AI Act Roles: Provider vs Deployer, Importer, Distributor and Authorised Representative

AI Act roles decide which duties an organisation carries: the EU AI Act names six operators (Article 3(8)), and the provider vs deployer split decides most of them. Chapter III Sections 1 to 3, which hold the high-risk duties of all six roles, apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.

The roles are defined in Regulation (EU) 2024/1689, in force since 1 August 2024. The six operators of the EU AI Act keep those definitions, while Regulation (EU) 2026/1744, the Digital Omnibus on AI in force since 27 July 2026, changed role shifts and dates.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What Are the Six Operator Roles under the EU AI Act?

The EU AI Act defines six operator roles in Article 3(8): provider, product manufacturer, deployer, authorised representative, importer and distributor. Each role has its own legal test and its own point in Article 2(1):

Article 3(3) to 3(8) and Article 2(1) of Regulation (EU) 2024/1689, not amended by Regulation (EU) 2026/1744.

Provider and Deployer: The Two Roles with Most Duties

The provider develops an AI system or general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark; the deployer uses an AI system under its authority. The deployer definition excludes use in the course of a personal non-professional activity (Article 3(4)).

Importer, Distributor, Authorised Representative and Product Manufacturer

Four further operators sit between the provider and the market: the importer, the distributor, the authorised representative and the product manufacturer. The importer brings third-country-branded systems onto the Union market, the distributor makes systems available later in the supply chain, the authorised representative acts under a provider's written mandate, and the product manufacturer has no Article 3 definition (recital 87).

Article 2(1) addresses seven groups, points (a) to (g), so every operator has its own scope point in deciding who the EU AI Act applies to. Third-country providers and deployers fall within scope where the output produced by their AI system "is used in the Union" (point (c)).

The Roles Section of This Guide: Seven Pages and What Each Answers

Seven pages of this guide go deeper, one per operator role and one on how responsibilities move along the value chain:

Rows one to six cover Chapter III and Chapter V duties; row seven covers Article 25.

Provider vs Deployer: How the Act Separates the Two Roles

The provider vs deployer difference is development and market entry under one's own name against use under one's own authority (Article 3(3) and 3(4)). Each role has its own high-risk article, log provision and Article 50 duty:

The Defining Test: Development under Own Name or Use under Own Authority

A provider under the AI Act is any natural or legal person, public authority, agency or other body that develops an AI system or general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, "whether for payment or free of charge" (Article 3(3)). The Commission Q&A "Navigating the AI Act" (updated 20 October 2026) names a developer of a CV-screening tool as provider and a bank using it as deployer. Article 3(9) defines placing on the market as the first making available of an AI system on the Union market.

One Organisation, Two Roles: In-House Systems and Recital 83

An organisation that builds an AI system and uses it itself is both provider and deployer, because putting into service covers supply "for own use in the Union for its intended purpose" (Article 3(11)). Recital 83 adds that operators can act in more than one role at the same time and should fulfil all relevant obligations cumulatively. In our reading, the role is assessed for each AI system separately.

Which Operator Role Applies? A Six-Question Decision Logic

Six questions identify the operator role for one AI system, starting with who develops it and under whose name it reaches the market. They give an orientation, not a legal assessment, and every "yes" adds a role:

1. Check who develops the system, or has it developed, and places it on the market or puts it into service under its own name or trademark: the provider (Article 3(3)).
2. Check who, located or established in the Union, places a third-country-branded system on the market: the importer (Article 3(6)).
3. Ask who else makes it available on the Union market: a distributor (Article 3(7)).
4. Ask who holds a written mandate from a non-EU provider: the authorised representative (Article 3(5)).
5. Check whether it is a high-risk safety component of an Annex I Section A product under the manufacturer's name: the manufacturer is the provider (Article 25(3)).
6. Ask who uses it under its authority outside a personal non-professional activity: the deployer (Article 3(4)).

Before changing a high-risk system, importers, distributors and deployers also check the three Article 25(1) triggers.

