Interactive
Which side of the AI supply chain are you on?
Before you can scope an AI management system, you need to know the part you play in each system's life. Two labels from Article 3 of the EU AI Act do most of the work. The provider is the organisation whose name an AI system carries when it is sold or released for use. The deployer puts an AI system to work in its own professional activity and decides how it is used. Pick a situation below, adjust it, and see what follows.
Back to ISO 42001 services01 · Why it matters
Your role changes what the auditor asks for
Same model, different evidence, depending on the seat you occupy.
| If you are | Your AIMS leans on | Questions to expect |
|---|---|---|
| The provider of a system | Life cycle, data and transparency controls (A.6, A.7, A.8) | How was it tested before release? What do users learn about its limits? |
| The deployer of a system | Responsible use and supplier oversight (A.9, A.10) | Who approved this tool? Which data may staff feed into it? |
| Both, for different systems | Each system scoped under its own role | Does the inventory say which hat you wear, line by line? |
02 · Try it
Test your own setup
Choose the nearest situation, then switch options on or off. The page address keeps your choices.
01 Start from a situation
Pick the closest match. Everything stays editable.
02 Describe your AI
Each AI system gets its own answer, so one company often wears both hats.
The result is a sketch, not a legal finding. In a real AIMS, the role for each system is decided by people who know the contracts, and written into the scope statement.
03 · Role switches
How a deployer can become a provider without noticing
Article 25 moves the provider label in three situations.
- Your brand goes on it. You put your name or trademark on a high-risk system that another company built.
- You rework it heavily. You make a substantial modification to a high-risk system already on the market, and it remains high risk.
- You change its job. You repurpose a system, including a general-purpose one, for a use that makes it high risk.
Once that happens, the original maker stops being treated as the provider of that system. It is still expected to cooperate and pass on the technical information you need, unless it stated plainly that the system must not be turned into a high-risk one.
Illustrative: the recruiting shortcut
A staffing agency subscribes to a general text model to draft emails. A team lead then wires it up to shortlist candidates. Recruitment is an Annex III use, so the agency now holds provider duties for that new system, though nobody signed anything new.
04 · Other roles
The rest of the cast
The Act and ISO/IEC 22989 name more parts than most companies need.
- Importer
- An EU-based company that brings in a system carrying the name of a provider established outside the Union.
- Distributor
- Anyone else in the chain who makes a system available in the EU without being its provider or importer.
- Authorised representative
- An EU-based party a non-EU provider appoints in writing to act for it under the Act.
- AI producer (ISO/IEC 22989)
- The designer or developer who builds the system, which may differ from the brand that sells it.
- AI customer and AI partner (ISO/IEC 22989)
- The organisation that uses the system, and the integrators, data suppliers and evaluators around it.
- AI subject (ISO/IEC 22989)
- The person the system's output is about, such as an applicant, borrower or patient.
ISO 42001 asks you to work out your roles as part of understanding your context (clause 4). For most Indian SaaS and services firms, provider and deployer cover it.
05 · Next step
From a label to a written scope
Four moves that turn the answer above into AIMS material.
- List each AI system: product features, internal tools and anything built for clients.
- Write the role next to each line, and the contract or fact that settles it.
- Flag any system that one of the three Article 25 triggers could catch.
- Carry the list into the AIMS scope and the Statement of Applicability, so controls follow the role.
Sources: Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3, 25 and 26 and Annex III; ISO/IEC 22989:2022, AI concepts and terminology (public role names); public clause and Annex A titles of ISO/IEC 42001:2023.
Questions about AI roles
We only call a model vendor's API. Is the vendor the provider of our feature?
The vendor supplies the model; you supply the feature.
Your customers use a system that carries your name, so you are its provider. The vendor belongs in your supplier controls, and its certificates speak for its own operations, not for your guardrails or disclosures.
Does the playground decide our legal role?
No. It points you at the right questions.
Roles turn on facts the tool cannot see: contracts, branding and intended purpose. Use the result to start the conversation, and let counsel settle borderline cases.
A customer resells our AI tool under its own brand. Who is the provider?
For a high-risk system, the label can move to them.
Under Article 25, putting a name on someone else's high-risk system makes that company the provider. Your contract should say who holds which duties, and what technical information you will hand over.
Staff use general chat assistants to draft documents. Are we a deployer?
Yes, for that use.
Only personal, non-professional use falls outside the definition. Drafting at work is usually minimal risk, so the duties are light: AI literacy for staff and clear rules on what data may go in.
Settle the role, then the scope.
Our ISO 42001 readiness assessment records your role for each AI system and builds the AIMS scope around it.