When an AI user becomes its provider: roles under the AI Act

Most companies working with artificial intelligence have developed no model of their own. They use licensed tools, build applications on top of large language model interfaces, or have an agency build them a chatbot. Many therefore assume that the obligations under the Artificial Intelligence Act (AI Act) rest with the maker of the model. That is only partly true. The Regulation allocates obligations according to the role a company occupies in relation to a particular system, and that role can change through a single commercial decision.

Two basic roles

The definition of a provider is the key:

‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

— Article 3(3) of Regulation (EU) 2024/1689

Against the provider stands the deployer, that is, the person using an AI system under its authority, except where used in the course of a personal non-professional activity (Article 3(4)). The concept of putting into service also matters: it is the supply of a system for first use directly to the deployer or for own use in the Union (Article 3(11)). A provider is therefore not only the person who sells AI, but also the person who has a system developed and operates it under its own name. The Regulation also contemplates a downstream provider that integrates an AI model, its own or supplied by another entity, into its system (Article 3(68)).

Three situations in which a company becomes a provider

Your own system built on someone else’s model. A company orders a customer support chatbot built on a third-party language model interface and launches it on its website under its own brand. Someone else developed the model, but it was the company that put the chatbot into service as an AI system. From 2 August 2026 it therefore bears, for example, the duty to ensure that people know they are communicating with AI, unless this is obvious from the circumstances (Article 50(1)); we examined the detail in whether you must tell customers that a chatbot is answering them.

Your own brand on someone else’s high-risk system. A distributor, importer, deployer or other third party that puts its name or trademark on a high-risk system already placed on the market or put into service is deemed to be its provider (Article 25(1)(a)). Here the Regulation allows the parties to allocate obligations differently by contract.

A substantial modification or a new purpose. A person also becomes the provider of a high-risk system if they make a substantial modification to it such that it remains high-risk, or if they change the intended purpose of a system that was not high-risk so that it becomes high-risk (Article 25(1)(b) and (c)). An example may be a general-purpose text tool deployed to assess job applicants, that is, in an area that Annex III designates as high-risk. We describe the context for HR tools in AI in recruitment and employee assessment.

What changes with the role of provider

For systems that are not high-risk, the provider’s obligations are relatively narrow, being principally the transparency requirements under Article 50. For high-risk systems the difference is fundamental: the provider must ensure the system’s compliance with the requirements of the Regulation, put a quality management system in place, keep documentation, subject the system to a conformity assessment, draw up an EU declaration of conformity, affix the CE marking and register the system (Article 16). For systems under Annex III, those obligations apply from 2 December 2027 following amending Regulation (EU) 2026/1744, and for systems tied to regulated products under Annex I from 2 August 2028. High-risk systems placed on the market or put into service before that date are covered by the Regulation only if they are later subject to significant changes in their designs. Systems intended to be used by public authorities must comply by 2 August 2030 (Article 111(2) as amended).

Where one of the situations under Article 25(1) arises, the original provider ceases to be regarded as the provider of that particular system. It must, however, cooperate closely with the new provider, and the amending Regulation clarified that, where necessary, this includes making the technical documentation available, providing information on known limitations and failure states, and giving targeted technical access, including for testing (Article 25(2) as amended). That duty falls away, however, if the original provider clearly stated that its system is not to be changed into a high-risk one. A company that deploys a general-purpose tool for a sensitive purpose contrary to the supplier’s express specification may thus be left with a provider’s obligations without the documentation it would need in order to meet them.

What belongs in the supplier contract

For high-risk systems, the Regulation expressly requires a written agreement between the provider and the third party supplying an AI system, AI model, tools, services, components or processes used in the high-risk system, covering the information, capabilities, technical access and other assistance needed in order to meet the obligations (Article 25(4) as amended). An exception applies to third parties that make such tools or components, other than general-purpose AI models, accessible to the public under a free and open-source licence. The amending Regulation expressly added breaches of the obligations under Article 25(2) and (4) to the infringements for which a fine may be imposed (Article 99(4)(da)). Even on ordinary projects it is worth setting out clearly in the development or licence agreement:

• who will be the provider in relation to the resulting system and under whose name the system is operated,
• what purpose the system is intended for and what it must not be used for,
• what materials and documentation the supplier will hand over and how it will cooperate on changes,
• how liability is allocated if the system fails to meet the requirements of the Regulation or causes damage.

We assess your company’s role in relation to each AI tool and derive the resulting obligations through the AI Act and deploying artificial intelligence. We prepare or review development and licence agreements for AI solutions that address these questions through software and licence agreements.