Provider vs Deployer Under the EU AI Act: Which Are You?

The One Question That Sets Your Obligations

Once you know your AI system's risk tier, the next question decides almost everything else: what is your role? The EU AI Act hands out duties by role, and the gap between the two main ones is wide. Pick wrong and you do the wrong work.

Two roles matter for most companies. Provider and deployer. And here is the twist that trips people up: plenty of small teams are both at the same time, on different systems. The fast way to find yours is the free risk check, which returns your role and your tier in about 90 seconds.

Find your role free (90 seconds)

Provider: You Build It or Brand It

You are a provider if you develop an AI system, or have one developed for you, and put it on the market or into service under your own name or trademark. Article 3 is blunt about this. It does not matter whether you charge for it or give it away. If your name is on it, you are the provider.

Providers carry the heavy end of the Act. For a high-risk system, Article 16 expects you to:

• run a risk management system (Article 9) and govern your training data (Article 10),
• produce technical documentation (Article 11) and keep automatic logs (Article 12),
• build in human oversight (Article 14) and hit accuracy, robustness, and security targets (Article 15),
• pass a conformity assessment, apply the CE marking, and register the system before it goes live.

That is the price of being the one who put the system into the world.

Deployer: You Put It to Work

You are a deployer if you use an AI system under your own authority in the course of your business. The recruiter running a screening model, the support team behind an AI chatbot, the finance lead using an AI forecasting tool: all deployers.

Deployer duties (Article 26) are lighter, but they are not nothing:

• use the system the way its instructions tell you to,
• give a real person the authority and the competence to oversee it,
• make sure the input data you feed it is relevant,
• keep the logs, watch for serious incidents, and report them,
• tell your workers when an AI system is used on them, and tell affected people where the Act requires it.

Some deployers also owe a fundamental rights impact assessment under Article 27: public bodies and certain private operators.

Provider vs Deployer at a Glance

The Trap: When a Deployer Becomes a Provider

Here is the part that catches people. Under Article 25, a deployer can turn into the provider of a high-risk system without meaning to. It happens three ways:

• you put your own name or trademark on a high-risk system that is already on the market,
• you make a substantial modification to it,
• you change what it is used for in a way that makes it high-risk.

Fine-tune a model and ship it as your own? Rebrand a vendor's tool and sell it on? You may have just inherited the full provider obligations. This is exactly where small companies slip, because it feels like "just using a tool" right up until it is not. If any of this sounds like you, the risk check will flag it.

Check whether you are a provider

A Quick Example: One Company, Two Roles

Picture a 30-person HR SaaS. It builds its own CV-ranking feature and sells it to clients. There, it is the provider, and because CV ranking is an Annex III employment use, that feature is high-risk with the full provider load. The same company runs an off-the-shelf AI chatbot for internal IT questions. There, it is the deployer, with the lighter Article 26 duties.

One company, two roles, two very different to-do lists. This is why "are we a provider or a deployer?" rarely has a single answer, and why mapping it system by system is the only way to get it right.

Most Small Companies Are Both

If you build your own AI feature and also use third-party AI inside your business, you are a provider of the first and a deployer of the second, at the same time. That is normal. The Act tracks roles per system, not per company. You do not pick one identity for the whole business. You map each system to its own role and its own set of duties.

Two more roles round out the picture. An importer places a third-country provider's system on the EU market. A distributor passes a system further down the chain. Both carry checks of their own, but for most SaaS companies the provider and deployer roles are the ones that bite.

Your Next 90 Seconds

1. Find your role. The risk check returns your role and risk tier for each system in about 90 seconds.
2. Map the duties. AI Comply HQ™ turns your role and tier into the exact obligations and drafts the documentation for you. A consultant charges €10,000 or more for the same scoping. Our plans start at $97 a month, and the check is free.
3. Stay ready. One dashboard, every system, every deadline, no surprises.

Start your free 7-day trial

Frequently Asked Questions

Can a company be both a provider and a deployer? Yes, and most are. You can be the provider of your own AI feature and the deployer of a third-party tool at the same time. The Act assigns roles per system, so you can hold both.

If I fine-tune GPT or Claude and ship it as my own product, am I a provider? Most likely yes. Putting your name on a system, or making a substantial modification to it, can make you the provider under Article 25, with the full provider obligations for high-risk systems.

Are deployer obligations really lighter than a provider's? Yes, but lighter is not zero. Human oversight, monitoring, incident reporting, and AI literacy all apply, and certain deployers owe a fundamental rights impact assessment under Article 27.

We only use AI internally. Are we a deployer? Yes. Using an AI system under your authority in your business makes you a deployer. The one carve-out is purely personal, non-professional use, which a business activity is not.

For more, see whether small companies have to comply at all, what your AI chatbot owes, the GPAI requirements that sit upstream of you, and our guide to risk classification.

Update: The Digital Omnibus Is Now Law (September 27, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed:

• High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
• Two new bans start December 2, 2026 (Article 5). AI that makes intimate images of real people without their consent will be banned. So will AI that makes child sexual abuse material.
• The AI literacy duty changed (Article 4). You must take steps to support your team's AI literacy. The law no longer asks for a set level of skill.

What did not change:

• The bans that started on February 2, 2025 still apply.
• Rules for the large models behind tools like ChatGPT (general-purpose AI models) have applied since August 2, 2025. So have the penalty rules.
• Transparency duties, like telling people they are talking to an AI (Article 50), have applied since August 2, 2026. Generative AI already on the market before then has until December 2, 2026 to mark its output as AI-made (Article 111(4)).

To see which dates apply to you, run the free 90-second risk check. For every date in one place, see our EU AI Act timeline.