How does a company determine if they are a deployer?
A company is a 'deployer' if it uses an AI system under its authority - but must monitor for role shifts that could reclassify it as a provider with stricter obligations.
Under the EU AI Act, a company determines if it is a "deployer" by assessing whether it meets the regulatory definition based on its actual use of AI.
Specifically, a company is classified as a deployer if it is a legal person, public authority, agency, or other body that uses an AI system under its authority. The only exception to this definition is when an AI system is used by a natural person for purely personal, non-professional activities.
Practical determination
To practically determine this role, a company must evaluate its deployments - meaning how its AI assets are actually used in practice, by whom, and for what purpose, rather than just evaluating abstract AI models in isolation. By mapping where AI exists within its operational perimeters (workspaces) and how it is utilized, a company can pinpoint whether it is acting as a deployer, a provider, or both.
Important caveat on shifting roles
A company must be careful when determining its status, because a company that initially acts as a deployer will legally become a provider (and assume all the stricter obligations of a provider) if it does any of the following:
- Puts its own name or trademark on a high-risk AI system that is already on the market or in service.
- Makes a substantial modification to a high-risk AI system.
- Modifies the intended purpose of an existing AI system in a way that causes the system to become classified as high-risk.
This means that the line between deployer and provider is not always fixed - companies must continuously reassess their role as their use of AI evolves, ensuring they comply with the appropriate set of obligations at all times.