What is a deployer under the AI Act?
By Joey van Vliet, founderUpdated
In short
A deployer, under the EU AI Act, is an organisation that uses an AI system under its own authority that was developed and placed on the market by someone else. If you use ChatGPT, Copilot or AI features in existing software, you are usually a deployer. The obligations are lighter than those of a provider.
Why the role matters so much
Whether you’re a provider or a deployer determines most of what the AI Act asks of you. A provider of a high-risk system keeps technical documentation, sets up risk management and data governance, provides logging and goes through a conformity assessment. A deployer doesn’t have to.
What a deployer does have to do: use the system according to the supplier’s instructions, make sure staff have sufficient AI literacy (Article 4), arrange human oversight where required, and in certain cases disclose that AI is involved, for example with generated images or text you publish (Article 50). For a high-risk AI system, further duties apply.
Which role are you in?
Three questions help:
- Do I place this system on the market under my own name or brand? Then you’re a provider.
- Have I changed the system so that it does something other than what it was intended for? Then you’re probably a provider.
- Do I use it as the supplier delivers it, within my own organisation? Then you’re a deployer.
Why it matters in practice
Companies that build AI into their own product often assume they remain a user because they didn’t build the model themselves. But as soon as you offer customers an AI feature under your name, the responsibility shifts towards you.
So answer the question before anything is built, not afterwards. The difference in obligations, and so in work and cost, is big enough to influence a design decision. What else to arrange is covered in the AI Act and GDPR: what you need to sort out.
Frequently asked questions
When does a deployer become a provider?
Among other things, when you offer an existing AI system to others under your own name or brand, or when you change it so substantially that its intended purpose changes. A custom GPT you use internally doesn’t make you a provider. The same assistant under your logo in a customer portal can.
What obligations does a deployer have?
Using the system according to the supplier’s instructions, ensuring AI literacy among staff (Article 4), arranging human oversight where required, and in certain cases being transparent that AI is involved (Article 50). High-risk systems bring additional duties.
