The AI Value Chain: Provider, Deployer, Importer, Distributor

The EU AI Act, Regulation (EU) 2024/1689, does not impose one undifferentiated set of duties. It assigns obligations by role along the value chain, and the same organisation can hold different roles for different systems. Get the role right and the obligations follow; get it wrong and the wrong party carries the stack. This is the practical map.

The four operator roles

• Provider (Article 16). Develops an AI system (or has it developed) and places it on the market or puts it into service under its own name or trademark. Carries the heaviest duties for high-risk systems: Articles 9–15, technical documentation, conformity assessment, Declaration of Conformity, CE marking, registration.
• Deployer (Article 26). Uses an AI system under its own authority (other than for personal, non-professional use). For high-risk systems: follow instructions, ensure human oversight, retain logs ≥6 months, inform workers' representatives, monitor and flag incidents.
• Importer (Article 23). Places on the EU market a system from a provider established outside the EU. Must verify the provider did the conformity work before importing.
• Distributor (Article 24). Makes a system available on the market without being provider or importer. Must check the CE marking and documentation are present.

A product manufacturer can also be treated as the provider where AI is a safety component of its product (Article 25(4)).

How roles shift: Article 25

Roles are not fixed labels. Under Article 25, a distributor, importer, deployer or third party becomes the provider of a high-risk system — inheriting the Article 16 stack — if it: puts its name or trademark on the system; makes a substantial modification (Article 3(23)); or changes the intended purpose so the system becomes high-risk. The original provider must then cooperate and share information (Article 25(2)). The flip is automatic by operation of law; a contract allocates work, not legal status.

Why this is the question that decides everything

Most organisations are deployers — the lighter Article 26 role. But procurement, branding and customisation decisions can quietly turn a deployer into a provider. The single most consequential field in any AI register is the role, because it determines whether you owe the deployer's handful of duties or the provider's full stack. Re-check it on every material change, not just at signing.

Worked example: one company, three roles

Meridian Tech deploys a third-party HR tool (deployer, Article 26); imports a non-EU analytics system to sell in the EU (importer, Article 23, verifying the provider's conformity); and rebrands a bought-in scoring engine under its own name (provider, Article 25(1)(a) → Article 16). Three systems, three roles, three obligation sets — held by the same company at once. The register records each separately.

How Confir helps

Confir derives your role for each system from how you actually source, brand, modify and use it — flagging the Article 25 flips that turn a deployer into a provider — and then scopes the matching obligations. The engine is deterministic and rule-based, so the role and its duties are cited and reproducible.

Frequently asked questions

What roles does the EU AI Act define along the value chain?

Provider (Article 16), deployer (Article 26), importer (Article 23) and distributor (Article 24), plus the product manufacturer treated as provider for safety-component AI (Article 25(4)). Obligations are assigned by role, and the same organisation can hold different roles for different systems.

What is the difference between a provider and a deployer?

A provider develops a system and places it on the market or puts it into service under its own name, carrying the heaviest high-risk duties (Article 16). A deployer uses a system under its own authority, carrying the lighter Article 26 duties — instructions, oversight, log retention, incident flagging.

How can our role change?

Under Article 25, a deployer, importer or distributor becomes the provider of a high-risk system if it brands the system as its own, substantially modifies it, or changes its intended purpose so it becomes high-risk. The flip is automatic by law; contracts allocate work, not legal status.

Can one company hold several roles?

Yes. A company can be a deployer of one system, an importer of another, and a provider of a third, all at once. The role is assessed per system, which is why an AI register records the role for each entry.

Why is the role the most important classification?

Because it decides whether you owe the deployer's handful of duties or the provider's full high-risk stack. Procurement, branding and customisation decisions can shift it, so it should be re-checked on every material change.

Related guides

• Provider versus deployer roles
• Article 25 value-chain roles
• Importer obligations
• Distributor obligations
• The AI use case register