A provider is a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model, or that has an AI system or a general-purpose AI model developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. The definition has three elements: development or having developed, market placement or putting into service, and own name or trademark. A person that only supplies a component, only hosts a system, or only uses a system does not meet the definition on those facts alone, but Article 25 can make a deployer, importer, distributor or third party the provider where its conditions are met.
What are the three elements of the provider definition?
The first element is development: the person develops the system or model, or has it developed by another party on its behalf. The second is market act: the person places the system or model on the market or puts the system into service. The third is branding: the market act is under the person's own name or trademark. All three must be present. A developer that never places a system on the market is not the provider of that system, although it may be a supplier to the provider. A seller that places another person's system on the market under that person's name is not the provider on those facts, although it may be an importer or distributor. A person that places a system on the market under its own brand, even where another party built it, meets the definition where the development element is satisfied through having it developed.
How do integrators and white-label suppliers fit?
An integrator that takes a supplied system, integrates it into a product, and places the resulting product on the market under its own name can be the provider of the resulting system, where the integration amounts to development or having developed and the market act is under its own brand. A white-label supplier that builds a system for another party to sell under that party's brand is not the provider on those facts, although the contract should allocate information, documentation and cooperation duties so that the brand owner can meet provider duties. The analysis must be done product by product: the same integrator can be a provider for one product, a distributor for another, and a deployer for a third, depending on the branding and the market act for each product.
For the broader regulatory framework, see provider responsibilities.
What about open-source and free supply?
Free supply does not remove provider status: the definition applies whether the system is supplied for payment or free of charge. Free and open-source AI systems and models benefit from a distinct, limited treatment in the Act, with exceptions to certain duties, but the exceptions do not cover every duty and do not apply in the same way to high-risk systems, prohibited practices or transparency duties. An open-source provider that places a high-risk system on the market under its own name must therefore still assess the provider duties that remain applicable. A person that merely makes a model available for download, without placing a system on the market under its own name, needs a separate analysis of whether it is a general-purpose model provider, a system provider, or neither on those facts.
What about own-use development?
A person that develops a system for its own use and puts it into service for its own use can be a provider, where the putting into service is under its own name or trademark and the system is put into service for its intended purpose. Own use does not remove the market act, because putting into service is defined as supply for first use directly to the deployer or for own use. An internal team that builds a high-risk system for internal deployment should therefore record the provider and deployer roles separately, even where the same legal person holds both roles, because the duties for each role are different and the evidence for each role must be kept separately. A purely personal, non-professional use is outside scope, but professional own use is not.
When does Article 25 change the answer?
Article 25 provides that a deployer, importer, distributor or third party shall be considered a provider where it puts its name or trademark on a high-risk system already placed on the market, makes a substantial modification to a high-risk system that remains high-risk, or modifies the intended purpose of a system so that it becomes high-risk. In those cases, the original provider ceases to be considered the provider for the modified system in the circumstances the article sets, and the person who made the change assumes provider obligations, subject to the cooperation and information duties in Article 25. A rebranding, a substantial modification, or a purpose change should therefore trigger a fresh provider analysis before the changed system is supplied or used, and the contract should address the change process.
Continue with Article 16 provider duties.
What is not decided by this guide?
This guide explains the provider definition and its edge cases in outline. It does not decide whether any particular developer, integrator, supplier or internal team is a provider, whether Article 25 applies, or whether an open-source exception is available. Those questions need the development facts, the branding, the market act, and the modification or purpose-change facts, read against Articles 3 and 25 in the consolidated text. Role questions should be confirmed with a competent authority or legal adviser where the duties that follow are substantial, because the wrong role assignment leads to the wrong duties being performed by the wrong party.
Frequently asked questions
Is a contractor that builds a system for a client the provider?
Not necessarily. If the client places the system on the market under its own name and the contractor only built it, the client is more likely to be the provider, with the contractor as a supplier. The contract should allocate information and cooperation duties, and the facts of development, branding and market act must be checked.
Does giving a system away free avoid provider duties?
No. The provider definition applies whether supply is for payment or free of charge. Limited exceptions for free and open-source systems do not remove every duty, and high-risk, prohibited and transparency provisions must still be checked.
Can a company be provider and deployer of the same system?
Yes, where it both places the system on the market or puts it into service under its own name and uses it under its authority. The duties for each role should be recorded separately, even where the same legal person holds both roles.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