What are providers and deployers?
Provider and deployer are the two main roles the EU AI Act assigns to companies, and most obligations in the Act attach to one or the other. A provider is a person or company that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. A deployer is a person or company that uses an AI system under its own authority, except for personal, non-professional use. The Act also defines importers, distributors, and authorized representatives, whose lighter duties center on checking that the provider did its job.
A software vendor that sells a candidate screening tool is the provider. The staffing company that runs it is the deployer. A company that builds a tool for its own use is both.
How the provider and deployer roles work
For high-risk systems, the provider owns the design-time duties: the risk management system, data governance, technical documentation, logging capability, instructions for use, human oversight design, the conformity assessment, registration, and post-market monitoring. The deployer owns the use-time duties: following the instructions, assigning trained overseers, keeping logs, informing workers and affected people, and in some cases carrying out a fundamental rights impact assessment.
The roles can shift. Under Article 25, a deployer becomes the provider of a high-risk system if it puts its own name on an existing system, makes a substantial modification, or changes the intended purpose so that a system which was not high-risk becomes high-risk. When that happens, the original provider must hand over the documentation the new provider needs to comply. Fine-tuning an open-weight general-purpose model and releasing it can similarly make a company the provider of a new model, depending on how far the modification changes it.
Provider and deployer roles in practice
A logistics company compares two paths to an AI tool that assigns drivers to routes and flags fatigue risk. Buying the tool from a vendor makes the company a deployer: it must train dispatchers to override the tool, keep the logs, and inform the drivers’ representatives, while the vendor carries the conformity work. Building the tool in-house on an open-weight model running in the company’s own environment makes the company the provider as well, with the full documentation and assessment burden. In Kirk Tech Solutions engagements, this distinction is settled before any architecture decision, because it determines who writes the technical file and who answers the market surveillance authority.
What to watch for
- Putting your brand on a vendor’s system, even as a white label, makes you the provider.
- Repurposing a tool beyond its documented intended purpose can quietly move you into the provider role.
- Write the allocation of obligations into the contract, because the Act requires the parties to cooperate but leaves the specifics to them.
- A company that both builds and uses a system must meet both sets of duties and cannot choose the lighter one.