AI Act Roles: Are You a Provider or a Deployer? A Guide for Irish Employers

Under the EU AI Act, the obligations that apply to you depend on your role, and the two roles most Irish employers will meet are "provider" and "deployer". Most employers that buy an AI tool and use it at work will be deployers. But the Act also says when a deployer is treated as a provider, and that is where the heavier duties sit. This guide explains the definitions, the Article 25 triggers and a practical way to work out your role. It is general information, not legal advice. If you already know you are a deployer of a high-risk system, our guide to deployer obligations and human oversight under Article 26 picks up from there.

Why the AI Act provider or deployer question matters

The Act is built around roles. The European Commission's "Navigating the AI Act" page (last updated 7 August 2026) says obligations fall on providers, with a developer of a CV-screening tool given as an example, and on deployers of AI systems, with a bank using such a tool given as the deployer example. The same page says the framework applies to public and private actors inside and outside the EU.

So the first compliance question is not "are we using AI?" but "what is our role for each system?". The answer can differ from one tool to the next, even inside the same Dublin HR team.

The Article 3 definitions in plain terms

We read the definitions on the Commission's AI Act Service Desk, which reproduces the Regulation (EU) 2024/1689 text (the page refers to the EUR-Lex consolidated version as at 27 July 2026). In summary:

• Provider: a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether paid or free.
• Deployer: a natural or legal person, public authority, agency or other body using an AI system. Use in a purely personal, non-professional capacity is excluded.
• Importer, distributor and authorised representative: other roles in the supply chain. An importer is established in the Union and places on the market a system carrying the name or trademark of an entity outside the Union. A distributor is in the supply chain and is neither provider nor importer.
• Operator: the umbrella term for provider, product manufacturer, deployer, authorised representative, importer or distributor.

Three related definitions matter for the role question. "Placing on the market" is the first making available of an AI system in the Union. "Putting into service" is the supply of a system for first use directly to the deployer, and it also covers own use in the Union for the system's intended purpose. "Intended purpose" is the use the provider intends, including the specific context and conditions of use set out in its instructions, marketing materials and technical documentation.

That last definition is the key to this topic. The provider decides the intended purpose. A deployer who uses the system outside that purpose is the one at risk of changing roles.

When a deployer becomes a provider: Article 25

The Service Desk's page on Article 25, "Responsibilities along the AI value chain", sets out when another party is treated as the provider of a high-risk AI system. In summary, a distributor, importer, deployer or other third party is considered a provider, and takes on the provider obligations in Article 16, if they:

• put their name or trademark on a high-risk AI system already placed on the market or put into service;
• make a substantial modification to a high-risk AI system in such a way that it remains high-risk; or
• modify the intended purpose of an AI system that was not classified as high-risk, including a general-purpose AI system, so that it becomes high-risk.

"Substantial modification" is defined in Article 3 as a change after placing on the market or putting into service that was not foreseen in the original conformity assessment and that affects compliance or changes the intended purpose assessed.

When this happens, the initial provider is no longer treated as the provider of that specific system. It must still cooperate closely with the new provider and supply the necessary information and technical access, unless it clearly specified that its system was not to be changed into a high-risk one. Article 25 also says providers and third-party suppliers of tools, components or services used in a high-risk system must agree in writing the information, capabilities, technical access and assistance needed. The page says this does not apply to free and open-source tools or components other than general-purpose AI models.

The Service Desk page also carries a notice that the provision has been amended by the Digital Omnibus on AI but that the displayed text had not yet been updated. We have therefore described Article 25 as the page shows it. Check the current consolidated text before relying on the detail.

What provider status would involve

Article 16 lists the obligations of providers of high-risk AI systems. According to the Service Desk page, they include making sure the system meets the Section 2 requirements, having a quality management system, keeping documentation and automatically generated logs under their control, carrying out the relevant conformity assessment, drawing up an EU declaration of conformity, affixing the CE marking, meeting registration obligations, taking corrective action, and demonstrating conformity to an authority on a reasoned request. That is a product-developer's workload, not a user's, and most employers will not want to take it on by accident.

