Provider or deployer? The wrong answer derails your AI Act work.

The AI Act divides actors into roles: provider, deployer, importer, distributor. Which role you have determines which obligations apply.

Many SMBs don't know which role they have. That leads to them either doing too little — or the completely wrong things.

Two roles that matter for SMBs

Provider

You are a provider if you develop an AI system and place it on the market or put it into service. This applies regardless of whether it's under your own name or someone else's.

Examples:

• You build an AI chatbot with your own logic and training data.
• You create an AI agent workflow that you sell as a service.
• You fine-tune a foundation model and distribute the result.

Deployer

You are a deployer if you use an AI system in your operations. You haven't built it, but you're responsible for how it's used.

Examples:

• You use ChatGPT/Copilot in customer communication.
• You use your CRM's built-in AI features for lead scoring.
• You use a recruitment platform with AI screening.

Why it matters

Providers have significantly more obligations: risk management, technical documentation, quality systems, logging, conformity assessment (for high-risk), and more.

Deployers have fewer but still important obligations: use the system according to instructions, ensure human oversight, transparency toward affected persons, and report serious incidents.

If you think you're a deployer but are actually a provider, you miss obligations. If you think you're a provider but are actually a deployer, you spend resources on the wrong things.

The gray zone: modified SaaS

Many SMBs find themselves in a gray zone:

• You use a SaaS platform with AI features → deployer.
• But you've customized the AI with your own prompts, training data, or logic → may become provider.

Rule of thumb: if you've changed the system's intended purpose or substantially modified it, you're likely considered a provider for the modified version.

Examples:

• You use ChatGPT API and build your own customer service bot → provider.
• You use HubSpot's built-in AI lead scoring → deployer.
• You fine-tune an LLM with your customer data and deliver results → provider.

Classify per system

Don't make a global assessment ("we are deployers"). Assess each AI system separately.

Add a column to your AI register:

What it means in practice

If you are a deployer:

1. Follow the vendor's instructions.
2. Ensure human oversight.
3. Inform affected persons (transparency).
4. Log usage.
5. Report serious incidents.

If you are a provider:

1. Everything above, plus:
2. Risk management system.
3. Technical documentation.
4. Quality management.
5. Conformity assessment (high-risk).

Next step

Open your AI register. Add a column "Role." Assess each system: provider or deployer? Document the justification.

The right role assessment is the foundation for correct AI Act compliance work. The wrong assessment leads to wrong priorities.