a high-risk system in a way that it remains high-risk
• Changing the intended purpose — you modify the intended purpose of a system (including a general-purpose AI system) that was not classified as high-risk so that it now becomes high-risk
• When any of these triggers, the original provider must cooperate, and you inherit the provider obligations — conformity assessment, technical documentation, record-keeping and the rest

This is the trap for teams that fine-tune, re-scope, or white-label a bought-in AI system: the paperwork you thought the vendor owned can shift to you.