Art. 3(3)
Provider
DefinitionA natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge.
ExampleA software company selling a CV-screening tool; a bank that builds its own credit-scoring model and uses it under its own name.
Main duties
- Art. 16: comply with the high-risk requirements of Art. 9 to 15, keep documentation and logs
- Art. 43, 47, 48: conformity assessment, EU declaration of conformity and CE marking for high-risk systems
- Art. 49: registration in the EU database before placing a high-risk system on the market
- Art. 50(1) and (2): disclosure of AI interaction and machine-readable marking of synthetic content
- Art. 72 and 73: post-market monitoring and serious-incident reporting
Art. 3(4)
Deployer
DefinitionA natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity.
ExampleAn employer using a vendor's recruiting tool; a clinic running a vendor's triage system; a company with a chatbot on its website.
Main duties
- Art. 4: take measures to support the AI literacy of staff
- Art. 26: use high-risk systems according to the instructions, assign human oversight, keep logs for at least six months, inform workers and affected persons
- Art. 27: fundamental rights impact assessment where Art. 27(1) applies
- Art. 50(3) and (4): inform persons about emotion recognition or biometric categorisation; disclose deep fakes and AI-generated public-interest text
Art. 3(6)
Importer
DefinitionA natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.
ExampleAn EU reseller bringing a US vendor's high-risk AI product to the EU market under the vendor's brand.
Main duties
- Art. 23: verify conformity assessment, technical documentation, CE marking and authorised representative before placing on the market
- Art. 23: indicate name and address on the product or packaging; keep the certificate and instructions for ten years
- Art. 23: cooperate with the competent authorities
Art. 3(7)
Distributor
DefinitionA natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.
ExampleA systems integrator or reseller passing a provider's high-risk system on to customers without modifying it.
Main duties
- Art. 24: verify CE marking, EU declaration of conformity and instructions before making a high-risk system available
- Art. 24: do not make a non-conforming system available; inform provider or importer and the authorities
- Art. 25: becomes a provider when it puts its name on the system or substantially modifies it
Art. 3(5)
Authorised representative
DefinitionA natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation.
ExampleAn EU law firm or consultancy mandated by a non-EU provider of a high-risk system or a general-purpose AI model.
Main duties
- Art. 22: appointed by written mandate by providers established outside the Union before placing a high-risk system on the market
- Art. 22: keep the EU declaration of conformity, technical documentation and certificates at the disposal of the authorities for ten years
- Art. 54: same role for providers of general-purpose AI models
Art. 3(63), Art. 53 to 55
Provider of a general-purpose AI model
DefinitionA provider whose product is a general-purpose AI model: a model trained on a large amount of data at scale that displays significant generality, can competently perform a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications (summary of Art. 3(63)).
ExampleA company that trains and distributes a foundation model, including open-weight models; systemic-risk models above the Art. 51 compute threshold.
Main duties
- Art. 53: technical documentation, information for downstream providers, a copyright policy and a public summary of training content
- Art. 54: authorised representative for providers established outside the Union
- Art. 52 and 55: notification and additional obligations for models with systemic risk (evaluation, risk mitigation, incident reporting, cybersecurity)
Many organisations are both: a provider for the product they sell and a deployer for the tools they buy. Role is set per AI system, not per company.