Provider or deployer: how to tell which one you are

Before asking what you must comply with, you need to know what you are. The EU AI Act allocates very different obligations depending on the role you occupy, and almost everyone assumes the one that feels most comfortable without checking. It is the costliest mistake, because a wrong classification drags every subsequent decision along with it.

The two roles that concern you

Article 3 defines several roles. For a company that does not build technology, two matter in practice:

• Provider: develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Whether for payment or free of charge makes no difference.
• Deployer: uses an AI system under its own authority in the course of a professional activity. This is the role the vast majority of companies occupy.

Article 4, on AI literacy, binds both equally. The remaining obligations — conformity assessment, technical documentation, CE marking, registration — fall mainly on the provider.

Four real situations

1. You use ChatGPT, Copilot or Gemini in daily work

You are a deployer. You have developed nothing and distribute nothing under your brand: you use a third party's tool. Article 4 applies to you, and if the use falls under an Annex III function, so do the deployer obligations for high-risk systems.

2. You have integrated a model's API into your own product and sell it

Here you are a provider, even though you did not train the model. What matters is not who built the technology but under whose name it reaches the market. If your customer buys your product, you answer as the provider of that system.

3. You adapted a third-party tool and offer it internally to other group companies

It depends on the extent of the change. Article 25 provides that anyone making a substantial modification to a high-risk system, or changing its intended purpose, is thereafter considered the provider of that system. Adjusting a system prompt is not the same as redirecting the tool to a use it was never designed for.

4. You use a third-party tool to screen CVs

You remain a deployer, but of a high-risk system: recruitment is expressly listed in Annex III. That adds specific obligations from Article 26, among them human oversight by people with the necessary competence and authority, and informing affected workers before putting the system into service.

The case almost nobody sees coming

Being both at once. A consultancy that uses AI internally — deployer — and also sells clients an assistant built on a third-party model — provider — accumulates both sets of obligations. You do not choose between them: they add up. It is the most common position among professional services firms that have started productising their expertise, and also the one least often spotted in time.

Frequently asked

How to settle it

The quick route is answering three questions in writing: do I place any AI system on the market under my name? Have I substantially modified any of the ones I use? Does any of my uses appear in Annex III? Three noes mean you are a deployer and Article 4 is your priority. Our free assessment walks that path in six questions and returns your assigned role together with the articles that apply to you.