Provider or deployer: how to determine your role under the AI Act
·
Updated on ·
By 
Aymeric Guyard · 7 min read
In brief
- The provider develops an AI system and places it on the market under their name (heavy obligations). The deployer uses a system supplied by a third party in a professional context (lighter obligations, focused on human oversight and transparency). Warning: a deployer may be reclassified as a provider (art. 25) if they put their trademark on it, substantially modify the system or change its purpose.
Definitions in Article 3
The provider is the one who develops an AI system, or has it developed, and places it on the market or puts it into service under their own name or trademark. The deployer is the one who uses an AI system under their own authority, in the course of a professional activity. In addition to these two roles, there are the importer and the distributor.
Decision tree
- Have you developed the AI system, or had it developed for you? If not, go to step 3.
- Are you placing it on the market under your name or trademark? If yes → you are a provider.
- Are you using an AI system supplied by a third party in your activity? If yes → you are a deployer.
- Have you put your name on a third-party system, substantially modified it or diverted it from its intended purpose? If yes → you may be reclassified as a provider (art. 25).
Comparative obligations
| Obligation | Provider | Deployer |
|---|---|---|
| Technical documentation (Annex IV) | Yes | No (but must require it) |
| Conformity assessment + CE marking | Yes | No |
| EU database registration | Yes | Partial depending on cases |
| Risk management system | Yes | No |
| Human oversight | Design | Implementation |
| Information to affected persons | Provides the means | Yes |
| Log retention | Designs logging | Retains logs (min. 6 months) |
| FRIA (art. 27) | Provides documentation | Yes, if public body / essential service / credit / insurance |
The reclassification trap (Article 25)
This is the most dangerous point. A deployer switches to the regime — much heavier — of the provider in three cases: if they put their name or trademark on a high-risk system already placed on the market; if they substantially modify such a system; or if they change the purpose of a system in such a way as to bring it into the high-risk category. Example: a recruitment agency that purchases a licence for a matching tool remains a deployer; the same agency that developed an in-house CV scoring model would become both provider and deployer, with cumulative obligations.
Why this distinction is strategic
For a SaaS publisher, understanding that it is a provider as soon as it integrates an AI function under its brand changes everything (technical documentation and, for high-risk, conformity assessment). For an SME user, understanding that it remains a deployer — but co-responsible — avoids the illusion that 'the publisher takes care of everything'. The qualification determines the budget, timeline and contractual allocation of responsibilities. See My SaaS integrates AI: am I a provider?.
Take action
Determine your exact role under the AI Act and map your AI systems with Data Comply One.
Discover the AI Act software →Test my compliance for free