What is the difference between a provider and a deployer under the EU AI Act?

A provider develops an AI system (or has it developed) and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. Providers carry most of the high-risk obligations, including the quality management system, technical documentation and conformity assessment. Deployers must use the system as instructed, assign human oversight, keep the logs under their control and, in some cases, carry out a fundamental rights impact assessment.

How it works

1. You are a provider if the AI carries your name or trademark, or you built it to sell or put into service.
2. You are a deployer if you use someone else's AI system in your business.
3. A deployer becomes a provider if it puts its own name on a high-risk system, substantially modifies it, or changes its intended purpose so it becomes high-risk (Article 25).
4. Either way, you need records showing what the system decided and who oversaw it.