--- title: "AI Act Provider vs Deployer: Duties and Article 25 | Pitch" description: "Under the AI Act, the provider builds or brands an AI system and the deployer uses it. Each role's duties, and when Article 25 makes a deployer a provider." url: https://pitch.law/academy/provider-vs-deployer-ai-act --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI Act Provider vs Deployer: Duties and Article 25 Under the AI Act, the provider builds or brands an AI system and the deployer uses it. Each role's duties, and when Article 25 makes a deployer a provider. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 25 February 2026 - Updated 30-10-2026 ## The legal framework The AI Act ([Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)) places obligations on operators according to their role in the value chain. Article 3 defines the main roles: - **Provider**: a person or body that develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. - **Deployer**: a person or body that uses an AI system under its authority, except for personal non-professional activity. - **Importer**: an operator established in the EU that places on the market a system bearing the name of a person established outside the EU. - **Distributor**: an operator in the supply chain, other than the provider or importer, that makes a system available on the EU market. - **Authorised representative**: a person in the EU appointed by a provider established outside the EU. For high-risk systems, the provider carries the heaviest load under Article 16: a risk management system, data governance, technical documentation, record-keeping, transparency towards deployers, human oversight by design, accuracy and robustness, a quality management system, a conformity assessment, the EU declaration of conformity, CE marking and registration. See [conformity assessments](https://pitch.law/academy/conformity-assessments-high-risk-ai-systems). The deployer's duties are set out in [Article 26](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689#art_26). They include using the system according to the instructions for use, assigning human oversight to competent and trained persons, ensuring that input data under the deployer's control is relevant and sufficiently representative, monitoring operation, keeping the automatically generated logs for at least six months, informing workers' representatives and affected workers before a high-risk system is used in the workplace, and informing natural persons that they are subject to the use of a high-risk system. Certain deployers, such as public bodies and those using AI for credit scoring or life and health insurance pricing, must carry out a fundamental rights impact assessment under Article 27. ### When a deployer becomes a provider [Article 25](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689#art_25) treats a deployer, distributor or other third party as the provider of a high-risk system if it: - puts its name or trademark on a high-risk system already on the market; - makes a substantial modification to a high-risk system so that it remains high-risk; or - changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. The original provider is then no longer treated as the provider of that system, but must cooperate with the new provider. [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744) spells out this duty to cooperate in more detail, including providing documentation and technical access, and extends the written agreements required between provider and suppliers of components to AI models. It also allows the original provider to exclude the duty by stating expressly that the system must not be turned into a high-risk system. ## In practice A Mechelen logistics company buys a licensed scheduling tool that allocates shifts to drivers. Shift allocation based on personal traits or behaviour falls under employment in Annex III. The company is a deployer. It must follow the supplier's instructions, appoint trained people for oversight, keep logs and inform the works council and the drivers. A Leuven start-up takes a general-purpose language model from a large provider and builds a tool that ranks job applicants under its own brand. The start-up is the provider of the resulting high-risk system. The model provider is not, but must give the start-up the information required under the rules for general-purpose models. A consultancy firm takes an HR tool from a vendor, rebrands it and resells it to clients. By putting its own name on the system, it becomes the provider under Article 25 and takes on the full set of provider duties. Roles apply per system, and one company can be a provider of one system and a deployer of another. A register that records role per system avoids surprises ([our register](https://pitch.law/technologies/ai-act-governance-toolkit)). Because deployer duties also involve personal data, they connect to your [records of processing](https://pitch.law/technologies/privacy-register). ## Frequently asked questions ### Is a company that fine-tunes a model a provider? Possibly. If it places a system under its own name on the market or puts it into service, it is a provider of that system. Whether it also becomes a provider of the model depends on the extent of the changes. ### Does a company outside the EU have to comply? Yes, if the system is placed on the EU market or its output is used in the EU. Providers outside the EU of high-risk systems must appoint an authorised representative. ### Can the roles be allocated by contract? The contract can distribute information and cooperation duties, but not change the legal role. A supplier cannot contract a deployer out of its Article 26 duties. ### Does a deployer need to ask the provider for anything? Yes: the instructions for use and the information needed to meet its own obligations. Ask for it in the purchase agreement. ## How this connects Our [AI Act compliance](https://pitch.law/solutions/ai-act-compliance) service starts by determining your role per system. The [risk classification](https://pitch.law/academy/ai-act-risk-classification-explained) tells you whether these duties apply at all, and the [timeline](https://pitch.law/academy/ai-act-compliance-timeline) tells you from when. ## In short - Duties differ by role, per system - Providers carry the heaviest load for high-risk AI - Deployers have their own duties under Article 26 - Rebranding or modifying a system can make you a provider ## Related solutions - [Solutions](https://pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://pitch.law/technologies/privacy-register) ## More in Legal Aspects of Artificial Intelligence - ### [EU AI Act Timeline: Every Date from 2024 to 2030](https://pitch.law/academy/ai-act-compliance-timeline) [The AI Act applies in stages from 2 February 2025 to 31 December 2030. Every date, what applies and who it affects, with the 2026 high-risk postponement.](https://pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification: the Four Risk Levels](https://pitch.law/academy/ai-act-risk-classification-explained) [The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in.](https://pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts: 9 Terms to Negotiate](https://pitch.law/academy/ai-clauses-in-vendor-contracts) [The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability.](https://pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI Act in HR and Recruitment: the High-Risk Rules](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Recruitment and HR AI is usually high-risk under the AI Act (from 2 December 2027), and emotion recognition at work is banned. What employers must do.](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data and Copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)