# What is the difference between an AI Act provider and a deployer? URL: https://ergostrat.com/en/ai-act-readiness/provider-vs-deployer.html Language: [Български](https://ergostrat.com/ai-act-readiness/provider-vs-deployer.html) · [English](https://ergostrat.com/en/ai-act-readiness/provider-vs-deployer.html) · [Français](https://ergostrat.com/fr/ai-act-readiness/provider-vs-deployer.html) · [Deutsch](https://ergostrat.com/de/ai-act-readiness/provider-vs-deployer.html) The role follows the particular system and what you do with it. Using a ready-made tool and supplying a system under your own name are different actions. Paying for a subscription alone does not settle every question. ## Who is a provider under Article 3? A provider develops or commissions an AI system or general-purpose AI model and places it on the market under its own name or trademark, or puts the AI system into service under its own name. Supply can be paid or free. You need not have written the code or resell a subscription. Commissioning development for your own use can also raise the provider question. Check development, naming and putting into service for the particular system. For a high-risk system, the provider has duties for risk management, documentation and conformity assessment. The declaration under Article 47 and CE marking under Article 48 are not general requirements for every AI tool or model. The Article 43 procedure depends on the category; do not assume it always means self-assessment or always requires an external certificate. ## Who is a deployer under Article 3? A deployer uses an AI system under its own authority, outside personal non-professional activity. This can include using someone else’s CRM assistant, writing tool or chatbot. Buying access alone does not automatically make you the provider of the underlying product. Check, however, what you commissioned, modified and supplied under your own name. A ready-made component does not exclude other roles for the system you integrate it into. The register should describe the particular use, not just the product’s brand name. AI literacy under Article 4, transparency under Article 50 and high-risk duties have different conditions. Article 26 concerns deployers of high-risk systems. Check the applicable date and transitions too. ## When do you take on a provider’s duties? Article 25 addresses a deployer, importer, distributor or other third party taking on responsibilities for a high-risk system: - You put your name or trademark on a high-risk system already placed on the market or put into service, taking account of the provision’s contractual-allocation caveat. - You make a substantial modification to an existing high-risk system and it remains high-risk. - You change the intended purpose of an existing system not classified as high-risk so that it becomes high-risk under Article 6. Not every configuration change or logo change establishes the same role. Record intended purpose, modifications and contractual relationships; assess the conditions for the particular case. A general-purpose model and the finished system are also distinct. ## What does a high-risk system’s deployer owe? Article 26 includes following instructions, competent human oversight and appropriate input data within your control. Monitor operation and follow the applicable rules on notification of risks or serious incidents and suspension of use. Keep automatically generated logs to the extent they are under your control, for a period appropriate to the intended purpose of at least six months, unless applicable Union or national law provides otherwise. This does not override data protection rules. For workplace use, inform affected staff and their representatives before use, in accordance with the applicable rules. The fundamental rights assessment under Article 27 covers specified deployers and high-risk uses, with the exception for Annex III point 2. Do not assume every deployer needs one or that it substitutes for the provider’s declaration. ## Questions ### We only pay for someone else’s tool. Are we a provider? The subscription alone is insufficient for that classification. Ordinary use under your authority points to a deployer role, but also check commissioned development, your own name, modifications and intended purpose. ### Can a company hold both roles? Yes. For example, you use someone else’s tool and offer another system under your brand. Assess the role for each system and activity; do not give the entire company a single label. ### Does a deployer sign a declaration of conformity? Not merely because it uses a system. The high-risk declaration duty belongs to the provider. Check whether your actions also create that role rather than rely solely on a subscription contract. ## Sources - [Regulation (EU) 2024/1689 — AI Act.](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) - [Regulation (EU) 2026/1744 — amendments.](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng) ## Related reading - [Are there small-business exemptions under the AI Act?](https://ergostrat.com/en/ai-act-readiness/sme-exemptions.html) - [What are the fines for non-compliance with the EU AI Act?](https://ergostrat.com/en/ai-act-readiness/ai-act-fines.html) - [What is the difference between the AI Act and GDPR?](https://ergostrat.com/en/ai-act-readiness/ai-act-vs-gdpr.html) ## Record the role for each tool and use. EU AI Act Readiness organises tools, roles and applicable articles with sources and dates. Disputed legal classifications are identified for legal review. [Ask about EU AI Act Readiness](mailto:contact@ergostrat.com?subject=AI%20Act%20role%20question)