Provider
A provider develops an AI system (or GPAI model) and places it on the market or puts it into service under its own name or trademark. Providers of high-risk systems carry the heaviest obligation set (Article 16).
Article 16 collects the provider's duties for high-risk systems: meet the Chapter III requirements, operate a quality management system, keep the technical documentation and automatically generated logs, run the conformity assessment, draw up the declaration of conformity, affix the CE marking, register in the EU database, take corrective action and cooperate with authorities. Under Article 25, a deployer, importer or distributor that puts its own name on a high-risk system, changes its intended purpose, or substantially modifies it becomes the provider — inheriting the full set including a fresh conformity assessment.
- Art. 3(3)
- Art. 16
- Art. 17
- Art. 25
Provider: why it matters
Provider is the expensive role, and Article 25 means you can acquire it by accident. White-labelling a vendor's model, or repurposing a bought system into a high-risk use, transfers the entire provider obligation set to you while the original vendor's contract is silent about it. The vendor is then obliged to hand over the information and access you need to comply — a right worth writing into the contract before the relationship starts rather than after a regulator asks for a technical file you do not have.
Provider in practice
A payroll software company embeds a third-party model into its own product, ships it as "PayrollCo Insights", and uses it to flag employees for performance review. It never trained a model, but it put its trademark on a high-risk system and it is therefore the provider: it owes the Annex IV technical documentation, the conformity assessment, the CE marking and the EU database registration. The upstream vendor remains a provider of its own system, but that does not discharge PayrollCo.
Provider: the mistake people make
Believing that not building the model means not being the provider. The trigger in Article 3(3) is placing on the market or putting into service under your own name or trademark, plus the Article 25 transfer rules — development is only one of several routes into the role.
Provider: common questions
- Can a company be both provider and deployer?
- Yes, and it is common. An organisation that builds a high-risk system for its own internal use puts it into service under its own name and then uses it under its own authority, so it holds both roles and owes both obligation sets.
- When does a buyer become the provider?
- Under Article 25, when it puts its name or trademark on a high-risk system already on the market, modifies the intended purpose of a system so that it becomes high-risk, or makes a substantial modification to a high-risk system.
- What is the provider's core obligation list?
- Article 16: compliance with Chapter III requirements, a quality management system, technical documentation, log retention, conformity assessment, declaration of conformity, CE marking, EU database registration, corrective action, accessibility and cooperation with authorities.
Provider: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.