Provider vs Deployer Under the EU AI Act

The EU AI Act distinguishes a provider from a deployer. Under Article 3, a provider develops an AI system or has one developed and places it on the market, or puts it into service, under its own name or trademark. A deployer uses an AI system under its authority in a professional context; personal non-professional use is excluded. These roles do not simply mean vendor and customer. A business that commissions development and markets the system under its own name may be the provider; an organization using a purchased tool for work may be a deployer. One organization can hold different roles across systems. Importers, distributors, product manufacturers, and authorized representatives have separate roles. Article 25 can reassign provider duties to a distributor, importer, deployer, or another third party in specified cases: branding a high-risk system, substantially modifying it while it remains high-risk, or changing its intended purpose so it becomes high-risk. A user-interface change alone is not automatically a substantial modification. Under the 2026 AI Omnibus, when a role change occurs the initial provider generally ceases to be provider of that system but must cooperate with the new provider and supply necessary information, reasonable technical access, and assistance, including known limitations and failure modes. This duty does not apply if the initial provider clearly specified the system must not be changed into a high-risk system. The parties must agree in writing on needed support. Provider and deployer duties depend on the system and role. For high-risk systems, providers handle conformity and required documentation; deployers use the system according to instructions and assign competent human oversight. The Act has applied generally since August 2, 2026, with phased rules: Annex III high-risk system rules apply from December 2, 2027, and Annex I product-embedded rules apply from August 2, 2028. Check the current Regulation for the specific system and use.