In short: An EU AI Act provider builds an AI system, or has it built, and offers it under its own name. A deployer uses an AI system in its work. Most companies that buy AI tools are deployers. Deployers of high-risk AI still have real duties: use it as instructed, keep human oversight, monitor it and keep the logs.
You bought an AI tool so your team could work faster, and the vendor takes care of the technology. It’s tempting to think the vendor takes care of the EU AI Act too. Partly, they do. But the law gives the company that uses AI its own role, with its own duties. Knowing which role you have is the first step to knowing what you must do.
What is the difference between a provider and a deployer?
A provider makes an AI system available under its own name, and a deployer uses one in its work. That’s the short version of the definitions in Article 3 of the EU AI Act. A provider develops an AI system, or has it developed, and puts it on the market or into service under its own name or brand. Paid or free makes no difference. A deployer is any person or organisation that uses an AI system under its own authority. Only purely personal use falls outside it. Take a tool that screens job applications. The company that builds and sells it is the provider. The retailer whose HR team uses it to rank applicants is the deployer. One organisation can also be both. If you build a chatbot yourself and use it on your own website, you’re the provider and the deployer of that chatbot.
The law has a few more roles, such as importers and distributors. For most companies, provider and deployer are the two that matter.
When does a deployer become a provider?
A deployer becomes a provider when it takes over the provider’s part of the job. Article 25 names three cases for high-risk AI. You put your own name or brand on a high-risk system that’s already on the market. You make a substantial change to a high-risk system, and it stays high risk. Or you change what a system is used for, so that it becomes high risk. That last case is the one to watch. Say you use a general chatbot for customer questions. Then a manager starts using it to sort job applicants. The use has changed, and you may now count as the provider of a high-risk system. That means the full set of provider duties, such as risk management, technical documentation and a conformity assessment.
The same logic applies when you build your own app on top of a vendor’s language model. The vendor provides the model. The app you offer under your name is your AI system, so you’re its provider.
What must a deployer of high-risk AI do?
A deployer of high-risk AI must use it with care and keep watching it. Those duties are in Article 26, and they don’t go away because the provider did its part. In short, these are your duties.
- Use the system as the provider’s instructions for use describe.
- Give human oversight to people with the skills, training and authority to step in.
- Make sure the input data you control is relevant and fits the people it’s used for.
- Monitor how the system works. Tell the provider and the authorities about a serious risk or incident.
- Keep the logs the system creates for at least six months, as far as you control them.
- Tell workers before you use high-risk AI at work. Tell people when it helps make decisions about them.
Some deployers must also assess the impact on people’s basic rights before they start, under Article 27. This covers public bodies and private companies that provide public services. It also covers anyone using AI for credit scoring or for pricing life and health insurance.
What applies if your AI isn’t high risk?
If your AI isn’t high risk, you have far fewer duties, but not none. The main ones are about being open. Under Article 50, providers must make sure people know they’re talking to an AI system, unless that’s obvious. Deployers who use emotion recognition must tell the people involved. Deployers who publish deepfakes must say the content is generated or altered. The same goes for AI-written text on matters of public interest, unless a person reviewed it and takes editorial responsibility. Other laws, such as the GDPR, still apply in full.
Check the timing too. The original timetable made the high-risk duties apply from 2 August 2026. In November 2025, the European Commission proposed moving part of them to a later date, in a package called the Digital Omnibus. Check the Commission’s AI Act page for the dates that apply to you now.
What this means for your team
You’re responsible for your AI, even when you didn’t build it. Being a deployer doesn’t move that responsibility to your vendor. It changes which duties you carry. Our advice: add a role column to your list of AI systems. For each system, write down whether you’re the provider, the deployer or both, and which risk category applies. Ask your vendors for their instructions for use. Then make sure you can watch the system yourself, with your own questions and your own data.
That last part is where many teams get stuck. A vendor tests its model in general. It doesn’t test how the model behaves with your prompts, your documents and your customers. VeritasAI does. The PRO plan runs an automated weekly test schedule, with tests mapped to the EU AI Act, ISO 42001, OWASP and NIST. You see where your AI performs well and where it struggles. You also get actionable feedback for your AI vendor or internal data science team. It doesn’t replace legal advice on your role. It does give you proof that you’re monitoring the system you use.
Show that you monitor the AI you use, not just the AI you build.
Frequently asked questions
Is a company that uses ChatGPT a deployer under the EU AI Act?
Yes, if staff use it for work. For most uses, such as drafting texts, the system isn’t high risk, so the duties are light. That changes if you use it for a high-risk purpose, such as screening job applicants.
Can a company be both provider and deployer?
Yes. A company that builds its own AI system and uses it itself is both. It then carries the provider duties and the deployer duties for that system.
Do deployer duties apply to companies outside the EU?
They apply to deployers based in the EU. They also apply to deployers outside the EU when the output of the AI system is used in the EU.
What fines can a deployer get?
Breaking the deployer duties can lead to fines of up to 15 million euros or 3% of worldwide yearly turnover, whichever is higher. For small and medium-sized companies, the lower of the two applies.
