Definitions of Provider, Manufacturer, Deployer, Importer and Distributor
Determining the risk level of an artificial intelligence (AI) system is the second step towards AI Act compliance. In fact, the Regulation provides for different obligations depending on the role, mainly distinguishing between the Provider (1), the Manufacturer (2), the Deployer (3) and the Importer/Distributor (4).
1. Provider
Article 3 of the Regulation defines the Provider as “a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge.”
Furthermore, pursuant to Article 25(1) of the AI Act, Distributors, Deployers, Manufacturers of products or any other person are also considered “Providers” of high-risk AI systems where they:
- Place their own name or trademark to a high-risk AI system already placed on the market, without prejudice to contractual arrangements providing for a different allocation of obligations in this respect;
- Make a substantial modification to a high-risk AI system that has already been placed on the market, thereby maintaining its classification as a high-risk AI system;
- Modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market, thereby making it a high-risk AI system.
It follows that having an AI system developed by an external supplier does not allow the person who subsequently places it on the market, or even merely distinguishes it with its own trademark – unless otherwise agreed contractually – to avoid the stringent obligations laid down by the AI Act for Providers.
Moreover, anyone who modifies a high-risk AI system or uses any AI system for a purpose other than the intended one, thereby making it a high-risk system, will be considered a Provider.
By contrast, those who develop, for themselves or for others, an AI system not intended to be marketed or put into service will be exempt from the obligations provided for Providers. However, it remains to be clarified what the Regulation means by “put into service” and whether this term also includes internal use of the AI system or not.
2. Manufacturer
Manufacturers – namely those who manufacture or have a product manufactured – fall within the scope of the AI Act insofar as they are considered Providers of AI systems where they integrate such systems as safety components of their products, if these products are regulated by EU legislation listed in Annex I to the Regulation (lifts, safety equipment, vehicles, essential components of critical infrastructure, toys, etc.), or where they place on the market or put into service AI systems as products under their own name or trademark.
Once again, it will be sufficient to affix one’s own trademark to an AI system or to integrate an AI system into a product under one’s own brand in order to be considered a Provider.
Furthermore, irrespective of whether the Manufacturer’s name or trademark appears on the product, the Manufacturer will be considered a Provider if the product falls within the scope of the EU legislation listed in Annex I to the Regulation and the AI system functions as a safety component of the product.
3. Deployer
Article 3 of the Regulation defines the Deployer as “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity.”
It follows that, except in the case of non-professional activities, all those who use AI systems for their activities are subject to the obligations laid down by the AI Act for Deployers, such as, for example, allowing their employees to use AI systems or implementing AI systems within their business processes.
4. Importator and Distributor
Importers and Distributors are subject to specific obligations set out in Articles 23 (Importers) and 24 (Distributors) of the AI Act, in addition, of course, to cases where they fall within the definition of “Provider” pursuant to Article 25(1).
Under Article 3 of the AI Act, an Importer is “a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country”; whereas a Distributor is “a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.”
Essentially, these last two categories include all those who take part in the value chain of an AI system that falls within the scope of application of the AI Act.
Conclusion
Once it has been established that the AI system falls within the scope of application of the AI Act, meets the definition of an AI system and its level of risk has been determined, it will be necessary to identify one’s role within the value chain in order to determine the specific obligations to which one will be subject.
