Provider vs deployer: how AI startups map their EU AI Act role

Role determines which EU AI Act obligations attach to an organisation and system. This practical guide explains the categories in the Regulation and how a startup can document its analysis. It is general informational guidance, not legal advice.

What are the four main roles?

Article 3 of Regulation (EU) 2024/1689 defines a provider as the person that develops an AI system or model, or has one developed, and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority. An importer places a system bearing the name of a provider established outside the EU on the EU market, while a distributor makes a system available without being the provider or importer.

How does a startup determine its role?

Start with one row per AI system, model and product feature. Record the developer, name or trademark shown to customers, who makes the system available, who controls the use, where it is supplied or used, and whether another organisation sits in the supply chain. Compare those facts with the Regulation's definitions and retain the rationale.

Building your own model

A startup that develops a model and makes it available under its own name will generally assess provider responsibilities. If it also uses that model internally, the same organisation can have a deployer role for that use.

Integrating a third-party model

Using another provider's model through an API does not by itself make the startup the model provider. The startup may be a deployer for internal use, while the product context, branding, substantial modification and placing-on-market facts must be assessed for customer-facing use.

Embedding AI in a SaaS product

A SaaS company that offers an AI feature under its own product name should assess whether it is placing an AI system on the market or putting it into service as a provider. It may also be a deployer when configuring a supplier's system for its own operations.

How role connects to the amended timeline

The Act's general application date of 2 August 2026 included Article 50 transparency obligations and other applicable provisions, but it was not the general start date for the Annex III high-risk regime. Under amending Regulation (EU) 2026/1744, Sections 1, 2 and 3 of Chapter III apply from 2 December 2027 to high-risk systems classified under Article 6(2) and Annex III, and from 2 August 2028 to those classified under Article 6(1) and Annex I. A deadline should therefore be mapped to the organisation's role, the particular system, the relevant provision and applicable transitional arrangements.

Why the role matters

Provider and deployer duties are different, and importer or distributor duties add supply-chain checks. Risk tier, intended purpose, modifications, market route and affected users should be assessed together rather than inferred from a vendor label. The European Commission AI Act policy page provides current policy and implementation information.

Practical role-map checklist

• Identify each system, model, feature and intended purpose.
• Record provider, deployer, importer and distributor facts for each route.
• Capture branding, modifications, supplier terms and human oversight.
• Link the role decision to risk classification, evidence owners and review triggers.

For hands-on EU AI Act readiness support, ProtectifyAI can help map systems, roles and obligations. See also ISO 42001 implementation support for an organisation-wide AI governance system.

Common questions

What is a provider under the EU AI Act?

A provider is a natural or legal person that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its name or trademark.

What is a deployer under the EU AI Act?

A deployer is a natural or legal person using an AI system under its authority, except where the system is used in a personal non-professional activity.

Can a startup have more than one EU AI Act role?

Yes. A startup can be a provider for a product it develops and a deployer when it uses another provider's system internally. It may also become an importer or distributor depending on how it places a system on the EU market.

How should a startup determine its role?

For each system, record who developed it, whose name or trademark is used, who places it on the market or puts it into service, who controls the use, and how it enters the EU market. Compare those facts with the Regulation's definitions and keep the reasoning with the system inventory.