Are You a Provider or a Deployer? (And Why It Matters)
Pete Hannam
Data and AI Systems Architect
Does your company have to comply? Almost definitely. See what role you fulfil under the EU AI Act.
Does your company have to comply? Almost definitely. See what role you fulfil under the EU AI Act.
Subscribe to watch
Access this and all of the content on our platform by signing up for a 7-day free trial.
Are You a Provider or a Deployer? (And Why It Matters)
6 mins 19 secs
Key learning objectives:
Identify and understand each role of the EU AI Act
Outline which industries have exemptions to the Act
Overview:
The Act classifies companies into specific roles to determine their level of responsibility. Success in compliance depends on mapping your activities to one or more of these categories. However, it's common for a company to have multiple roles at once.
Subscribe to watch
Access this and all of the content on our platform by signing up for a 7-day free trial.
Summary
Can one company hold multiple roles at the same time?
Yes, it is very common for an organisation to wear 'multiple hats' depending on how they handle their AI, for example:
It is also important to note that you don't have to be physically located in Europe to be affected. If you are a company in Singapore providing an AI service that generates data used by an EU bank for lending decisions, you are subject to the Act.
Which industries or activities have exemptions or leeway under the Act?
Who are the key actors defined by the EU AI Act?
The Act classifies companies into specific roles to determine their level of responsibility. Success in compliance depends on mapping your activities to one or more of these categories:
The Act classifies companies into specific roles to determine their level of responsibility. Success in compliance depends on mapping your activities to one or more of these categories:
- Providers: This is whoever develops an AI system and places it on the market, or puts the AI system into service under its own name or trademark. Providers carry the heaviest compliance burden. They must ensure their systems meet all requirements before release. They're responsible for building compliant systems from the ground up.
- Deployers: This is the organisation actually using the AI system (e.g. bought it, licensed it or accessed it as a service). Deployers must use systems according to instructions, monitor performance, ensure input data quality, and maintain human oversight where required.
- Importers: They bring AI systems into the EU from outside. They're the bridge between non-EU providers and the EU market. Importers must verify that providers have met their obligations. They check documentation, ensure conformity assessments are complete, and act as a contact point for authorities.
- Distributors: They make AI systems available on the market (e.g. software resellers, cloud marketplaces, or app stores). They must verify systems have proper documentation and CE marking. Distributors also need to ensure systems aren't modified in ways that affect compliance.
- Authorised Representatives: They act for non-EU providers of high-risk systems. Every non-EU provider needs an EU-based representative. This entity handles certain compliance tasks and serves as a contact for authorities.
Can one company hold multiple roles at the same time?
Yes, it is very common for an organisation to wear 'multiple hats' depending on how they handle their AI, for example:
- A bank that develops its own internal credit scoring tool is both a provider (the developer) and a deployer (the user).
- A tech company that brings in AI tools from overseas to use for their own operations acts as both an importer and a deployer.
- A cloud platform creating AI services for others is a provider and potentially a distributor.
It is also important to note that you don't have to be physically located in Europe to be affected. If you are a company in Singapore providing an AI service that generates data used by an EU bank for lending decisions, you are subject to the Act.
Which industries or activities have exemptions or leeway under the Act?
- Research and Innovation
- Military and Defence
- Personal Use
- Open-source software
Subscribe to watch
Access this and all of the content on our platform by signing up for a 7-day free trial.
Pete Hannam
Pete Hannam has over twenty years’ experience building large-scale data platforms, including those that now underpin modern AI systems. His work has ranged from national security infrastructure processing hundreds of billions of records to global enterprise platforms supporting tens of thousands of users. He has architected AI-ready systems for government, consultancies, and enterprises, with a strong focus on governance, security, and regulatory compliance. His work emphasises that successful AI deployment depends not only on technology, but on understanding the organisational, technical, and regulatory context that enables AI initiatives to deliver real value.
There are no available Videos from "Pete Hannam"