What causes an AI role to shift from deployer to provider?
Under Article 25 of the AI Act, a deployer becomes a provider - inheriting all stricter obligations - if they rebrand, substantially modify, or change the intended purpose of a high-risk AI system.
Under the EU AI Act, an entity that initially acts as a deployer (or another third party, such as an importer or distributor) will legally be considered a provider of a high-risk AI system-and must therefore assume all the stricter regulatory obligations of a provider-if they meet any of three specific conditions.
According to Article 25 of the Act, this role shift is triggered if the deployer does any of the following:
1. Rebranding
Puts their own name or trademark on a high-risk AI system that has already been placed on the market or put into service (without prejudice to contractual arrangements that might allocate obligations otherwise).
2. Substantial modification
Makes a substantial modification to an existing high-risk AI system in such a way that it remains classified as a high-risk AI system.
3. Changing the intended purpose
Modifies the intended purpose of an existing AI system (including a general-purpose AI system) that was previously *not* classified as high-risk, in a way that the modification causes the system to become classified as a high-risk AI system.
Cooperation with the original provider
When any of these circumstances occur, the entity that initially placed the system on the market is no longer legally considered the provider. However, that original provider is required to closely cooperate with the new provider by making available the necessary information, technical access, and assistance required to fulfill the new provider's obligations, particularly regarding conformity assessments.