You are a provider if you build an AI system or general-purpose model, or have one built, and release it under your own name or trademark. You are a deployer if you use an AI system under your authority. Many companies are both, depending on the system.
The definitions
Article 3 defines the roles this way:
- Provider: builds an AI system or general-purpose AI model, or has one built, and places it on the market or puts it into service under its own name or trademark, for payment or free.
- Deployer: uses an AI system under its authority, except in a purely personal, non-professional activity.
- Importer: established in the EU and places on the market a system bearing the name of a company established outside the EU.
- Distributor: makes a system available on the EU market without being the provider or importer.
Worked examples
A bank buys a credit scoring tool from a vendor and uses it on applicants. The vendor is the provider and the bank is the deployer.
A software firm builds a recruitment screening feature on top of a third-party model and sells it under its own brand. The firm is the provider of that system. The model vendor is a provider of a general-purpose model, which is a different role.
A company builds a chatbot for its own staff and never sells it. It built the system and puts it into service under its own name, so it is likely both provider and deployer. Check this with counsel.
Why the split matters
Most of the heavy duties for high-risk systems sit with providers: risk management, technical documentation, quality management, logging capability and post-market monitoring. Deployers have their own list, including using the system as instructed, assigning human oversight, monitoring, keeping logs under their control and informing affected people.
Knowing your role tells you which list to work from. It also tells you what to ask suppliers for.
When roles shift
A deployer can become a provider by putting its name on a high-risk system, making a substantial modification, or changing the intended purpose of a system so that it becomes high-risk. That is covered in a separate post on when a deployer becomes a provider.
A one page role register
For each AI system, record: name, vendor, who built it, whose brand it carries, where it is used, your role, and the contract that allocates responsibilities. Review it whenever you change a tool.
Roles also matter commercially. Customers will ask which role you hold when they send procurement questions, and your answer should match your records. If you say you are only a deployer but your own staff trained and branded the model, expect follow-up. Agree the wording internally once, store it with the register, and reuse it in contracts and questionnaires so answers stay consistent.
Quick check
I only use a vendor tool. Am I a provider?
Usually no, you are a deployer. That can change if you rebrand it, substantially modify it or repurpose it into a high-risk use.
Can I be both roles for one system?
Yes, if you build a system and use it yourself under your own authority.
Sources
Last reviewed: 19 October 2026.
