The EU AI Act applies to a range of actors defined by role and by territorial connection, including providers placing AI systems or general-purpose AI models on the Union market, deployers established or located in the Union, providers and deployers in third countries where the system's output is used in the Union, importers and distributors, product manufacturers, authorised representatives, and affected persons located in the Union. Which obligations apply to a particular organisation depends on its role for each system, its establishment, and the system's placing and output use, and must be assessed system by system.
What roles does the Act define?
The Act defines roles in Article 3, including provider, deployer, authorised representative, importer, distributor, and product manufacturer. A provider develops or has developed an AI system or a general-purpose AI model and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. A deployer uses an AI system under its authority, except for personal non-professional use. An importer places on the Union market a system bearing another person's name or trademark, while a distributor makes a system available on the Union market without affecting its properties, in the supply chain. A product manufacturer places a system on the market together with its product under its own name or trademark. The same organisation can hold different roles for different systems, and can hold more than one role for the same system, so the role record must be per system, not per organisation.
How does territorial reach work?
Territorial reach under Article 2 is based on placing on the Union market, establishment or location in the Union, and use of output in the Union, rather than on headquarters alone. Providers who place systems or models on the Union market are in scope wherever they are established. Deployers established or located in the Union are in scope for their deployments. Providers and deployers in a third country are in scope where the output of the system is used in the Union. Importers, distributors, product manufacturers and authorised representatives are in scope through their Union market activities. A team should record, for each system, the placing act, the establishment of each actor, and where the output is used, because those three facts together determine which actors are in scope for that system. A headquarters outside the Union does not, by itself, place an organisation outside the Act where those connections exist.
For the broader regulatory framework, see AI governance planning checklist.
How can one organisation hold several roles?
An organisation can be a provider for a system it develops under its own name, a deployer for a system it buys and uses under its authority, an importer for a system it brings into the Union, and a distributor for a system it resells, across different products. It can also change role for the same system over time, for example by substantially modifying a system it deployed, or by changing its intended purpose so that it becomes high-risk, in which case Article 25 can make it the provider of the modified system. The role map should therefore be a matrix, with systems on one axis and roles on the other, and with a named owner for each cell. A single organisation-level label, such as calling the whole company a deployer, hides the different obligations that apply to its different activities and should not be used as the role record.
What exclusions and limits apply to scope?
Article 2 provides exclusions and limits, including for military, defence and national security uses, for scientific research and development, for pre-market testing, and for purely personal non-professional use, subject to the conditions and limits in the article. Free and open-source AI systems are also subject to distinct scope treatment, unless they are high-risk or fall within Articles 5 or 50, as the article provides. An exclusion should not be assumed from a general research, personal, or open-source label; the specific conditions, the purpose, and the stage of development must be checked and recorded. Where a system moves from research to market placement, or from personal use to professional use, the scope position must be reassessed, because the exclusion that applied at one stage may no longer apply at the next.
How should an organisation map who must comply?
An organisation should map scope and roles system by system, starting from the inventory, and should record for each system the actors, their roles, their establishment, the placing act, and the output use. The map should then link each role to the obligations that follow from it, including provider, deployer, importer, distributor and representative duties, and should name the owner for each obligation. Gaps should be visible as unowned obligations, and role changes should trigger a remapping. The map should be reviewed when a new system is added, when a system is modified or repurposed, when an actor's establishment changes, or when output use changes. A map that is produced once and never updated will not reflect the organisation's current scope, and a supervisor asking who is responsible for a system will receive an outdated answer.
Continue with AI governance operating model.
What does this guide not decide?
This guide does not decide whether a particular organisation is in scope, what role it holds for a specific system, or what obligations follow from that role. It does not assess establishment, placing, output use, or an exclusion. Those questions depend on the facts for each system, the contracts and control exercised, and the consolidated legal text, including Articles 2, 3 and 25. An organisation should map its roles system by system, record the reasoning and evidence, and confirm the position with a competent authority or legal adviser, particularly where a role is borderline, where output is used across borders, or where an exclusion is relied on.
Frequently asked questions
Does the Act apply to companies outside the EU?
Yes, in the circumstances Article 2 sets out. Providers placing systems or models on the Union market are in scope wherever established, and third-country providers and deployers are in scope where the system's output is used in the Union. Establishment, placing and output use should be recorded for each system, rather than assuming headquarters location decides scope.
Can one company be both provider and deployer?
Yes. A company can be a provider for systems it develops under its own name and a deployer for systems it uses under its authority, and roles can differ per system and change over time. The role record should be a per-system matrix, with owners for the obligations that follow from each role.
Does personal use fall outside the Act?
Purely personal non-professional use is subject to the exclusion in Article 2, subject to its conditions. Professional use, even by an individual, and use that moves from personal to professional, should be assessed separately, and the scope position should be recorded with the facts relied on.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