Who should comply with the AI Act?

AI systems are developed, sold, and deployed by a wide range of organisations, and for many different use cases. 

Some organisations build AI from the ground up and bring it to market, while others integrate AI into their products or use it internally to improve efficiency.

It is important to understand these different applications and roles, because the AI Act applies different rules and responsibilities depending on the role an organisation plays.

In this article, we will have a look at these roles defined by the AI Act, so you can identify which ones apply to your organisation's use of AI. Beware, that your organisation can hold more than one role in this regard.

Provider 

The AI Act defines a ‘provider’ as an organisation or individual that develops an AI system or AI model and makes it available for others, either by selling it, offering it for free, or deploying it under their own brand. 

Examples of well-known providers are OpenAI (creator of ChatGPT) and Google (creator of Gemini), because they develop AI models and offer them as a service to businesses, which could then use these in their own products. 

But your organisation could become a provider as well if it shares, sells, or distributes AI that you developed or significantly modified. This could happen if your organisation creates a machine learning tool for internal use and later decides to offer it to a sister organisation, a client, or the general market, or when a small software vendor builds a specialized algorithm and licenses it to other firms. 

Once an organisation becomes a provider, it assumes a set of responsibilities under the AI Act. These responsibilities involve documenting the design, purpose, and data sources for the AI system, as well as ensuring the model is used in a lawful and transparent way.

AI Act Definition of Provider

“[A] ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge”

Downstream Provider

A ‘downstream provider’ is a company that takes an existing AI model (either their own or from another provider) and integrates it into a product or service. They might modify or customise the AI before offering it to customers. 

Salesforce is an example of this, because they integrate AI-powered chatbots and analytics (such as AI models from OpenAI) into its CRM software, so their customers can use it to automate sales and support tasks.

Yet smaller businesses, e.g. offering a SaaS (software-as-a-service), can also become downstream providers if they license, adapt, or otherwise embed someone else's AI model into their own solutions and then distribute those solutions further. 

AI Act Definition of Downstream Provider 

[A] ‘downstream provider’ means a provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether the AI model is provided by themselves and vertically integrated or provided by another entity based on contractual relations. 

Deployer

A deployer is any organisation or individual that uses an AI system as part of their operations. This includes businesses, governments, or institutions that apply AI tools internally or in their delivery of services to their customers. 

Any organisation using AI tools, e.g. ChatGPT for text or image generation, falls into this category, because they are using an existing AI system without modifying or commercialising it. 

An example of this could be a hospital using an AI-powered diagnostic tool to help doctors detect diseases faster. The hospital would be a deployer under the AI Act, because it uses a ready-made AI system without altering or integrating the underlying model. 

AI Act Definition of Deployer

[A] ‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity.

Authorised Representative

An authorised representative is a person or company based in the EU that represents an AI provider located outside the EU. The task of the representative is to ensure compliance with the AI Act on behalf of the provider.

For example, if a provider of an AI system wants to offer AI solutions in the EU, they must appoint an EU-based legal entity to act as their authorised representative to ensure compliance with the AI Act.

AI Act Definition of Authorised Representative

[An] ‘authorised representative’ means a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation.

Importer

An importer is a company or individual based in the EU that imports AI systems developed by a company outside the EU and makes them available in the European market. This could be AI-powered physical products, such as smart devices, robots, or machinery. Importers must ensure that the imported AI systems comply with EU regulations before they are sold or used in Europe.

AI Act Definition an Importer

[An] ‘importer’ means a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.

Distributor

A distributor is a company that makes AI systems available on the market, but did not develop them and did not import them directly. Distributors are part of the supply chain and help make AI tools available to others, whether that’s to businesses or end users, without modifying the AI system itself. 

This could be, for example, an electronics retailer selling AI-powered devices that they procured from a vendor (such as a downstream provider who integrated AI into the device). A software reseller could also be a distributor if they sell licenses for software that has AI embedded in it.

AI Act Definition a Distributor

[A] ‘distributor’ means a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

Operator

The term operator is used in the AI Act as a broad category for the key roles involved in the AI system’s lifecycle. It includes providers, deployers, authorised representatives, importers, and distributors. These are the actors who either develop, place on the market, distribute, import, or professionally use AI systems. 

It does not include private end-users or consumers who simply interact with an AI system.

AI Act Definition an Operator

[An] ‘operator’ means a provider, product manufacturer, deployer, authorised representative, importer or distributor.

Product manufacturer

The term “product manufacturer” is used in the AI Act but is not specifically defined in Article 3, unlike other roles such as provider, deployer, importer, or distributor. However, “product manufacturer” is mentioned as one of the “operators” under the AI Act.

A product manufacturer is the company or person responsible for having a product manufactured, whether they produce it themselves or outsource the manufacturing process, as long as they place the product on the market under their own name or trademark. 

Definition of ‘manufacturer” in Regulation (EC) No 765/2008  

Example: Predictive Maintenance Solution

The following example is fictional and shows how the roles of the AI Act play out along a single supply chain, and how one organisation can hold multiple roles at once.

Provider

NeuralPredict Inc. (US) develops a general‑purpose failure‑prediction model and offers it via cloud API.

Authorised Representative

AI Act Compliance Partners LLP (IE), a Dublin‑based law firm, acts on behalf of NeuralPredict Inc. in the EU. They handle all AI Act regulatory filings, liaise with Member‑State authorities, and ensure NeuralPredict’s documentation and notifications stay up to date.

Downstream Provider & Product Manufacturer

SensorTech GmbH (DE) licenses the failure‑prediction model, fine‑tunes it on vibration and temperature data from heavy machinery, embeds it into its custom “SensorGuard edge‑analytics” unit, and sells the finished device under its own brand. SensorTech produces the hardware, assembles the units, manages risk assessments, prepares technical documentation, and secures CE marking.

Importer

SensorTech GmbH also imports a Chinese-made AI‑powered device called “MachinEye” which uses machine learning to monitor equipment health. They bring MachinEye into the EU, verify its CE mark and AI safety documentation, and then sell it under their German entity.

Distributor

EngiSupply BV (NL) supplies the “SensorGuard edge‑analytics” units to factories across Europe without altering hardware or software.

Deployer

AutoPartsCo Srl (IT) integrates “SensorGuard edge‑analytics” into its production lines to schedule maintenance proactively, using the device under the manufacturer’s instructions without modifying its software.

Action points

Your organisation must identify which role(s) it plays in relation to the AI Act, whether you develop, integrate, import, distribute or deploy AI, so you can meet each role’s specific requirements. In practice, you do this by listing all products and services sold to end-users or used for internal purposes, and look at whether AI is used. Next, you assess how AI is used to determine your role. While most will act as deployers (AI is often embedded in internal tools and SaaS), you should assess every potential role for each AI use case.