Comparison
Provider vs deployer
Written with AI from the sources below and checked against our facts sheet. Last checked . How this site is made · Spot an error?
Part of: EU AI Act
The one-line rule
Provider: places the AI system on the market or into service under its own name. Deployer: uses it under its own authority. Rebrand, substantially modify or repurpose into high-risk, and the deployer becomes provider.
Side by side
| Provider | Deployer | |
|---|---|---|
| Definition | Develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark, paid or free (Art. 3(3)) | Uses an AI system under its own authority, except for purely personal, non-professional use (Art. 3(4)) |
| Typical example | A software firm selling a CV-ranking tool under its brand | An employer using that tool to shortlist applicants |
| Core high-risk duties | Art. 16: quality management system, technical documentation, conformity assessment, EU declaration of conformity, CE marking, registration, corrective action | Art. 26: use per the instructions, assign human oversight, check input data it controls, monitor, keep logs at least six months, inform workers and affected people |
| Human oversight | Builds oversight tools into the system, including a stop function (Art. 14) | Assigns people with the competence, training and authority to use them (Art. 26(2)) |
| Pre-use assessment | Conformity assessment before market placement (Art. 43) | FRIA before first use, but only for public bodies, private providers of public services, and credit scoring or life and health insurance pricing (Art. 27) |
| When something goes wrong | Corrective action and serious-incident reporting (Arts. 20 and 73) | Suspends use and informs the provider and the market surveillance authority (Art. 26(5)) |
| Transparency (Art. 50) | Chatbots tell people they are talking to AI; generated content is machine-marked | Discloses deepfakes and tells people when emotion recognition or biometric categorization is used |
When each applies
Roles follow conduct, not contracts or job titles. Ask two questions about each AI system.
First, whose name does the system carry when it reaches the market or goes into service? That organization is the provider, even if a contractor wrote the code. Building a system purely for your own internal use also makes you its provider, because you put it into service.
Second, who runs it, and under whose authority? That organization is the deployer. Configuring a purchased system within the provider's documented settings keeps you a deployer.
Article 25 can move the provider role down the chain. A deployer, distributor, importer or other third party becomes the provider of a high-risk system if it:
- puts its own name or trademark on a high-risk system already on the market, unless contracts allocate the obligations otherwise;
- makes a substantial modification so the system stays high-risk; or
- changes the intended purpose of a non-high-risk system, including a general-purpose one, so it becomes high-risk.
The original provider then stops being the provider of that system but must cooperate. The 2026 Digital Omnibus rewrote Art. 25(2) to list what it must share. The list covers technical documentation, known limitations and failure modes, and targeted technical access for testing. That duty lapses if the original provider clearly said its system must not be turned into a high-risk one.
Timing matters too. After the Omnibus, high-risk duties apply to Annex III systems from 2 December 2027 and to Annex I products from 2 August 2028. AI literacy (Art. 4) already applies to both roles for every AI system. See the EU AI Act hub for the full timeline.
Worked example
Ondra Systems, a fictional Dutch software company, builds a CV-ranking tool and sells it to employers under the Ondra brand. Recruitment tools are high-risk under Annex III point 4(a), so Ondra is the provider. It runs the conformity assessment, draws up the technical documentation, affixes the CE marking and registers the system.
Calloway Freight, a fictional Spanish logistics firm, licenses the tool to shortlist warehouse supervisors. Calloway is the deployer. It follows Ondra's instructions for use and trains two HR managers to oversee the rankings. It keeps the logs for at least six months and informs staff representatives before go-live. As a private employer, it does not need a FRIA.
A year later, Calloway retrains the model on its own hiring data in ways Ondra's assessment never covered. It renames the result "Calloway Match" and licenses it to partner firms. Either step alone can make Calloway the provider of Calloway Match under Art. 25. It now owes a new conformity assessment and every other provider duty. Ondra must cooperate but is no longer that system's provider.
The exam trap
The classic confusion is assuming the company that wrote the code is always the provider, and everyone downstream is a deployer. The Act asks a different question: whose name is on the system, and who changed what?
The tell has three parts:
- Rebranding, substantial modification or a new high-risk purpose in the stem means the answer is "becomes the provider".
- Adjusting settings within the provider's instructions means the role is unchanged.
- "The vendor's CE marking covers us" is wrong for a deployer. The marking covers the provider's obligations, not how the system is used.
Also watch for options that let a company hold only one role. A bank that builds and uses its own scoring model is both, and owes both sets of duties. Practice the role flips in lesson II.C.7 and the deployer checklist in lesson II.C.6.
Frequently asked questions
Can a company be both a provider and a deployer?
Yes. A bank that builds its own credit-scoring model and uses it on customers holds both roles. It is the provider because it put the system into service under its own name. It is the deployer because it uses the system. As provider, it owes conformity assessment, technical documentation and CE marking. As deployer, it owes Art. 26 duties such as human oversight and log retention. Building a system only for internal use is enough to make you its provider.
Does using ChatGPT at work make my company a deployer?
Generally, yes. Using an AI system under your authority in a professional context makes you its deployer (Art. 3(4)). For an ordinary, non-high-risk use, the main duties are AI literacy (Art. 4) and, where relevant, Art. 50 transparency, such as disclosing deepfakes. Using a general-purpose tool for a high-risk purpose can go further. Under Art. 25(1)(c), changing a system's intended purpose so it becomes high-risk makes you its provider.
Who is responsible if a deployer misuses a high-risk AI system?
The deployer answers for its own Art. 26 duties, such as following the instructions for use and assigning competent human oversight. The provider's CE marking covers the system's design, not how a customer uses it. If the misuse changes the intended purpose or substantially modifies the system, Art. 25 can make the deployer the provider. Contracts can share out costs and tasks, but the law assigns roles by conduct.
Is a deployer the same as a user?
Not quite. The final EU AI Act text replaced the earlier term "user" with "deployer". A deployer is the organization or person using the system under its authority, outside purely personal, non-professional use. The AIGP Body of Knowledge also uses "user" for the individual working with the system, such as a nurse acting on a triage score. That individual is not a separate legal role under the Act.