Provider (AI Act)

The provider is the role that carries most obligations under the EU AI Act. Whether it charges a fee or offers the system free of charge makes no difference. For high-risk systems, Article 16 requires the provider to ensure compliance with the technical requirements, operate a quality management system, keep technical documentation and logs, undergo the relevant conformity assessment, draw up an EU declaration of conformity, affix CE marking, register the system where required, take corrective action and cooperate with authorities. Providers of GPAI models have a separate set of duties.

Roles are assigned by what an organization does, not by what it calls itself. A company that puts its own name on a third-party system, makes a substantial modification to a high-risk system or changes its intended purpose so that it becomes high-risk is treated as a new provider. For example, a bank that fine-tunes a vendor model and sells the result to other banks as its own scoring product becomes the provider of that product, with the corresponding obligations.