Are we a provider or a deployer under the EU AI Act?
Short answer
A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses an AI system at work. Most businesses are deployers. But if you build a chatbot or an AI feature into your own product using, say, OpenAI's or Anthropic's model, you are typically the provider of that AI system. And you can become the provider of a high-risk AI system if you put your name on it, modify it substantially or use it for a new high-risk purpose (Article 25).
The two roles
| Provider | Deployer | |
|---|---|---|
| Who? | Develops AI and places it on the market under its own name | Uses AI at work |
| Example | OpenAI, Anthropic, a SaaS company with its own AI feature | An online shop that uses ChatGPT for customer service |
| Obligations for high-risk AI | Quality management, technical documentation, CE marking, registration | Use according to the instructions, human oversight, logs, informing people |
The pitfall: when the user becomes the provider
Article 25 says that you become the provider of a high-risk system if you put your name or trademark on it, modify it substantially, or use a system that wasn't high-risk for a high-risk purpose. An example: you build a small tool on top of a language model that screens job applicants – and sell it to others.
General-purpose AI models
The models behind ChatGPT, Claude, Gemini and Mistral are general-purpose AI models. The rules for them apply to the providers of the models, not to you as a user. Read more about general-purpose AI models.
What to do
- Do you use someone else's AI for your own tasks?Then you are a deployer.
- Do you offer AI to others under your name?A chatbot on your website or an AI feature in your app typically makes you the provider of that system.
- Are you changing the purpose?If you use a general-purpose AI for a high-risk purpose, you can become the provider of a high-risk system (Article 25).
- Record the role in your inventory.For each use of AI.
What the law says
- Article 3(3) and (4) AI Act – provider and deployer
- The definitions of the two most important roles.
- Article 25 AI Act – responsibilities along the AI value chain
- When a deployer or another party becomes the provider of a high-risk system. Clarified by the Digital Omnibus.
Questions and answers
We have a chatbot on our website built on GPT. What are we?
Typically the provider of the chatbot. Among other things, you must make sure users can see they are talking to an AI (Article 50(1)).
Are we a provider if we make a GPT or a Claude project for internal use?
Usually not. Using a tool internally that you don't place on the market makes you a deployer.
What does the role mean for fines?
The fine caps are the same, but the obligations differ. Providers of high-risk AI have far more requirements than deployers.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.