Regulatory roles
EU AI Act provider vs deployer roles
The organisation's role is determined by what it does with a particular AI system. A company can be a deployer for one system and a provider for another.
Prepared by EU AI Fit editorial team · Published 24 August 2026 · Source review 31 August 2026
When are you likely to be a provider?
A provider develops an AI system or has one developed and places it on the market or puts it into service under its own name or trade mark. Substantial modification or changing an intended purpose can also affect the role analysis.
When are you likely to be a deployer?
A deployer uses an AI system under its authority in a professional context. Buying a third-party AI product does not remove responsibility for how the organisation configures, monitors and uses it.
What should the role record contain?
Record the system, contractual chain, branding, intended purpose, configuration, modifications and operational control. Explain the conclusion, list unresolved facts and identify who approved it.
Recommended next step
Assess the role separately for each system and use case; do not apply one organisation-wide label.
Run the free exposure checkRelated practical guides
Put the guidance into practice