When an Importer, Distributor or Deployer Is Treated as the Provider

A distributor, importer, deployer or other third party is considered the provider of a high-risk AI system in three cases listed in Article 25(1): its own name or trademark, a substantial modification, or a change of intended purpose that makes the system high-risk. Point (a) applies without prejudice to contracts allocating the obligations otherwise, point (b) only where the system remains high-risk, and point (c) also to general-purpose AI systems. The draft guidelines of 19 May 2026 on high-risk classification state that merely asserting, for example in terms of service, that high-risk uses are excluded is insufficient to keep a system from being considered high-risk.

The initial provider "shall no longer be considered to be a provider of that specific AI system" (Article 25(2)). Since 27 July 2026, its cooperation with the new provider expressly covers (a) technical documentation sufficient to assess compliance with Article 16, (b) known limitations and failure modes and (c) targeted technical access, including for testing and validation, unless it clearly specified that its system is not to be changed into a high-risk AI system.

Article 25(3) separately makes the manufacturer of an Annex I Section A product the provider of a high-risk AI safety component placed on the market or put into service under its name or trademark. Machinery under Regulation (EU) 2023/1230 has sat in Annex I Section B, point 21, since 27 July 2026, so Article 25(3) no longer covers it.

High-Risk Duties per Role: Main Article, Retention Period and Fine Line

Each operator of a high-risk AI system has its own article: the provider Article 16, the deployer Article 26, the importer Article 23, the distributor Article 24, the authorised representative Article 22 and the product manufacturer Article 25(3). These duties attach only once a system qualifies as one of the high-risk AI systems, under Article 6(1) through Annex I or Article 6(2) through Annex III. The provider carries the widest set:

Article 25(2) and (4) duties: Article 99(4), point (da), since 27 July 2026.

Only some deployers carry out a fundamental rights impact assessment: bodies governed by public law, private entities providing public services and deployers of Annex III points 5(b) and 5(c) systems (Article 27(1)).

When the Role Duties Apply: Application Dates after the Digital Omnibus

The high-risk role duties apply later than the rest of the act, because Regulation (EU) 2026/1744 replaced Article 113, third paragraph, point (c), and deferred Chapter III Sections 1 to 3, except Article 6(5), separately for Annex III and Annex I systems. Duties outside those sections follow their own dates:

The deferral is adopted law, not a proposal: the Digital Omnibus on AI moved the role duties back without changing the Article 3 definitions. Before 27 July 2026, the same duties were due on 2 August 2026 for Annex III systems and on 2 August 2027 for Annex I systems.

Fines per Role: The Article 99(4) Tiers for Operator Duties

Breaches of operator duties carry fines of up to EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher, with one point of Article 99(4) per role, from point (a) for providers to point (e) for deployers. These are the maximum fines that the penalty rules of the Member States, laid down under Article 99(1), must provide for.

Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request carries up to EUR 7 500 000 or 1 % of total worldwide annual turnover, whichever is higher (Article 99(5)), and the guide to EU AI Act penalties sets out every tier. SMEs, including start-ups, face the lower of the two amounts in each tier of Article 99(3) to (5) (Article 99(6)); small mid-caps only in the Article 99(4) and (5) tiers (Article 99(6a)).

Duties outside the High-Risk Tier: Articles 4 and 50 by Role

Providers and deployers carry two duties that do not depend on high-risk classification: AI literacy measures under Article 4 and transparency under Article 50. The Article 5 prohibitions bind every operator, points (a), (b) and (c) to (h) since 2 February 2025 and points (ba) and (bb) and Article 5(1a) and (1b) from 2 December 2026.

Article 4: Staff Measures for Providers and Deployers

Since 27 July 2026, providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and other persons dealing with the operation and use of AI systems on their behalf (Article 4(1)). The obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual", and the guide to AI literacy under Article 4 explains what providers and deployers must do.

Article 4 is not listed in Article 99(4). Before 27 July 2026, it required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy".

