Under the EU AI Act, a firm that uses an AI system under its own authority is a deployer, and buying an agent platform does not pass that role to the vendor. The provider answers for how the system is built. You answer for how it is used: who oversees it, what it does, how it is monitored and what records you keep.
Who is a deployer, and who is a provider?
The Act separates two main roles. A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority, other than for purely personal activity. Our explainer on what a deployer is under the EU AI Act covers the definition in more detail.
Most firms that use an agent platform are deployers of the agents they run on it. The platform company is the provider of the system. The underlying model provider has its own obligations as a provider of a general-purpose AI model. Each role carries different duties, and none of them substitutes for another. Our page on who is the provider and who is the deployer of an AI agent works through common arrangements.
Can a deployer become a provider?
Yes, in some circumstances, and it matters because providers of high-risk systems carry much heavier obligations. In substance, a deployer can take on provider duties if it puts its own name or trademark on a high-risk system, makes a substantial modification to one, or changes the intended purpose of a system so that it becomes high-risk. A firm that takes a general agent and configures it to assess the creditworthiness of individuals should check carefully whether it has crossed that line.
This is why classifying each agent's capabilities matters. The same platform can be used for minimal-risk work and for high-risk work, and the role a firm plays can depend on which capabilities it builds.
What does a deployer have to do?
For deployers of high-risk AI systems, Article 26 sets out the core duties. In substance, and as they apply to agents:
| Deployer duty | What it means for an agent | Evidence it leaves |
|---|---|---|
| Use the system according to the provider's instructions | Configure and operate the agent within the provider's stated uses and limits | Configuration records; scope documents |
| Assign human oversight to competent people with authority | Named approvers for held actions; people who can lower the agent's authority or stop it | Approver register; oversight procedures; competence records |
| Make sure input data under your control is relevant | Sources the agent reads are appropriate and current for the task | Source register; source review records |
| Monitor operation and act on risks | Watch the agent's decisions; inform the provider and authorities of serious incidents | Monitoring reports; incident records |
| Keep logs under your control | Retain the records the system generates for an appropriate period | Retention policy; log and decision record |
| Inform people where required | Tell workers and affected individuals about the use of the system where the Act requires | Notices; communication records |
Some deployers, including certain bodies providing public services and deployers using high-risk systems for creditworthiness assessment or life and health insurance pricing, must also carry out a fundamental rights impact assessment under Article 27 before first use. Our page on Article 27 FRIA for banks and insurers using AI agents covers that duty.
Beyond high-risk use, deployers also have duties that apply more broadly, including AI literacy under Article 4 and certain transparency duties under Article 50.
What is different about meeting these duties for agents?
Three duties need particular care when the system acts.
Human oversight. For a system that recommends, oversight can mean a person deciding on the recommendation. For an agent that acts, oversight has to sit in the action path: consequential actions held for a named person, and the ability to narrow or stop the agent at once. Assigning oversight on paper to someone who never sees the agent's decisions does not meet the duty in substance.
Monitoring. The agent may be running perfectly from a technical point of view while making poor decisions. Monitoring must look at decisions: what was allowed, held and refused, which bounds decided, how reviewers responded, whether the agent tried to act outside its authority.
Logs. The logs a provider's system generates may record events without recording the deployer's own bounds and approvals. Deployers need their own decision record, showing what their agent was allowed to do and who oversaw it.
Our playbook on meeting deployer obligations for an AI agent sets out the steps, and our deployer obligations checklist gives a version to work through.
Do deployer duties apply outside the EU?
The Act applies to deployers established in the EU and, in some cases, to deployers outside it where the output of the system is used in the EU. Firms elsewhere may face no equivalent law, but many supervisors expect something similar in substance: firms using automated systems should oversee them, monitor them and keep records.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What is the trade-off?
Taking deployer duties seriously means building oversight, monitoring and records around every agent, not relying on the provider's assurances. That is work the procurement decision did not price in, and it falls on operations, risk and compliance as well as technology.
Assuming the vendor covers it is cheaper until a supervisor asks how you, as deployer, oversaw the agent's decisions. For each agent you run, decide whether you are a deployer of a high-risk system, whether any configuration has made you a provider, and which Article 26 duties apply. Then assign each one to a named person with the evidence it should leave. The wider mapping of rules to controls is in our guide to AI agent regulation, mapped to controls.
Questions people ask
Can a contract with the provider transfer deployer duties?
A contract can allocate support, information and costs between the parties, and providers must give deployers the information they need. It cannot change who the Act treats as the deployer or remove the deployer's own duties.
Are deployer duties the same for every agent?
No. The heaviest duties apply to high-risk uses. Agents used for minimal-risk tasks carry fewer specific obligations, though AI literacy and some transparency duties may still apply.
Who inside the firm should own deployer compliance?
Usually the business owner of each agent, supported by compliance. A central function can keep the register and the framework, but each duty, such as oversight or monitoring, needs a named person in the area where the agent operates.