Skip to content
L&L Synergy
Get in touch

HomeAI ActProviders and deployers

Providers and deployers Who the AI Act applies to and what deployers must do.

The AI Act distinguishes mainly between providers, who develop AI, and deployers, who use it. Most companies are deployers. Which obligations they have depends on what they use AI for.

Key points at a glance Obligations for all deployers

As of October 2026, checked against the text of the regulation. General information, not legal advice.

Who is who

  • Provider (Art. 3(3))

    Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name, including for its own use and free of charge.

  • Deployer (Art. 3(4))

    Uses an AI system under its own authority. Only purely personal, non-professional use is excluded.

  • Importers and distributors (Art. 3(6) and (7))

    Bring AI systems from third countries into the EU or make them available on the market.

  • Affected persons

    People to whom AI is applied. Among other things, they have a right to an explanation of certain decisions made with high-risk AI (Art. 86).

Territorially, the Act applies to providers that offer in the EU, to deployers established in the EU and to providers and deployers outside the EU if the output of their AI is used in the EU (Art. 2(1)).

Obligations for all deployers

  • Promote the AI literacy of employees (Art. 4).
  • Do not use prohibited practices (Art. 5).
  • Label deepfakes and certain texts, inform people about emotion recognition (Art. 50(3) and (4)).
  • Data protection and other laws continue to apply alongside (Art. 2(7)).

For the use of low-risk AI there is otherwise no obligation to obtain a permit, notify or register.

AI literacy under Art. 4 in detail

Art. 26 Additional obligations for high-risk AI.

Anyone who uses high-risk AI, for example in recruitment or credit assessment, has these obligations from 2 December 2027 (Annex III).

  1. Use as intended

    In line with the provider's instructions for use, with suitable technical and organisational measures (para. 1).

  2. Human oversight

    By people with the necessary competence, training and authority (para. 2).

  3. Suitable input data

    As far as you control the input data, it must fit the purpose and be sufficiently representative (para. 4).

  4. Monitor and report

    Monitor operation, report risks and serious incidents and suspend use where there are risks (para. 5).

  5. Keep logs

    Keep automatically generated logs for at least six months, as far as they are under your control (para. 6).

  6. Inform employees

    Before use in the workplace, inform employee representatives and the employees concerned (para. 7).

  7. Inform affected people

    Inform people when high-risk AI under Annex III takes decisions about them or helps to take them (para. 11).

  8. Cooperate with authorities

    Cooperate in all actions of the competent authorities (para. 12).

Public bodies, private providers of public services and deployers of AI for credit assessment or for life and health insurance must additionally carry out a fundamental rights impact assessment (Art. 27).

Get in touch

When a deployer becomes a provider

  • You put your name or brand on a high-risk AI system that is already on the market (Art. 25(1), point (a)).
  • You make a substantial modification to a high-risk AI system (Art. 25(1), point (b)).
  • You change the purpose of an AI system so that it becomes high-risk, for example when a general-purpose AI program is in future to select job applications (Art. 25(1), point (c)).
  • You have an AI system developed specifically for you and put it into service under your name. Then you can be a provider even without selling it (Art. 3(3) and (11)).

For systems that are not high-risk, the additional obligations as a provider remain manageable, above all transparency under Art. 50(1) and (2). Before we build an AI system for you, we clarify whether your company is only a user (deployer) under the AI Act or becomes a provider itself, because your obligations depend on it.

How we support you

  • User or provider?

    We go through your AI uses with you and clarify where your company is only a user (deployer) and where it becomes a provider itself. More on AI consulting.

  • Competence and oversight

    We work out with you what the people who work with AI or oversee it need to know. More on AI consulting.

For high-risk uses we also recommend a legal review in each individual case.

More topics on the AI Act

Frequently asked questions about providers and deployers

Who does the EU AI Act apply to?

To providers, deployers, importers and distributors of AI systems, regardless of company size. Companies outside the EU are also covered if their AI is offered in the EU or its output is used in the EU (Art. 2(1)).

Who counts as a deployer of AI systems under the AI Act?

Any natural or legal person, authority or body that uses an AI system under its own authority, except in the case of purely personal, non-professional use (Art. 3(4)). A company that uses an AI program for its work is therefore a deployer.

Are we a provider if we only use AI internally?

If you use a ready-made program, you are a deployer. If you have an AI system developed specifically for you and put it into service under your name, you can be a provider even where use is purely internal.

Does the EU AI Act also apply to small companies?

Yes, there is no size threshold. But SMEs benefit from relief, such as lower fine caps (Art. 99(6)) and support in building AI literacy (Art. 4(2)).

What obligations do deployers of low-risk AI have?

Mainly AI literacy under Art. 4, no prohibited practices and, where it applies, labelling under Art. 50. No permits or registrations are needed.

Would you like to clarify your role and obligations?

Tell us which AI uses you have or are planning. We will reply personally, free of charge and without obligation.

Get in touch

Keep reading

The AI Act at a glance AI consulting for companies