What is a provider under the EU AI Act?

A provider under the EU AI Act is the organisation that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. Providers carry the heaviest obligations for high-risk systems. Firms that build their own AI agents are often providers too.

Why does the provider role matter for AI agents?

The question "who is the provider?" decides who must carry out risk management, keep technical documentation, ensure data governance, design for human oversight, meet accuracy requirements and complete conformity assessment for a high-risk system. Getting it wrong means either duplicating work or, worse, assuming someone else has done what nobody has.

Agents blur the answer: one company supplies the model, another the platform, and the firm using the agent may change its brief and tools. Who is the provider and who is the deployer of an AI agent works through common arrangements.

What does a provider of a high-risk system have to do?

In substance:

• run a risk management system across the life cycle (Article 9);
• apply data governance to training, validation and testing data (Article 10);
• enable automatic logging of events (Article 12);
• give deployers clear instructions and information (Article 13);
• design the system so people can oversee it effectively (Article 14);
• achieve appropriate accuracy, robustness and cybersecurity (Article 15);
• keep technical documentation, complete conformity assessment and register where required;
• monitor the system after it is placed on the market.

When does a firm become a provider of an agent?

Common routes:

1. You build the agent and use it yourself. Putting a system into service for your own use, under your name, can make you its provider and its deployer.
2. You put your name on someone else's system. Rebranding a high-risk system makes you its provider.
3. You substantially modify a high-risk system or change its intended purpose so that it becomes high-risk. The obligations then shift to you.

Using a vendor's agent as supplied, under its instructions, normally leaves you as deployer only. Provider or deployer: your role under the EU AI Act when you run agents helps you decide which applies.

What does an example look like?

A lender's in-house team builds an agent on a model provider's general-purpose model to assess personal loan applicants. The model provider is the provider of the general-purpose model, with its own obligations. The lender is the provider of the credit assessment agent, because it developed the system and put it into service under its own name, and it is also the deployer. As creditworthiness assessment of individuals is high-risk under Annex III, the lender carries both sets of duties. Had it bought a finished agent from a vendor and used it as instructed, the vendor would be the provider.

How is a provider different from a deployer?

The provider makes the system available; the deployer uses it under its own authority. Providers are responsible for how the system is built and documented; deployers for how it is used, overseen and monitored in their setting. The two must cooperate: providers supply information under Article 13, and deployers report serious risks back. Our explanation of the EU AI Act shows how both roles fit into the Act as a whole; see whether the EU AI Act applies to AI agents for scope. Questions of enforcement are covered in who enforces the EU AI Act for AI agents. For the wider picture, see our guide to AI agent regulation.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.