The provider is whoever develops the agent, or has it developed, and places it on the market or puts it into service under its own name. The deployer is whoever uses it in a professional capacity. Buy a finished agent and you are the deployer. Build one on a model and use it yourself, and you are both.
How does the Act define the two roles?
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Providers carry the design obligations, which for high-risk systems include risk management, data governance, technical documentation, automatic logging, information to deployers, human oversight by design, and accuracy, robustness and cybersecurity. The role is explained in what a provider is under the EU AI Act.
A deployer uses an AI system under its authority, except for purely personal, non-professional use. Deployers of high-risk systems carry Article 26 duties: use according to instructions, assign competent human oversight, monitor, keep logs, and inform people. See what a deployer is under the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do the roles split across an agent's layers?
An agent usually has three layers, and the roles follow them.
| Layer | Who | Likely role |
|---|---|---|
| General-purpose model | Model provider | Provider of a general-purpose AI model, with its own obligations |
| Agent platform that sells ready-made agents | Platform company | Provider of the AI system it markets |
| Regulated firm using the agent | Bank, insurer, lender | Deployer |
| Firm that assembles its own agent on a model | That firm | Provider and deployer |
The model provider's obligations concern the model. They do not make it the provider of your agent. Whoever turns the model into an AI system with a purpose, and puts it into service, is the agent's provider.
When does a deployer become a provider?
A deployer takes on provider obligations for a high-risk system if it:
- puts its own name or trademark on a high-risk system already on the market;
- makes a substantial modification to it;
- changes the intended purpose of a system so that it becomes high-risk, for example using a general support agent to assess customers' creditworthiness.
For agents, the third trigger is the common one. Adding a tool or a source can change what an agent does, and if the new use is listed in Annex III, the firm may have become a provider without deciding to. The agent-specific analysis is in provider or deployer? Your role under the EU AI Act when you run agents.
An illustrative example
Take an insurer that licenses a claims agent from a platform. The platform markets it for property claims triage. The insurer is the deployer. Its duties are to follow the instructions for use, assign oversight and keep logs.
A year later, the insurer's health division asks to reuse the agent to assess applicants for health cover, which is risk assessment and pricing for health insurance, a high-risk use. If the insurer simply points the agent at health applications, it has changed the intended purpose to a high-risk one and becomes the provider for that use, with technical documentation, risk management and conformity duties. Instead, the insurer asks the platform whether it offers a version intended for that purpose, and records the decision either way.
How should roles be assigned and recorded?
- Record the role per agent and per use in your AI register: provider, deployer or both.
- Hold the provider's documentation for every agent you deploy, including its instructions for use and intended purpose.
- Gate changes to tools, sources and purposes through a check on whether your role changes.
- Write roles into contracts with platforms: who provides documentation, who handles incidents, who keeps which logs.
- Name an owner for each role inside the firm.
Deployers can work through the deployer obligations checklist under the EU AI Act. The wider argument about agents is in the EU AI Act and agents that act, and the full map in AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, an agent's role scope is enforced at the moment of action: a claims agent asked to price health cover is refused unless that capability has been added and certified. That makes an accidental change of intended purpose visible and recorded rather than silent.
Questions people ask
Is the model provider responsible for our agent's compliance?
No. It carries obligations for the model. The agent's provider, and you as deployer, carry the obligations for the AI system and its use.
Can a contract make the vendor the deployer?
No. Roles follow the facts. Whoever uses the agent under its authority is the deployer, whatever the contract says, though contracts can allocate tasks and costs.
Are we a provider if we only write the agent's instructions?
Possibly. If you assemble a model, instructions, sources and tools into an agent with a purpose and put it into service under your name, you are likely its provider.