Deployer (AI Act)

Most organizations meet the EU AI Act as deployers: they buy or subscribe to AI systems built by others and use them in their operations. Deployers have fewer duties than providers, but they are real. For high-risk systems, Article 26 requires deployers to take appropriate technical and organizational measures to use the system in line with the instructions for use, assign human oversight to people with the necessary competence, authority and support, ensure input data under their control is relevant, monitor operation and inform the provider of risks or serious incidents, keep automatically generated logs, and inform workers and affected persons where required.

Public bodies and some private deployers, such as those assessing creditworthiness or setting terms for life and health insurance, must also carry out a fundamental rights impact assessment before first use. Every deployer is subject to the AI literacy duty and, for certain systems, to transparency duties such as disclosing deepfakes. A hospital using a vendor triage system is a deployer; if it rebrands or substantially modifies the system, it may become a provider.