Software publishers & AI Act: provider obligations

What does the AI Act cover?

The AI Act classifies systems as unacceptable risk, high risk, limited risk and minimal risk, and distinguishes between provider, deployer, importer and distributor. The provider is the party that develops the system, or has it developed, in order to place it on the market under their name.

High-risk systems include in particular those whose use is listed in Annex III (biometrics, employment, access to essential services, etc.) or that constitute a safety component of a regulated product.

Is the 'Software Publishers' sector concerned?

Any publisher that markets an AI system under its own brand is a provider. A publisher that merely integrates a third-party AI service without modifying it may only be a deployer — but it can also be reclassified as a provider if it substantially modifies the system or places it under its own brand.

General-purpose AI models integrated into the product additionally trigger specific documentation and transparency obligations, reinforced for models presenting systemic risk.

Detailed obligations

Sanctions & risks

Up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for failures to meet high-risk system obligations, and €7.5M or 1% for providing inaccurate information to authorities.

For a vendor-publisher, the greatest risk is misclassifying a high-risk system: it exposes them both to sanctions and to product withdrawal from the market.

Application timeline

• 1Entry into force. 1 August 2024.
• 2Prohibited practices. Since 2 February 2025.
• 3General-purpose AI models (GPAI). From 2 August 2025.
• 4High-risk systems. From 2 August 2026, and 2027 for certain systems embedded in regulated products.

Common mistakes in the sector

• 1Underestimated status. Believing you are a mere deployer when you affix the system under your own brand or substantially modify it.
• 2Missing documentation. Not having the technical documentation required by Annex IV.
• 3No post-market. Omitting post-market surveillance and incident handling.
• 4GPAI ignored. Integrating a general-purpose model without addressing its own obligations.

Practical case

A software publisher integrates a language model to generate summaries and adds a module that automatically scores application files. The scoring module, listed as a high-risk use case, requires technical documentation, risk management and human oversight, while the summary function falls under limited risk. The publisher segments its obligations by feature rather than by entire product.

Compliance roadmap

1. 1

   Inventory. Inventory all AI components of the product and their provenance.

2. 2

   Qualify. Determine the risk level and status (provider or deployer) of each one.

3. 3

   Document. Building the technical documentation (Annex IV) and the quality management system.

4. 4

   Governing usage. Implement transparency, human oversight and a usage notice.

5. 5

   Monitor. Organise post-market surveillance and incident handling.

Frequently asked questions