/16Who Owns What Under the AI Act?
A plain-English guide to the AI Act roles, because the same system can create very different duties depending on what your company actually does.
Beginner
8 min
Open +
Who Owns What Under the AI Act?
A plain-English guide to the AI Act roles, because the same system can create very different duties depending on what your company actually does.
Beginner
8 min
The role question is one of the easiest places to get lost. Buying an AI tool does not automatically make you its provider. Building, rebranding, substantially changing, importing, distributing, or deploying a system can put you in different legal positions.
Leave knowing / Know which role needs deeper review
The four common roles
Translate the legal nouns into normal work.
Provider
You develop an AI system or model, or have one developed, and place it on the market or put it into service under your name or trademark.
Deployer
You use an AI system under your authority in a professional or organisational context. For many companies buying and using AI, this is the role to examine first.
Importer
You place an AI system on the EU market when the provider is established outside the EU. The legal chain matters, not just where the software runs.
Distributor
You make an AI system available in the EU supply chain without being the provider or importer.
The trap
Your role can change.
A company can begin as a deployer and move closer to provider obligations if it puts a system on the market under its own name, makes a substantial modification, or changes the intended purpose in a way the Act treats as significant.
That is why “we use Vendor X” is not enough information. You need to know what your organisation changed, branded, integrated, controlled, and put into service.
The contract says who sold it. The facts say what role you are playing.
Examples
What this can look like in practice.
| Situation | Role to examine first |
|---|---|
| Your HR team uses an external AI recruiting tool as supplied | Deployer |
| You build and sell an AI workflow to customers under your brand | Provider |
| You bring a non-EU AI system into the EU market for sale | Importer |
| You resell an AI system inside the EU supply chain | Distributor |
| You significantly change a system or its intended use | Re-check whether provider obligations now attach |
Role check
Bring this to legal or compliance.
Who developed the system?
Whose name or trademark is on the system offered to users?
Who puts it into service?
Who controls the intended use?
Did we materially modify the system?
Did we change what the system is intended to do?
Are we placing a non-EU system on the EU market?
What logs, documentation and instructions move between the parties?
Official sources
We simplify the map here. For a real legal decision, use the law, current guidance and qualified counsel.
Notes / Subscribe
Get the next note.
No schedule. No content calendar. A note goes out only when there is something worth understanding.