What is a deployer under the EU AI Act?

A deployer under the EU AI Act is any person or organisation that uses an AI system under its own authority in the course of a professional activity. A bank running a vendor's AI agent on its customers' accounts is a deployer. It is a separate role from the provider, who develops the system and places it on the market.

Why does the deployer role matter for AI agents?

Most firms using AI agents did not build the underlying model, and many did not build the agent either. It is tempting to assume the compliance burden sits with the vendor. The Act does not work that way. Deployers carry their own obligations, which grow with the risk of the system and the context of use, and they cannot be contracted away. The practical consequences are set out in using an agent makes you a deployer: what that means.

What must a deployer do?

For high-risk systems, Article 26 sets out deployer obligations in substance:

• use the system in line with the provider's instructions for use;
• assign human oversight to people with the competence, training and authority to do it;
• ensure input data under its control is relevant and sufficiently representative for the intended purpose;
• monitor the system's operation and inform the provider and authorities of serious risks or incidents;
• keep the automatically generated logs under its control for an appropriate period;
• inform workers and affected people where required.

Some deployers, including public bodies and those using systems for credit scoring or life and health insurance pricing, must also carry out a fundamental rights impact assessment under Article 27. All deployers must meet the AI literacy duty in Article 4, and the transparency duties in Article 50 where they apply. The deployer obligations checklist under the EU AI Act lists them in one place, and what to do when something goes wrong is covered in EU AI Act serious incidents: what a deployer of an AI agent must do.

What does an example look like?

A regional bank uses a vendor's agent to assess small business credit applications and draft decisions. The vendor is the provider. The bank is the deployer. Assessing the creditworthiness of natural persons is listed as high-risk in Annex III, so for sole traders the bank must follow the instructions for use, assign trained credit officers to oversee the agent, keep the logs, monitor performance, and carry out a fundamental rights impact assessment before use. The vendor's compliance does not discharge any of these.

How is a deployer different from a provider?

The provider develops the AI system, or has it developed, and places it on the market or puts it into service under its own name. It carries the heaviest duties for high-risk systems: risk management, data governance, technical documentation, conformity assessment. The deployer uses it. The roles can shift: a deployer that puts its own name on a system, or substantially modifies it or changes its intended purpose, can take on provider obligations. Building your own agent on a provider's model can therefore make you both. Who is the provider and who is the deployer of an AI agent works through common set-ups, and provider or deployer: your role when you run agents helps you decide.

For the wider picture, see our guide to AI agent regulation.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.