Am I a provider or a deployer?

The two main roles

• Provider (Art. 3(3)) — you develop an AI system or a GPAI model, or have one developed, and place it on the market or put it into service under your own name or trade mark, whether for payment or free of charge. Providers carry the heaviest obligation set: risk management, technical documentation, conformity assessment, registration.
• Deployer (Art. 3(4)) — you use an AI system under your authority, in the course of a professional activity, but a third party built it. Think: an HR team using a vendor's CV-screening tool. Deployer duties centre on using the system as instructed, human oversight, monitoring and — for some — a fundamental-rights impact assessment.

A simple test: if the system breaks its promises, whose name is on it? That party is usually the provider.

The Art. 25 "own-name upgrade"

Roles are not fixed labels — they follow behaviour. Under Art. 25(1), a distributor, importer, deployer or other third party is treated as the provider of a high-risk system, with every provider obligation under Art. 16, if it:

• puts its own name or trade mark on a high-risk system already on the market or in service,
• makes a substantial modification to a high-risk system that keeps it high-risk, or
• changes the intended purpose of a system — including a GPAI system — that was not high-risk so that it becomes high-risk.

When that happens the original provider is no longer the provider of that system, but must cooperate with the new one and make available the information and technical access needed to meet the Act (Art. 25(2)). A provider of a high-risk system must also have a written agreement with third parties supplying tools, services, components or processes for it, covering the information and access the provider needs (Art. 25(4)).

Rebranding a vendor's chatbot as "YourCo Assistant" or retraining it for a new high-risk purpose means you inherit the full provider obligation set for that system.

Importer and distributor, briefly

• Importer (Art. 3(6), duties in Art. 23) — established in the EU, places a system from a non-EU provider on the EU market. Must verify the conformity assessment, the technical documentation, the CE marking and the authorised representative before doing so, and keep the paperwork for ten years.
• Distributor (Art. 3(7), duties in Art. 24) — makes a system available on the EU market without modifying it. Verifies the marking and paperwork, and holds a non-conforming system back.
• Authorised representative (Art. 22) — an EU-established entity a non-EU provider appoints by written mandate before making a high-risk system available; it keeps the documentation and DoC at the authorities' disposal for ten years and cooperates with them.

How Veritome resolves your role

Step 1 of the registration wizard asks for your base role, then runs the Art. 25 check for deployers and distributors: "Do you put this system on the market under your own name or brand, substantially modify it, or change its intended purpose?" Answer yes and Veritome upgrades you to Provider for that system, so the obligation engine generates the provider set — the review step shows whether the upgrade was applied. The role lives on the system's classification, so the same organisation can be the deployer of one system and the provider of the next.

Common questions

Does rebranding a vendor's AI system make me the provider?

For a high-risk system, yes. Under Art. 25 a deployer or distributor that puts the system on the market under its own name or trade mark is treated as its provider, and inherits the full provider obligation set for that system — risk management, technical documentation, conformity assessment and registration. The same applies if you substantially modify the system or change its intended purpose so that it becomes high-risk.

What is the difference between an importer and a distributor?

An importer (Art. 23) is established in the EU and places a system from a non-EU provider on the EU market; it must verify the conformity assessment, CE marking, documentation and authorised representative before doing so. A distributor (Art. 24) makes a system available on the EU market without modifying it, verifies the markings and paperwork, and holds a non-conforming system back. Neither role develops the system; both stop being that role if they rebrand or modify it.

How does Veritome decide which role I hold?

Step 1 of the registration wizard asks for your base role, then runs the Art. 25 check for deployers and distributors. If you answer that you place the system on the market under your own name, substantially modify it or change its intended purpose, Veritome records you as the provider for that system and the obligation engine generates the provider set. The review step shows whether the upgrade was applied, so the role is always visible before anything is generated.