The EU AI Act allocates obligations not by industry but by role. The two most important roles are provider and deployer. Misjudging your role means either fulfilling obligations that do not apply to you or overlooking those that do.
The definitions
A provider is a natural or legal person that develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. A deployer is anyone using an AI system under its own authority, except in a personal non-professional activity. A company using a purchased AI tool for candidate screening is a deployer; the tool’s maker is the provider.
What separates the roles
Providers of high-risk systems carry the heavy load: risk management, data quality, technical documentation, logging, transparency towards deployers, human oversight by design, accuracy and robustness, conformity assessment, registration and post-market monitoring. Deployers must use the system according to its instructions, ensure human oversight by competent people, check input data under their control, monitor operation, keep logs and inform workers. Certain deployers must additionally carry out a fundamental rights impact assessment.
When the deployer becomes a provider
Article 25 of the AI Act governs the change of role. A deployer or other third party is considered the provider of a high-risk system if it puts its name or trademark on it, substantially modifies it, or changes its intended purpose so that it becomes high-risk. For software houses this is the most common trap: building a third-party model into your own product and selling it for a high-risk purpose makes you the provider of that product.
Why Swiss companies are affected
The AI Act applies to providers placing AI systems on the EU market regardless of where they are based, and to providers and deployers in third countries where the system’s output is used in the EU. A Swiss SaaS provider with EU customers is therefore typically covered as a provider, and a Swiss company using AI outputs in the EU may be covered as a deployer.
Determine the role per system
The role is determined per AI system, not per company. The same company can be the provider of its own product and the deployer of a purchased HR tool. An AI inventory with role, purpose and risk class per system is therefore the first step; our high-risk classification checklist and the gap assessment start exactly there.