Reference
AI Act: are you the provider or the deployer?
When you commission a system with AI and publish it under your trademark, the provider the Regulation names is you, not whoever built it. Here is where that definition comes from, what is enforceable today, and what we put in writing before we write the first line.
What is enforceable today
The AI Act — Regulation (EU) 2024/1689 — applies in stages, and Regulation (EU) 2026/1744, the digital omnibus on AI in force since , moved part of the timetable. We cite the consolidated version on EUR-Lex, which incorporates that amendment.
- Articles 4 and 5
- Enforceable since : AI literacy and prohibited practices, for any system and whatever role you hold. The two prohibitions the omnibus added to Article 5 arrive later, on . It replaced Article 4 in full: today it requires measures to “support the development” of the AI literacy of staff and makes clear that it does not require guaranteeing any specific level of AI literacy of any individual.
- Article 50
- Enforceable since . Transparency: a system intended to interact directly with people informs them that it is an AI system, and synthetic content comes out marked in a machine-readable format and detectable as generated or manipulated. Whatever was already on the market before that date has until to comply with it, under Article 111.4. It runs in parallel with the high-risk regime, not instead of it.
- The high-risk regime, postponed
- Articles 6 to 27 — the whole high-risk regime — move to for Annex III and to for Annex I. What the postponement gives is time to get there: the conformity assessment has to be done before placing the system on the market or putting it into service.
What makes you the provider and what makes you the deployer
Article 3.3 defines the provider as whoever develops an AI system “or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark”. It does not require having built anything: commissioning the development and publishing it under your trademark puts you there from day one, and whoever built it is your supplier in the commercial sense, not in the sense of the Regulation.
Article 3.4 calls deployer whoever uses “under its authority” a system somebody else published: it is the role you stay in when you take out a licence for a commercial product and use it in your business. The distance between the two fits in one sentence: the provider answers for the system being conforming before it exists on the market; the deployer answers for how it is used.
For a system that was already on the market, Article 25 names three ways of becoming its provider: putting your name or your trademark on a high-risk one, substantially modifying it in such a way that it remains one, or changing the intended purpose of one that was not — a general-purpose one included — in such a way that it becomes one. Its point (a) allows contractual arrangements that allocate the obligations otherwise, and its paragraph 2 moves the role across: whoever initially placed it on the market is no longer considered the provider of that system.
What we put in writing before building
Who places the system on the market, and under what trademark
It is what decides each party's role, so it goes into the development contract ahead of the technical scope. From that follows who writes the technical documentation, who carries out the conformity assessment and who signs the EU declaration of conformity.
Whether your system falls under Annex III, and with what conclusion
Its eight areas are biometrics, critical infrastructure, education and vocational training, employment and workers' management, access to essential services, law enforcement, migration, asylum and border control management, and administration of justice and democratic processes. Article 6.3 allows the conclusion that a system on that list does not pose a significant risk where one of its four conditions is met, and 6.4 requires that assessment to be documented before placing it on the market or putting it into service, and to be handed to the authority that asks for it. Article 6.3 itself closes a door: an Annex III system that performs profiling of natural persons is always high risk.
What technical access we give you over what we build
Article 25.4 requires the information, the capabilities, the technical access and the assistance that the provider needs from whoever supplies it a component to be specified by written agreement. What we put into that agreement: the documentation of the component, its known limitations and failure modes, and the access for the validation testing your conformity assessment calls for.
Frequently asked questions
- I commissioned the development from a company. Who is the provider?
- If you place it on the market or put it into service under your own name or your trademark, you are: the Article 3.3 definition expressly includes whoever did not develop it, because it says “or that has an AI system or a general-purpose AI model developed”. We set it down in the development contract, because it decides who writes the technical documentation and who signs the declaration of conformity.
- I use the API of a commercial model. Does that make me a provider of a general-purpose model?
- No. Article 3.9 defines placing on the market as the first making available on the Union market, and that happened before you arrived. What can happen is that you are the provider of the system: if you integrate that model into one and publish it under your trademark, that role is yours, and with it another regime and other obligations.
- Does the Regulation ban generative AI?
- No. Article 5 is a closed list of specific practices, and none of them bans generative AI as such: the two the omnibus added to it reach the generation of non-consensual intimate material, not the technology. On hallucinations, the Commission clarified it in its Guidelines on prohibited artificial intelligence practices: a generative system that presents them incidentally may not be considered to deploy “deceptive techniques” within the meaning of that article, provided that you have informed users of its limitations, integrated safeguards to minimise them and do not intend it for sensitive contexts. What does exist for generated content is Article 50, and it is transparency: inform, mark, disclose.
- We work with free and open-source software. Does anything change?
- Something. Article 2.12 leaves systems released under a free and open-source licence outside the Regulation, unless they are placed on the market as high-risk systems or fall under Articles 5 or 50, which is a large “unless”. For general-purpose models, Article 53.2 lifts two obligations, and the licence is not enough: it also requires the weights, the architecture and the information on model usage to be made publicly available. The copyright policy and the public summary of the training content remain in place, and that exception does not reach models with systemic risk.
Where do we start?
Two ways to begin, depending on what you have in front of you today. Answered within one working day.