Glossary · AI governance
Your AI Act duties depend on which side of the sale you stand.
Under the EU AI Act, the provider develops an AI system or model and puts it out under its name; the deployer uses it professionally under its own authority.
Back to the glossary01 · In plain words
In plain words
Under the EU AI Act, the provider develops an AI system or model and puts it out under its name; the deployer uses it professionally under its own authority.
The provider is the maker: the party that builds an AI system, or commissions its construction, and then releases it to the market or brings it into use under its own brand. The deployer is the professional user. One company can be both, for different systems, and a deployer can turn into a provider by changing what it bought.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Roles split the work. For a high-risk system, the provider carries the design duties: risk management, data governance, technical documentation, conformity assessment, registration and post-market monitoring. The deployer must use the system according to its instructions, assign trained people to oversee it, keep the logs under its control, monitor how it runs and, in some cases, carry out a fundamental rights impact assessment before first use (Article 27). A contract that leaves roles vague leaves both sides exposed to duties they assumed the other held.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Article 3(3) and 3(4)
- The legal definitions of provider and deployer.
- Articles 16 and 26
- What a provider and a deployer of a high-risk system must each do.
- Article 25
- When a distributor, importer or deployer becomes a provider, for example by putting its name on a high-risk system or making a substantial modification.
- The master services agreement
- Where buyer and vendor write down who holds which role, who keeps the logs and who supplies the instructions for use.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a triage tool retrained and rebranded
An Indian health-software firm builds an emergency triage scorer and licenses it to a hospital group in the Netherlands, which runs it in its own emergency departments. The firm is the provider; the hospital group is the deployer. A year later, the hospital group's data team retrains the scorer on local records, changes how it ranks patients, and licenses it to two partner clinics under its own brand. Under Article 25, that substantial modification and rebranding make the hospital group the provider of the changed system. The original firm must cooperate by handing over information, but it is no longer the provider of that modified version.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Data controller and processor
- GDPR roles about personal data. A deployer is often also a controller, but the AI roles follow a different test, and one company can hold different combinations.
- Importer and distributor
- Supply-chain roles for bringing into the EU, or making available there, a system that someone else provides.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- For each AI system, name the provider and the deployer in writing.
- Read vendor contracts for rights to modify or rebrand AI; using them can move you into the provider role.
- As a deployer, keep the instructions for use, the oversight assignments and the logs you control.
- Check whether you must run a fundamental rights impact assessment before first use.
- GuideAI role emulatorProvider or deployer? Describe your AI and see what's yours to evidence.
- GuideISO 42001 and the EU AI ActLaw vs standard, the risk tiers, dates, and the article-by-article map.
- GuideControllers, processors & DPOsWho decides, who processes, and when a DPO is required.
Sources: Regulation (EU) 2024/1689, Articles 2, 3, 16, 25, 26 and 27 and Annex III, as published on EUR-Lex.
Questions about Provider and deployer (AI)
Can a company outside the EU be a deployer under the Act?
Yes, in some cases.
Article 2 extends the Act to providers and deployers in third countries where the output of the AI system is used in the Union. A team in India using an AI tool to make decisions about people in the EU should check whether it is caught. Counsel should confirm how this applies to your contracts.
Who must run a fundamental rights impact assessment?
Certain deployers of high-risk systems.
Article 27 applies to deployers that are public bodies or private bodies providing public services, and to deployers of certain systems used for creditworthiness and for life or health insurance pricing. It is separate from a GDPR DPIA, though one can feed the other.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.