Provider or deployer? How the EU AI Act assigns roles, and why it decides your obligations

The EU AI Act does not regulate "companies that use AI." It assigns obligations by role, and Article 3 of the Act defines six roles that together make up the "operator" category. Until you know which role your organization occupies for a given AI system, you cannot know which obligations apply, so role assignment is the first analysis you should be able to run.

Why the role question comes first

The AI Act attaches duties to specific actors. A provider carries one set of obligations, a deployer another, and importers and distributors have their own supply-chain duties. The same organization can hold different roles for different systems, and can even hold more than one role for the same system. If you misplace your organization in this scheme, every downstream compliance decision inherits the error.

The definitions sit in Article 3 of Regulation (EU) 2024/1689, published in the Official Journal on 12 July 2024. The five actor definitions run from Article 3(3) to Article 3(7), and Article 3(8) gathers them under the umbrella term "operator."

The five defined roles

Role	Article	Core test
Provider	3(3)	Develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark
Deployer	3(4)	Uses an AI system under its authority, outside personal non-professional activity
Authorised representative	3(5)	Located in the Union; holds a written mandate from a provider to carry out the provider's obligations
Importer	3(6)	Located in the Union; places on the market an AI system bearing the name or trademark of a person established in a third country
Distributor	3(7)	In the supply chain, other than the provider or importer, makes an AI system available on the Union market

Provider

The provider definition has two limbs. You are a provider if you develop the system, or if you have it developed for you. Either way, the trigger is placing it on the market or putting it into service under your own name or trademark. Payment is irrelevant. The definition says "whether for payment or free of charge," so giving a system away does not remove provider status. Note also that the definition covers general-purpose AI models, not only AI systems.

The name-or-trademark element does real work. A hypothetical example: a bank commissions a software house to build a credit-scoring system, then offers it to customers under the bank's own brand. The bank did not write a line of code, but it had the system developed and puts it into service under its own name. On the Article 3(3) test, the bank is the provider.

Deployer

Article 3(4) is short and worth reading exactly:

'deployer' means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;

Two things matter. First, the use must be under the person's authority. Second, there is one carve-out: personal, non-professional activity. An individual using a consumer AI tool at home is not a deployer. A company using the same tool in its hiring process is.

Authorised representative

This role exists to give non-Union providers a foothold in the Union. The representative must be located or established in the Union, and must have received and accepted a written mandate from a provider. The mandate covers performing the provider's obligations and procedures under the Regulation on its behalf. No mandate, no role.

Importer and distributor

Both are supply-chain roles, and the definitions separate them cleanly. The importer, under Article 3(6), is located in the Union and places on the market an AI system that bears the name or trademark of a person established in a third country. The third-country branding is the distinguishing feature. The distributor, under Article 3(7), is anyone else in the supply chain who makes an AI system available on the Union market. The definition expressly excludes the provider and the importer, so distributor is the residual supply-chain role.

Operator: the umbrella, and the product manufacturer inside it

Article 3(8) reads:

'operator' means a provider, product manufacturer, deployer, authorised representative, importer or distributor;

Count the roles. There are six, and only five have their own definitions in Article 3. The product manufacturer appears in the operator list without a definition of its own anywhere in the Article 3 catalog. This is a genuine feature of the text, not an omission you have misread. It means product manufacturers are pulled into the Act's operator category, and into provisions that address "operators," through Article 3(8) alone. When you see "operator" in the Regulation, remember that it sweeps in a role the definitions article never separately defines.

A decision sequence for placing your organization

Run these questions in order for each AI system your organization touches. The supporting definitions in Article 3(9) to 3(11) matter here: "placing on the market" is the first making available on the Union market, "making available" is supply for distribution or use in the course of a commercial activity, and "putting into service" is supply for first use directly to the deployer or for own use in the Union.

1. Did you develop the system, or have it developed, and does it reach the market or enter service under your name or trademark? If yes, you are a provider under Article 3(3). Free distribution does not change this.
2. Are you established in the Union and holding a written mandate from a provider to carry out its obligations? If yes, you are an authorised representative under Article 3(5).
3. Are you established in the Union and placing on the market a system branded by a person established in a third country? If yes, you are an importer under Article 3(6).
4. Are you in the supply chain, not the provider or importer, making the system available on the Union market? If yes, you are a distributor under Article 3(7).
5. Are you using the system under your authority, outside personal non-professional activity? If yes, you are a deployer under Article 3(4).

Two cautions. The roles are not mutually exclusive across systems, and an organization that develops one tool and buys another can be provider for the first and deployer for the second. And watch Article 3(23) on substantial modification: a change to a system after placing on the market or putting into service, not foreseen in the initial conformity assessment, that affects compliance or modifies the intended purpose. Related to this, Article 3(68) defines a "downstream provider" as a provider of an AI system that integrates an AI model, whether the model is its own or supplied by another entity. Integration work can change what you are.

Where this sits on the AIGP

The AIGP Body of Knowledge version 2.1, effective 2 February 2026, tests AI-specific laws under Competency II.C, which carries 6 to 8 of the exam's 100 items, inside Domain II at 19 to 23 items. The performance expectation is that you can work with the main elements of AI-specific laws, and the AI Act's role architecture is foundational to that. Be able to state each Article 3(3) to 3(7) definition, place a described organization into the correct role, and explain why the product manufacturer belongs to the operator category despite lacking its own definition. That analysis is the gateway to everything the Act asks of you afterward.