Provider or deployer? The role question in the EU AI Act
Before you talk about training formats, clarify your role. The EU AI Act distinguishes between providers and deployers, and that decides how deep your measures need to go.
Providers
Providers develop an AI system, or have it developed, and place it on the market under their own name. The most far-reaching duties apply to them, including technical documentation and risk management.
Deployers
Deployers use an AI system under their own responsibility in a professional context. That applies to the large majority: anyone rolling out Microsoft Copilot or using a GPT in customer service is a deployer.
Watch out: anyone who substantially modifies a purchased system, or offers it under their own name, can become a provider.
Consequence for your measures
Deployers mainly need application competence: safe use, recognising errors, handling data. Providers additionally need competence in development, testing and documentation.
- Record roles in the company and map them to systems
- Determine the competence needed per role
- Align measures and proof accordingly
