AI Act for builders · reviewed 2026-09-23
Provider or deployer?
Most AI Act duties sit with the provider. Your role is decided per AI system, not per company: the same team can be the deployer of Copilot and the provider of the chatbot it ships.
The two definitions
- Provider (Art. 3(3)): develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, paid or free.
- Deployer (Art. 3(4)): uses an AI system under its authority, except for personal non-professional use.
Three questions
- Did you develop the system, or have it developed, and do you offer it or use it under your own name? Then you are its provider, and also its deployer if you use it yourself.
- Did you put your name on someone else's high-risk system, substantially modify one, or change a system's intended purpose so that it becomes high-risk? Then you take over the provider obligations for it (Art. 25(1)).
- Otherwise, do you use it in your professional activity? Then you are a deployer.
Separately: if you train a general-purpose model, or modify one with more than about one third of its original training compute, you are the provider of that model, with the obligations in Art. 53 (in force since 2 August 2025).
By kind of feature
| Situation | Your role | Why | What follows |
|---|---|---|---|
| Staff use a SaaS AI tool (ChatGPT Team, Copilot, a coding assistant) · example | Deployer | You use an AI system under your authority in a professional activity (Art. 3(4)). | AI literacy (Art. 4); GDPR if personal data goes in |
| You switch on a vendor's chatbot on your website · example | Deployer, usually | The vendor develops the system and offers it under its name. If you present it as your own product built on a model you chose, check whether you have become the provider. | Make sure the Art. 50(1) disclosure is on and visible |
| You build a chatbot or RAG feature on a model API and ship it under your brand · example | Provider of the AI system | You develop an AI system and put it into service under your own name (Art. 3(3)). The model vendor remains the provider of the general-purpose model. | Art. 50(1) disclosure by design; Art. 50(2) marking where it applies |
| You build an AI tool for your own internal use (for example CV screening) · example | Provider and deployer | Putting into service includes supply for your own use (Art. 3(11)). An internal HR or credit tool can be high-risk. | High-risk provider and deployer duties from 2 Dec 2027 if the use is in Annex III |
| You fine-tune an open-weight model and ship it in your product · example | Provider of the AI system; model provider only above a threshold | You become provider of the general-purpose model only if the modification is significant; the Commission's indicative criterion is more than one third of the original training compute (guidelines, July 2025). | Record the compute; classify the product use |
| You put your name on someone else's high-risk system, substantially modify one, or change a system's purpose so it becomes high-risk | Provider of that high-risk system | Art. 25(1) moves the provider obligations to you; the original provider must cooperate. | All high-risk provider obligations |
| You resell a non-EU provider's AI system in the EU | Importer or distributor | Separate roles with their own checks (Art. 23 and 24). | Verify conformity marking and documentation for high-risk systems |
Six myths, and what the text says
"We only call an API, so we are a deployer."
If you build a product on the API and offer it under your name, you are the provider of that AI system (Art. 3(3)).
"Fine-tuning makes us a general-purpose model provider."
Only above the indicative criterion of one third of the original model's training compute (Commission guidelines on general-purpose AI models, July 2025).
"High-risk duties start in August 2026."
The Digital Omnibus moved them to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Article 50 was not moved: it applies since 2 August 2026.
"Article 52 requires the chatbot disclosure."
Article 52 was the numbering in the draft. In the adopted AI Act the transparency duties are in Article 50.
"Logs must be kept for ten years."
Providers keep technical documentation for ten years (Art. 18). Automatically generated logs of high-risk systems are kept for at least six months, by providers (Art. 19) and by deployers (Art. 26(6)).
"Internal tools are out of scope."
Supplying a system for your own use counts as putting it into service (Art. 3(11)). An internal HR screening tool is high-risk like a bought one.
Next
- Article 50 for apps built on someone else's model: disclosure, marking and labels in practice.
- 20 classified examples with the reasoning shown.
- Check your features in CI: ai-act-check, a CLI and GitHub Action that turns a list of your AI features into obligations and dates.
- The dates in your calendar: subscribe to the deadlines.