What is a deployer under the AI Act?
By Joey van Vliet, founderUpdated
In short
A deployer, under the EU AI Act, is an organisation that uses an AI system under its own authority, usually one that someone else placed on the market. If you use ChatGPT, Copilot or AI features in existing software, you are usually a deployer. The obligations are lighter than those of a provider.
Why the role matters so much
Whether you’re a provider or a deployer determines most of what the AI Act asks of you. A provider of a high-risk system keeps technical documentation, sets up risk management and data governance, provides logging and goes through a conformity assessment. A deployer doesn’t have to.
What a deployer does have to do: use the system according to the supplier’s instructions, take measures to support AI literacy among staff (Article 4), arrange human oversight where required, and in certain cases disclose that AI is involved, for example with generated images or text you publish (Article 50). For a high-risk AI system, further duties apply.
Which role are you in?
Four questions help:
- Do I place an AI system on the market under my own name or brand? Then you’re a provider.
- Do I have an AI system custom-built and use it under my own name in my own organisation? Then you’re usually a provider as well, and the builder isn’t (Article 3(3)).
- Do I put my name on a high-risk system, modify it substantially or change its purpose so that it becomes high risk? Then you become a provider (Article 25).
- Do I use a system I bought as the supplier delivers it, within my own organisation? Then you’re a deployer.
Why it matters in practice
Companies that build AI into their own product often assume they remain a user because they didn’t build the model themselves. But as soon as you offer customers an AI feature under your name, the responsibility shifts towards you.
So answer the question before anything is built, not afterwards. The difference in obligations, and so in work and cost, is big enough to influence a design decision. What else to arrange is covered in the AI Act and GDPR: what you need to sort out.
Frequently asked questions
When does a deployer become a provider?
Among other things, when you offer an existing AI system to others under your own name or brand, or when you change it so substantially that its intended purpose changes. A custom GPT you use internally doesn’t make you a provider. The same assistant under your logo in a customer portal can.
What obligations does a deployer have?
Using the system according to the supplier’s instructions, taking measures to support AI literacy among staff (Article 4), arranging human oversight where required, and in certain cases being transparent that AI is involved (Article 50). High-risk systems bring additional duties.
