Under the EU AI Act you are a provider if you developed an AI system, substantially modified it, or place it on the market under your own name, and a deployer if you simply use AI that someone else built and supports. Most Irish SMEs are deployers, and the distinction decides almost everything: providers carry the heavy product-compliance regime, while deployers carry a shorter, operational set of duties.
The two roles, defined
Article 3 of the AI Act defines a provider as the person or organisation that develops an AI system (or has it developed) and places it on the market or puts it into service under its own name or trademark. A deployer is anyone using an AI system under its own authority in the course of business. Buy Microsoft Copilot licences and roll them out to staff: deployer. Build a chatbot on an API and sell it to customers under your brand: provider. The Act also has roles for importers and distributors, but for an Irish SME buying software, the provider/deployer line is the one that matters.
Why the difference matters so much
For high-risk systems, providers carry the full product-compliance regime of Articles 9 to 17: risk management, data governance, technical documentation, conformity assessment and CE marking. Deployers carry Article 26: use the system per the provider’s instructions, assign trained human oversight, check input data, retain logs, inform affected workers, and monitor for incidents. Demanding, but a fraction of the provider burden, which is why knowing your role is the second question in any AI Act compliance exercise, right after the inventory.
How a deployer accidentally becomes a provider
The line can move under you. Under Article 25, a deployer of a high-risk system can take on provider obligations if it:
- Puts its own name or trademark on a high-risk system someone else built, white-labelling a vendor’s tool as your own product.
- Makes a substantial modification to a high-risk system, changing how it fundamentally works, not adjusting its settings.
- Changes a system’s intended purpose so that it becomes high-risk, repurposing a general document tool to score job applicants, for example.
Routine configuration does not automatically change your role. However, changing intended purpose, substantial modification or supplying a system under your own name can require a fresh assessment. Branding a service or connecting data is not a universal safe harbour. Check Articles 3 and 25 against the actual arrangement.
The GPAI confusion
A separate provider regime has applied to general-purpose AI models since 2 August 2025, technical documentation, copyright policies, training-data summaries under Articles 53 to 55. This causes regular confusion, so to be plain: subscribing to ChatGPT Team, Copilot, Claude or Gemini does not make you a GPAI provider. That regime applies to the companies that train and supply the models. Developing or modifying and supplying a model needs a separate assessment under the GPAI definitions and guidance.
Practical steps for the typical Irish SME
- Record your role for each system in your AI register, per system, not per company, because a firm can be deployer of ten tools and provider of one.
- Get the provider’s instructions for use and confirm your actual use matches them, Article 26(1), and the first question in vendor due diligence.
- Watch the Article 25 triggers: white-labelling, substantial modification, repurposing. Flag any roadmap item that goes near them.
- Check the high-risk categories, especially recruitment and worker management, where deployer duties bite hardest.
Get the role right, and the rest follows
AI Register Ireland asks the role question first for every system you record, then attaches the obligations that follow from the answer. For the wider Irish picture, see the EU AI Act in Ireland.
Sources checked 4 October 2026: definitions in Article 3, Article 25 supply-chain roles and application dates. High-risk obligations have specific application dates and transitions.