Provider or deployer: your EU AI Act role

Last verified October 31, 2026, against the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

If you develop an AI system, or have one developed, and put it on the market or into service under your own name, you are its provider. If you use an AI system under your authority at work, you are its deployer (Art. 3(3)-(4)). Roles are set system by system, so one company can hold both.

Your setup	Your likely role	Why
You buy an AI tool and use it at work	Deployer; the vendor is the provider	You use it under your authority (Art. 3(4))
You build an AI feature into your product and sell it	Provider, even if it runs on another company’s model	You place it on the market under your name (Art. 3(3), 3(68))
You build a tool for your own staff in the EU	Provider and deployer	Putting into service includes your own use (Art. 3(11))
A vendor builds a custom system that goes out under your name	Provider	You had it developed (Art. 3(3))
You put your name on someone else’s high-risk system	Provider, from the high-risk dates	Art. 25(1)(a)
You resell someone else’s system under its name	Distributor, or importer if your entity is in the EU	Art. 3(6)-(7)

This article goes deeper on the two roles most US companies hold. For whether the Act reaches you at all, see Does the EU AI Act apply to a US company?. For the overview, see The EU AI Act for US companies.

The two definitions

A provider is a person or organization “that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge” (Art. 3(3)).

A deployer is a person or organization “using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” (Art. 3(4)).

Three phrases carry most of the weight:

“Has developed.” You do not need to write the code. If a contractor builds a system for you and you release it under your name, you are its provider.
“Under its own name or trademark.” The name on the system points to the provider.
“Puts into service.” This includes supplying a system for your own use in the EU (Art. 3(11)). A company that builds an internal tool and uses it is both its provider and its deployer.

Setups that need a closer look

AI built on another company’s model. The Act calls a provider that integrates a model, its own or someone else’s, a “downstream provider” (Art. 3(68)). The vendor of a general-purpose model has its own, separate duties.

Reselling or rebranding. You may be a distributor, or an importer if you are based in the EU and the system carries a non-EU company’s name (Art. 3(6)-(7)). For high-risk systems, putting your own name on it makes you the provider (Art. 25(1)(a)). For other systems, selling it under your own name can also make you the provider if you had it developed for you (Art. 3(3)); that depends on the facts.

When a deployer becomes the provider

From December 2, 2027 (Annex III) or August 2, 2028 (Annex I), Art. 25(1) turns a distributor, importer, deployer or other third party into the provider of a high-risk system, with all the provider duties in Art. 16, in three cases:

Rebranding. You put your name or trademark on a high-risk system already on the market or in service. This is without prejudice to contracts that allocate the obligations otherwise.
Substantial modification. You change a high-risk system in a way that was not planned in its original conformity assessment and that affects its compliance or changes its intended purpose (Art. 3(23)), and it remains high-risk.
New intended purpose. You change the intended purpose of a system that was not high-risk, including a general-purpose AI system, so that it becomes high-risk.

The third case matters for companies that adapt general tools. Whether configuring a general-purpose assistant to, say, filter job applications (an Annex III point 4(a) use) changes its intended purpose depends on the facts. The Commission’s guidelines on high-risk classification are still a draft, so get advice before you rely on either answer.

When a shift happens, the original provider is no longer treated as the provider of that specific system, but it must cooperate closely and hand over the information you need (Art. 25(2)). Art. 25(2) carves out the case where the original provider clearly specified that its system is not to be changed into a high-risk system and so has no duty to cooperate.

Model provider or system provider?

A general-purpose AI model is a model that can competently perform a wide range of distinct tasks and be built into many systems (Art. 3(63)). Its provider has the duties in Art. 53: technical documentation, information for the companies that build on it, a copyright policy and a public summary of training content.

If you call a model through an API and build a product around it, you are usually the provider or deployer of your own AI system, and the model duties stay with the model’s provider. The model vendor’s information duties under Art. 53(1)(b) exist to help you meet yours. If you fine-tune or otherwise modify the model itself, you can become the provider of the modified model, with duties limited to your changes (Recital 109); the Commission’s guidelines on general-purpose AI models explain when.

What each role must do

For any system in scope, both roles must take AI literacy measures (Art. 4) and stay clear of the prohibited practices (Art. 5).

Transparency splits by role (Art. 50):

Providers design systems that interact directly with people so people know it is AI, unless obvious (50(1)), and mark synthetic output in a machine-readable way, with exceptions (50(2)).
Deployers inform people exposed to emotion recognition or biometric categorization (50(3)). They disclose deep fakes (for evidently artistic, satirical or fictional work, a lighter disclosure), and disclose AI-generated text published to inform the public on matters of public interest, unless a person reviewed the text and someone holds editorial responsibility (50(4)).

For high-risk systems, from December 2, 2027 (Annex III) or August 2, 2028 (Annex I), provider duties are in Art. 16 and deployer duties in Art. 26:

Provider	Deployer
Meets the Section 2 requirements: risk management, data governance, technical documentation, logging, instructions, human oversight, accuracy, robustness and cybersecurity	Uses the system according to the instructions
Runs a quality management system and keeps documentation and logs	Assigns oversight to people with the competence, training and authority
Completes conformity assessment, the EU declaration and CE marking	Checks that input data it controls is relevant and sufficiently representative
Registers the system where required, and takes corrective action	Monitors the system, reports risks and serious incidents, and suspends use where the system presents a risk
Shows conformity to authorities on request	Keeps the logs under its control for at least six months
If based outside the EU, appoints an authorized representative (Art. 22)	Informs workers and their representatives before workplace use, and people subject to Annex III decisions

Both lists are summaries; each article has more. Some deployers also carry out a fundamental rights impact assessment (Art. 27).

Contracts matter

From the same high-risk dates, a provider of a high-risk system and a third party that supplies a system, model, tool, service, component or process used in it must agree in writing on the information, capabilities, technical access and help the provider needs to comply. This does not apply to tools and components, other than general-purpose AI models, released publicly under a free and open-source license (Art. 25(4)). If you buy AI components for a high-risk product, or sell them to someone who builds one, check your contracts.

A short way to decide

For each system, answer:

Who developed it, or had it developed?
Whose name or trademark is on it?
Who uses it, and where?
Have we changed it, rebranded it or used it for a new purpose?
Could the new purpose be high-risk under Annex III or Annex I?

Your answers to 1 and 2 point to the provider, 3 to the deployer, and 4 and 5 to an Art. 25 shift.

Does the EU AI Act apply to a US company?
GDPR basics for US companies with EU users: when the AI feature uses personal data, the GDPR roles (controller and processor) apply too.
The EU AI Act for US companies
EU AI Act glossary

Sources

AI Act Service Desk (text as amended by the Digital Omnibus): Art. 3, Art. 4, Art. 5, Art. 16, Art. 22, Art. 25, Art. 26, Art. 27, Art. 50, Art. 53, Art. 113, Annex III, Recital 109
AI Act Service Desk, Guidelines on the classification of high-risk AI systems (draft)
European Commission, Guidelines on the scope of obligations for providers of general-purpose AI models
Regulation (EU) 2024/1689, Official Journal

This page is general information, not legal advice.