Who is who: the five operators

Lesson 1 of 5 in The Value Chain: Providers, Deployers, Importers, Distributors.

The high-risk requirements you met in Arts 8–15 describe what a compliant system looks like. This module answers the harder commercial question: who has to make it so? The AI Act borrows its answer from thirty years of EU product-safety law: it names the actors in the supply chain, assigns each a distinct bundle of duties, and makes each actor a checkpoint on the road to the EU market.

Art 3 defines five roles, collectively called operators:

  • Provider (Art 3(3)) — develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. The trademark clause matters: you can be a provider without writing a line of code.
  • Deployer (Art 3(4)) — uses an AI system under its authority in a professional context. Personal, non-professional use is out of scope entirely.
  • Authorised representative (Art 3(5)) — an EU-established person with a written mandate from a non-EU provider, the Act’s guaranteed point of contact inside the Union.
  • Importer (Art 3(6)) — an EU-established person who places on the EU market a system bearing the name or trademark of a person established outside the Union.
  • Distributor (Art 3(7)) — anyone else in the supply chain, other than provider or importer, who makes the system available on the EU market.

Two design choices make this taxonomy work. First, roles attach to functions, not labels — what you do with the system determines what you are, and one company can hold two roles at once (a bank that builds its own credit-scoring model is provider and deployer, and owes both duty sets). Second, duties are graduated by proximity to the design: the provider, who controlled development, carries the full Arts 8–15 burden; importers and distributors verify paperwork; deployers control the context of use and owe use-context duties.

That gradient is deliberate. The Act puts each obligation on the actor best placed to discharge it — nobody else can fix a biased training set except the provider, and nobody else can guarantee competent human oversight on the shop floor except the deployer.

The journey of a high-risk system to an EU user

  1. Provider (non-EU)

    Develops the system, runs conformity assessment, draws up documentation, affixes CE marking (Arts 16, 43, 47–48).

  2. Authorised representative

    Written mandate; verifies conformity assessment was carried out and documentation exists; keeps docs for authorities 10 years (Art 22).

  3. Importer

    Verifies conformity assessment, technical documentation, CE marking and declaration of conformity before placing on the market; adds its own name and address (Art 23).

  4. Distributor

    Checks CE marking, declaration of conformity, instructions for use; verifies provider and importer met their marking duties (Art 24).

  5. Deployer

    Uses per instructions, assigns competent human oversight, monitors, keeps logs, informs affected persons (Art 26).

  6. Affected person

    Holds rights: explanation of individual decisions (Art 86), complaints to authorities (Art 85).

Interactive sorting exercise: Assign each actor its Art 3 role — judge the function, not the job title.

Key terms: provider, deployer, importer (AI Act), distributor (AI Act), authorised representative

Interactive checkpoint quiz (1 questions) — open this page in a browser to take it.