Article 50: Marking by Providers, Labelling by Deployers

Article 50 splits transparency by role: providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text mark the output in a machine-readable format (Article 50(2)), and deployers disclose deep fakes and, subject to the exceptions in Article 50(4), AI-generated or manipulated text published to inform the public on matters of public interest. A deep fake is image, audio or video content only (Article 3(60)).

Article 50 applies since 2 August 2026. The transparency obligations under Article 50 also cover chatbots, emotion recognition and biometric categorisation.

How to Determine Your Role: Compliance Steps and Checklist

Five steps determine the role for each AI system before the high-risk duties apply, from inventory to duty mapping:

1. List every AI system the organisation develops, buys, imports, resells or uses.
2. Assign the operator role per system under Article 3(3) to (8).
3. Check the Article 25(1) triggers before rebranding, substantially modifying or repurposing a high-risk system.
4. Agree in writing with each supplier the information, capabilities, technical access and other assistance a high-risk provider needs (Article 25(4)).
5. Map each role to its article, retention period and application date.

A step-by-step programme for providers and deployers is set out in the guide to EU AI Act compliance.

Since 27 July 2026, the Article 25(4) agreement also covers suppliers of AI models, next to AI systems, tools, services, components and processes.

Each duty then needs an owner and a date, and the EU AI Act checklist by role sorts the obligations by role and risk class.

AI Act Roles: Related Questions

Articles 3(4), 2(1), 3(68) and 96(1) answer the questions on deployers, non-EU operators, model providers and Commission guidance.

Who Is a Deployer under the AI Act?

A deployer is any person or body that uses an AI system under its authority outside a personal non-professional activity (Article 3(4)). Its high-risk duties are the deployer obligations in the twelve paragraphs of Article 26.

Do Non-EU Providers and Deployers Have Duties?

Yes: non-EU providers have duties when they place AI systems or general-purpose AI models on the Union market (Article 2(1), point (a)), and non-EU providers and deployers when the output of their AI system is used in the Union (point (c)).

The guide to the EU AI Act for non-EU companies explains when non-EU providers must comply. Non-EU providers of high-risk AI systems appoint an authorised representative by written mandate first (Article 22(1)).

Which Duties Apply to Model Providers under Chapter V?

A provider of a general-purpose AI model is a provider under Article 3(3) and therefore an operator, with the Chapter V duties applying since 2 August 2025.

The obligations for general-purpose AI models sit in Articles 51 to 56. A provider of an AI system that integrates an AI model, its own or another entity's, is a downstream provider (Article 3(68)).

Is There Commission Guidance on the Roles?

Role guidelines are required by Article 96(1), point (a), as amended by Regulation (EU) 2026/1744, but the Commission guidelines overview, last updated 31 July 2026, lists them as forthcoming.

Point (a) covers the requirements and obligations in Articles 8 to 15 and in Articles 25 and 26, and the register of EU AI Act guidelines tracks the forthcoming value-chain, substantial-modification and provider and deployer guidelines.

Frequently Asked Questions about AI Act Roles

How many operator roles does the AI Act define?

Six: provider, product manufacturer, deployer, authorised representative, importer and distributor (Article 3(8)). Article 25(1) can make a distributor, importer or deployer the provider of a high-risk AI system.

Can one organisation be both provider and deployer?

Yes. An organisation that develops an AI system and puts it into service for its own use is both, and recital 83 expects all relevant obligations to be fulfilled cumulatively.

Does using an AI system privately make someone a deployer?

No. Article 3(4) excludes use "in the course of a personal non-professional activity", so a person using an AI system privately carries no deployer duties.

Does a distributor have a document retention period?

No. Article 24 sets none, while importers keep a copy of the notified-body certificate, the instructions for use and the EU declaration of conformity for 10 years (Article 23(5)).

Is the product manufacturer a separate role from the provider?

Yes. It is listed in Article 3(8) without an Article 3 definition, and Article 25(3) makes it the provider of a high-risk AI safety component of an Annex I Section A product placed under its name or trademark.