PricingLog in

Who must comply with the AI Act.

Reviewed

Short answer

The AI Act applies to providers that place AI systems or general-purpose AI models on the EU market, deployers that use AI systems in the EU, importers, distributors, product manufacturers and authorised representatives, and also to providers and deployers outside the EU when the output of their AI system is used in the EU. It does not apply to purely personal, non-professional use, to research before a system is placed on the market, or to military, defence and national security uses, and free and open-source AI systems are exempt unless they are high-risk, prohibited or covered by Article 50.

Official sources: AI Act, Article 2 (consolidated) · AI Act, Article 3

The roles

Operator roles defined in Article 3 of the AI Act
RoleWho it is (Article 3)Typical example
Provider (3)Develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, paid or freeA company that sells or offers an AI app or API
Deployer (4)Uses an AI system under its authority, except in a personal non-professional activityA bank using an AI credit tool; an agency using an image generator for clients
Authorised representative (5)Located in the EU, holds a written mandate from a provider outside the EUAn EU firm acting for a US AI provider
Importer (6)Located in the EU, places on the market an AI system bearing the name or trademark of someone established outside the EUAn EU reseller bringing in a foreign AI product
Distributor (7)Makes an AI system available on the EU market, other than the provider or importerA software marketplace or IT reseller
Product manufacturer (Article 2(1)(e))Places an AI system on the market together with its product under its own nameA maker of machines or devices with built-in AI

“Operator” is the umbrella term for all of them (Article 3(8)). One organisation can hold several roles for the same system, and the duties differ widely: providers of high-risk systems carry most of them, deployers fewer.

Companies outside the EU

  • Providers anywhere are covered when they place AI systems or general-purpose AI models on the EU market (Article 2(1)(a)).
  • Providers and deployers outside the EU are also covered when the output of their AI system is used in the EU (Article 2(1)(c)).
  • For transparency duties, the Commission’s Article 50 guidelines say a deployer outside the EU is covered when it foresees use in the EU, for example by posting deepfakes on the globally accessible internet, but not when content reaches the EU through channels it cannot foresee or control.
  • Providers of high-risk systems established outside the EU must appoint an authorised representative in the EU by written mandate before making the system available (Article 22); providers of general-purpose AI models likewise (Article 54), with an exemption for open-source models without systemic risk.

When a deployer becomes a provider

Under Article 25(1), a distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system when it puts its name or trademark on a high-risk system already on the market, makes a substantial modification so that the system remains high-risk, or changes the intended purpose of a non-high-risk system (including a general-purpose AI system) so that it becomes high-risk. Since the Digital Omnibus, the initial provider then stops being the provider of that system but must cooperate, for example by sharing technical documentation and known limitations (Article 25(2)).

Who is excluded

Exclusions in Article 2 of the AI Act
ExclusionLimitsArticle
Purely personal, non-professional use by natural personsOnly the deployer duties; the provider of the tool is still covered2(10)
Research, testing and development before placing on the marketTesting in real-world conditions is not excluded2(8)
AI developed and put into service only for scientific researchIncluding its output2(6)
Military, defence and national securityRegardless of who carries out the activity2(3)
Free and open-source AI systemsNot if placed on the market as high-risk, or covered by Article 5 or 502(12)
Public authorities of third countries and international organisationsIn law-enforcement and judicial cooperation with adequate safeguards2(4)

Find your role in four questions

  1. Did you build the system or model, or have it built, and do you offer it under your name? You are its provider.
  2. Do you use someone else’s AI system for your work? You are a deployer of it.
  3. Do you bring a non-EU AI system to the EU market, or sell it on? You are an importer or a distributor.
  4. Did you rebrand, substantially modify or repurpose a high-risk system? Check Article 25: you may now be its provider.

Questions

Does the AI Act apply to US or UK companies?
Yes, when they place AI systems or general-purpose AI models on the EU market, or when the output of their AI system is used in the EU (Article 2(1)). Where they provide high-risk systems or general-purpose AI models, they need an authorised representative in the EU.
If my company uses an AI chatbot from a vendor, are we a deployer?
Yes: a deployer is anyone using an AI system under its authority except for personal non-professional activity. What you must do depends on the use: AI literacy for staff (Article 4), labels if you publish deepfakes or certain AI text (Article 50(4)), and the full deployer duties of Article 26 only if the use is high-risk.

Sources

Last reviewed by Volkan Çatak, Founder, Proofcan.

Not legal advice. This page explains official texts in plain words and links each one; check the sources, or a lawyer, before relying on it for a decision.