Digital service companies (DSC) · AI Act

IT Services Companies & AI Act: provider or deployer, a question of deliverable

An IT services company that develops, integrates or operates AI systems for its clients must first determine its status under the AI Act: provider or deployer. This status, which may vary from one project to another, governs the intensity of the obligations. This guide clarifies the qualification, the corresponding obligations, and the importance of the contractual allocation of responsibilities with the client.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Any IT services company delivering, integrating or operating AI is concerned.
  • Qualifying status by project.
  • Document (supplier).
  • Ensuring transparency and oversight.
  • Up to €35M or 7% of turnover for prohibited practices, €15M or 3% for high-risk non-compliance.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act distinguishes between the provider (who develops and places on the market), the deployer (who uses the system under their own authority), the importer and the distributor, and classifies systems by risk level. An IT services company may take on several of these roles depending on its activities.

Beware of reclassification: a deployer who substantially modifies a system or places it under their own brand becomes a provider.

Is the 'Digital Service Companies (DSC)' sector concerned?

Any IT services company delivering, integrating or operating AI is concerned. Custom development of an AI solution delivered under the firm's own brand places it as a provider; operating third-party tools for a client places it as a deployer.

A single contract may combine both: development of a module (provider) and operation of a third-party tool (deployer).

Detailed obligations

Qualify status by project

Determine, for each engagement, whether the IT services company is a provider or a deployer, as obligations follow directly from this distinction.

Document (supplier)

For systems delivered under its own brand: technical documentation (Annex IV), risk and quality management system, and conformity assessment.

Ensuring transparency and oversight.

Inform about system capabilities and limitations and enable effective human oversight.

Allocating responsibilities.

Contractually specify which party — the IT services firm or the client — bears the AI Act obligations for each component.

Monitoring after market placement.

For supplied systems: organise post-market surveillance and incident escalation.

Sanctions & risks

Up to €35M or 7% of turnover for prohibited practices, €15M or 3% for high-risk breaches. For an IT services company, ambiguity over status is the primary risk: AI delivered without documentation when the company is in reality acting as a provider.

Contractual clarity protects both the IT services company and its client.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Prohibited practices. Since 2 February 2025.
  • 3High risk. Main obligations from 2 August 2026.

Common mistakes in the sector

  • 1Undetermined status. Failing to determine whether the IT services provider is a supplier or deployer.
  • 2Missing documentation. Delivering AI under your brand without technical documentation.
  • 3Unclear responsibilities. Leave the contract silent on the allocation of AI obligations.
  • 4Ignored reclassification. Substantially modifying a third-party system without assuming the status of provider.

Practical case

An IT services company develops a recommendation engine for a client, delivered under its own brand, and also operates a third-party natural language processing tool. It is a provider for the former (technical documentation, risk management) and a deployer for the latter (transparency, oversight). The contract sets out this allocation, avoiding any liability dispute.

Compliance roadmap

  1. 1

    Inventory. Inventory AI projects and components delivered or operated.

  2. 2

    Qualify. Determine the status and risk level per project.

  3. 3

    Document. Produce technical documentation for supplied systems.

  4. 4

    Contractualise. Clearly allocate AI responsibilities with each client.

  5. 5

    Monitor. Organising post-market surveillance of supplied systems.

Frequently asked questions

As soon as it develops and delivers the AI under its own brand, or substantially modifies a third-party system. Otherwise, it is a deployer.

Back to the Digital service companies (DSC) guideDigital service companies (DSC) & NIS2 Digital service companies (DSC) & GDPR Digital service companies (DSC) & DORA

Take action on AI Act

Free assessment or a chat with an expert dedicated to digital service companies (dsc).

Start my free assessment Talk to an expert

They already trust us

See how organisations in the digital service companies (dsc) sector secured their compliance with DCO.

See testimonials