YTYK You think you know

Card 4 of 15 Provider, deployer, and the flip between them ●○○ Foundational

Provider and deployer

A provider develops an AI system or has it developed and places it on the market or puts it into service under its own name. A deployer uses one under its own authority. Almost all the heavy obligations sit with the provider.

Why it is like this

The party that designs the system is the only one that can build the risk management, the data governance and the technical documentation into it. The deployer can only operate it as designed.

Not to be confused with

Vendor and customer. Building a system for your own internal use makes you a provider *and* a deployer — putting into service covers your own use, so an in-house tool does not escape the provider obligations.

In practice

A bank building its own credit-scoring model is the provider and the deployer, and carries both sets of duties.

Source: Regulation (EU) 2024/1689 (AI Act) — Article 3(3) and 3(4). Read on .

Predict Check yourself

A company builds a high-risk AI system purely for its own internal use and never sells it. Which obligations apply?

  1. Both sets — putting a system into service for your own use makes you the provider as well as the deployer.
  2. Only the deployer obligations, since nothing was placed on the market.
  3. Only the provider obligations, since it built the system.
  4. None, because the regulation targets the market.
Show the answer

Both sets — putting a system into service for your own use makes you the provider as well as the deployer.

"Placing on the market" and "putting into service" are two separate triggers. In-house build is the second one.