Provider, deployer, importer, distributor: which are you under the EU AI Act?

The EU AI Act does not assign obligations to companies. It assigns them to roles. Before you can know what the Act requires of you, you have to know which role you occupy for a given AI system, because the same organisation can be a provider for one system and a mere deployer for another. Get the role wrong and you either take on duties that are not yours or, more dangerously, miss the ones that are.

The Act defines four operator roles in Article 3, and the gap between them is large. A provider of a high-risk system carries the conformity assessment, technical documentation, registration and post-market monitoring burden. A deployer of the same system has a short, defined list of duties under Article 26. Importers and distributors sit in between, mostly checking that the provider did its job. This article shows you how to place yourself, and why the placement is not always permanent.

The four roles, defined

The definitions are in Article 3. They turn on what you do with a system, not what you call yourself.

Two details trip people up. First, "free" does not get a provider off the hook: placing a system on the market without charge still makes you a provider. Second, "under its own authority" is what makes a deployer. An employee using a tool their company chose is not the deployer; the company is.

The most common case: you are a deployer

Most businesses in scope of the Act are deployers. You licensed a CV-screening tool, a credit-decisioning model, a customer-service assistant, or a fraud-detection system from a vendor, and you use it. You did not build it and your name is not on it as the maker.

That is the lighter end of the Act. Your obligations live in Article 26 and are real but bounded: use the system according to the provider's instructions, assign competent human oversight, monitor operation and report serious incidents, keep logs, and inform the people affected. The full list is in our deployer obligations guide. The key point here is that you are not on the hook for the conformity assessment or the technical file. That is the provider's job, and one of your real duties is to confirm the provider actually did it.

When a deployer becomes a provider

This is where role analysis stops being a one-time exercise. Article 25 sets out three triggers that convert a deployer (or distributor, or importer) into the provider of a high-risk system, with all the provider obligations that follow:

1. You put your name or trademark on it. Rebrand a high-risk system already on the market as your own and you become its provider.
2. You substantially modify it. Change a high-risk system in a way that affects its compliance, after it is on the market, and you own the result.
3. You change its intended purpose so that it becomes high-risk. Take a system that was not high-risk, point it at an Annex III use case, and you have built a high-risk system in the eyes of the Act.

The third trigger is the quiet one. A general-purpose tool repurposed for, say, employee performance ranking can cross into high-risk territory, and the organisation that repurposed it, not the original vendor, becomes the provider. If you are fine-tuning, white-labelling, or materially adapting AI systems, run the Article 25 test deliberately rather than assuming you stayed a deployer.

Importers and distributors: the verification roles

If you sit in the supply chain for a system built outside the EU, you are likely an importer (Article 23) or distributor (Article 24). Neither role requires you to re-do the conformity assessment. Both require you to check that it happened.

An importer must verify, before placing a non-EU system on the market, that the provider carried out the conformity assessment, drew up the technical documentation, applied the CE marking, and appointed an EU authorised representative where required. A distributor must check that the CE marking and the required documentation are present, and must not make a system available if it has reason to believe it does not conform. Both must act, and notify authorities, if they learn a system on the market is non-compliant or presents a risk. In short: you are the EU market's check that a foreign provider met the bar, and you cannot knowingly pass on a system that did not.

How to place yourself, step by step

Do this per system, not per company.

1. Name the system and its intended purpose in one sentence. Roles are assigned system by system.
2. Ask who put their name on it as the maker. If that is you, you are the provider. If it is a third party, continue.
3. Ask whether you are using it under your own authority. If yes, you are at least a deployer.
4. Ask where it came from. First EU hand for a non-EU system means importer. Reselling without rebranding means distributor.
5. Run the Article 25 conversion test. Did you rebrand, substantially modify, or repurpose a high-risk system? If any is yes, you have become a provider regardless of where you started.
6. Record the conclusion and the reasoning. Role determination is the foundation of every other compliance decision you make about that system, so document it.

A note on scope: this guide deals with operator roles, not with whether a given system is high-risk in the first place. The two questions interact, because most of the heavier duties only bite for high-risk systems, but they are separate. Work out your role, then work out the risk tier using our risk classification guide. And because role boundaries on a specific deployment can be genuinely ambiguous, treat a borderline Article 25 call as a question for qualified legal advice, not one to settle from a guide.