A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority. One organization can hold both roles for different systems.
A provider carries the heaviest obligations. Providers must build the system to the requirements for its risk class, prepare technical documentation, run a conformity assessment, and register high-risk systems in the EU database. The provider role attaches to whoever puts the system on the market, including a company that commissions a model from a vendor and sells it under its own brand.
A deployer uses an AI system in a professional capacity. For high-risk systems, deployers must follow the provider's instructions for use, assign human oversight to competent people, monitor operation, keep logs, and inform affected individuals in the cases the Act specifies. Some deployers, such as public bodies, must also carry out a fundamental rights impact assessment.
The role can change. A deployer that substantially modifies a high-risk system, or puts its own name on it, can become a provider for that system. That is why role mapping should be reviewed whenever a system is adapted or rebranded.
Determining the organization's role is one of the first exercises in the Certified EU AI Governance Professional course, because it decides which obligations apply to each system.
The role can change: a company that substantially modifies or rebrands a third-party high-risk system can become its provider, so review the role each time a system is adapted.
“Your role under the Act sets your obligations, so write it down for every system.”
This ISO/IEC 42001 Lead Auditor training prepares audit, risk, and compliance professionals to assess Artificial Intelligence Management Systems (AIMS) in a structured, defensible way. The course focuses on planning, conducting, and closing ISO/IEC 42001 audits in real organizational environments, addressing governance, ethical use of AI, risk management, and regulatory expectations shaping 2024–2025. Participants learn to interpret ISO/IEC 42001 requirements from an auditor’s perspective, evaluate objective evidence, and formulate audit conclusions that stand up to certification scrutiny and executive review.
View courseThis Lead AI Risk Manager training prepares professionals to design, operate, and defend an AI risk management program aligned with regulatory and governance expectations. The course focuses on practical risk identification, decision traceability, and defensible mitigation strategies across the AI.
View courseThis ISO/IEC 42001 Lead Implementer course trains professionals to design and deploy an Artificial Intelligence Management System that stands up to regulatory, ethical, and operational scrutiny.
View courseThe EU AI Act applies to AI systems placed on the EU market, put into service there, or whose outputs are used in the EU, wherever the company is based. Applicability is decided per system and per use case.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. Bans on prohibited AI have applied since 2 February 2025; governance and general-purpose AI (GPAI) obligations since 2 August 2025; the transparency rules since 2 August 2026; and, since the Digital Omnibus on AI (Regulation (EU) 2026/1744), the Annex III high-risk rules apply from 2 December 2027. High-risk systems embedded in already-regulated products have until 2 August 2028.
Often, yes. Switzerland is not in the EU, but the EU AI Act has extraterritorial reach: it applies to Swiss providers and deployers whose AI systems are placed on the EU market or whose outputs are used within the EU (Art. 2). Swiss firms serving EU customers must comply, and Switzerland is separately preparing domestic AI rules aligned with the Council of Europe AI Convention.
The EU AI Act applies to AI systems placed on the EU market, put into service there, or whose outputs are used in the EU, wherever the company is based. Applicability is decided per system and per use case.
Providers of high-risk AI systems must prepare technical documentation before the system is placed on the market, following the content set out in Annex IV, and keep it up to date. The documentation shows how the system meets the requirements for high-risk AI.
The course suits compliance and AI governance leads, legal counsel and data protection officers, technical AI teams, and consultants or executives who must show defensible AI governance. Each role works through a different part of the AI Act.
The EU AI Act sorts AI systems into four levels: unacceptable risk (prohibited), high risk, limited risk with transparency duties, and minimal risk. A system is high risk if it is a safety component covered by EU product legislation or falls under a use case listed in Annex III.
Browse all FAQs →
Full knowledge base
Necessary cookies are always active. You can accept, reject non-essential cookies, or customize your preferences.