provider and deployer
In plain wordsThe two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes.
The two principal roles, or 'operators', to which the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models. assigns obligations. The provider is the party behind an AI systemAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it. or general-purpose AI modelgeneral-purpose AI model, n.: The EU's legal name for the large, adaptable AI models behind chatbots and similar tools: models that can turn their hand to many different jobs and be built into many other products.: whoever builds it, or has it built, and releases it under its own name or brand, placing it on the EU market or putting it into service, whether it charges for it or not; it carries most duties, including conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used. and post-market monitoringpost-market monitoring, n.: The duty of an AI system's maker to keep watching how it performs after release, gathering evidence from real use so that problems are found and fixed.. The deployer is any person, company or public body that uses an AI system under its own control, unless the use is private and non-professional. Deployers of high-risk systemshigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks. must follow the instructions for use, assign human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked., monitor operation, keep logs for at least six months, inform affected workers and, in some cases, carry out a fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm.. Roles are functional, not fixed: a deployer, importer or distributor that rebrands a high-risk system, makes a substantial modificationsubstantial modification, n.: A change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker. to it or repurposes a system for a high-risk use becomes its provider.
The bank is the deployer of the credit model; the vendor that sold it is the provider.
Origin
'Provider' follows EU product-safety law, where it parallels 'manufacturer'. The Commission's 2021 proposal called the using organization the 'user'; the Parliament's 2023 amendments renamed it 'deployer' to avoid confusion with end users, and the final text kept that term.
Usage note
The other operators are the authorised representative, importer, distributor and product manufacturer. A 'downstream provider' integrates someone else's general-purpose model into its own AI system. These roles apply alongside, and do not map neatly onto, the controller and processor roles of the General Data Protection RegulationGeneral Data Protection Regulation, prop. n.: The European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems..
Related
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
- general-purpose AI modelgeneral-purpose AI model, n.: The EU's legal name for the large, adaptable AI models behind chatbots and similar tools: models that can turn their hand to many different jobs and be built into many other products.
- conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used.
- fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm.
- substantial modificationsubstantial modification, n.: A change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker.
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 3(3) ('provider'), Art. 3(4) ('deployer'), Art. 3(8) ('operator'), Art. 3(68) ('downstream provider'); duties Arts. 16, 25 and 26
Mentioned in
high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks., AI systemAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it., human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked., inference providerinference provider, n.: A company that runs AI models on its own computers and sells access to them over the internet, charging by use, so customers need not buy or operate the hardware themselves., fundamental rights impact assessmentfundamental rights impact assessment, n.: A check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm., intended purposeintended purpose, n.: The use a maker says its AI system is meant for. In EU law, the rules that apply to a system depend largely on this declared purpose., post-market monitoringpost-market monitoring, n.: The duty of an AI system's maker to keep watching how it performs after release, gathering evidence from real use so that problems are found and fixed., substantial modificationsubstantial modification, n.: A change to an AI system after release that is big enough, under EU law, to require a fresh check — and that can make whoever made the change legally responsible as its maker.