By contrast, the Article 26 deployer duties summarised on the Service Desk include operating the system in line with the provider's instructions, assigning human oversight to people with the necessary competence, training and authority, checking that input data under the deployer's control is relevant and sufficiently representative for the intended purpose, and informing workers' representatives and affected workers before a high-risk system is used at the workplace. The page says this sits alongside existing EU and national rules on informing workers.

A practical way to work out your role

Our suggestion: for each AI tool in use, ask these questions and record the answers in your AI inventory.

• Did we develop this system, or commission it, and is it offered under our name or brand?
• Are we using it within the intended purpose the provider describes in its instructions?
• Have we customised or retrained it, or changed how it works, beyond what the provider anticipated?
• Have we repointed a general tool (for example a chatbot) at a use that appears in Annex III, such as screening job applicants?
• Do we put our own branding on a vendor's high-risk tool when we make it available to others?

These are illustrations of how we read the definitions, not conclusions about any real product. Whether a system is high-risk at all depends on the Act's classification rules. Annex III point 4 lists AI systems intended for recruitment or selection of natural persons (including placing targeted job advertisements, analysing and filtering applications and evaluating candidates) and systems used to make decisions affecting terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour. Our related guide on AI in recruitment and HR under the EU AI Act goes further on that area.

Keep the role under review, and check the dates

Roles are not fixed. A change in use, a new integration or a rebrand can alter your position, so review the inventory when a tool changes. On timing, the Commission page cited above says prohibitions, definitions and AI literacy rules have applied since 2 February 2025 and governance and general-purpose AI obligations since 2 August 2025, and that high-risk rules are now slated to apply from 2 December 2027, linked to the Digital Omnibus, which it says entered into force on 27 July 2026. Because those dates have been subject to change, treat this as the position on that page on 7 August 2026 and check the current position. Our guide to EU AI Act key dates for employers in Ireland tracks the timeline.

The Commission's AI literacy questions and answers page (last updated 27 July 2026) says Article 4 applies to both providers and deployers; following the Digital Omnibus on AI (Regulation (EU) 2026/1744) it describes the obligation as one where no specific level of AI literacy is mandated. In our reading, AI literacy measures for staff who operate AI systems are therefore relevant whichever role you hold. The page also describes the earlier November 2025 proposal, so check the current position.

Next steps for employers

• List every AI tool and mark each as provider, deployer or unsure.
• Obtain and file the provider's instructions for use for each tool.
• Write down what each tool is intended to do and what your teams actually use it for, and flag any gap.
• Before rebranding, customising or redirecting a tool, ask whether that could amount to a change of role.
• Take legal advice on borderline cases.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is an employer that uses ChatGPT-style tools a provider or a deployer?

Under the Article 3 definitions as shown on the Commission's Service Desk, a body that uses an AI system is a deployer, unless the use is purely personal. Whether stricter obligations arise depends on the use. If the use falls within Annex III, the system is high-risk subject to the Act's classification rules.

Can a deployer become a provider without meaning to?

According to the Service Desk page on Article 25, yes: putting your own name or trademark on a high-risk system, substantially modifying it, or changing the intended purpose of a non-high-risk system so that it becomes high-risk can each make you a provider of that system.

Who decides the intended purpose of a tool?

The definition ties intended purpose to the use the provider intends, as described in its instructions, marketing materials and technical documentation. That is why keeping the vendor's documents matters.

Do these roles apply to employers outside the EU?

The Commission's Navigating the AI Act page says the framework applies to actors inside and outside the EU who place systems on the EU market, put them into service or use them in the EU. The page does not discuss deployers based outside the EU in detail, so take advice if that applies to you.

Roles drive obligations under the AI Act, so identifying yours for each system is a sensible first step. Revisit the answer whenever a tool, its use or its branding changes.