What obligations does a deployer actually have under the AI Act?

Article 26 imposes concrete duties on deployers of high-risk AI systems, including using the system in accordance with its instructions for use, assigning human oversight to competent and trained personnel, monitoring the system's operation for signs of risk, and, for certain public bodies and services, conducting a Fundamental Rights Impact Assessment before deployment. A common misconception is that deployers face no meaningful compliance burden simply because they did not build the system, which is incorrect and can expose healthcare organizations to enforcement risk.

Can a healthcare organization accidentally become a 'provider' under the AI Act?

Yes, Article 25 provides that if a deployer substantially modifies a high-risk AI system, or rebrands it under its own name or trademark, that entity can be deemed the provider and inherit the full set of provider obligations, including conformity assessment responsibility. Hospitals or health systems that customize, relabel, or significantly modify AI-enabled devices without recognizing this risk can unexpectedly take on manufacturer-level regulatory responsibilities they are not equipped to fulfill.

How should contracts between manufacturers and healthcare customers address the provider-deployer split?

Contracts should explicitly state which party is acting as provider and which as deployer, define the boundaries of permitted customization or configuration that would not trigger a role change under Article 25, and specify how information relevant to each party's obligations, such as incident reports, monitoring data, or updates, will be shared between them. Leaving these roles implicit creates ambiguity that can surface only during a regulatory inquiry or an adverse event investigation, when clarity matters most.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Quality System Global Markets

Provider and Deployer (EU AI Act)

The two primary role categories in the AI Act. Providers place systems on the market; deployers put them into use in a professional capacity.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 3(3) defines a provider as a natural or legal person that develops an AI system or has one developed and places it on the market or puts it into service under its own name or trademark. Article 3(4) defines a deployer as a natural or legal person using an AI system under its authority, except where use is in the course of a personal non-professional activity. Obligations differ sharply between the two.

What the regulation says

Regulation (EU) 2024/1689, adopted on 13 June 2024 and in force since 1 August 2024, distinguishes responsibility for supplying AI from responsibility for using it. Article 3(3) defines providers as persons or entities that develop an AI system, or have it developed, and market or commission it under their own name or trademark. Article 3(4) defines deployers by use under their authority, excluding personal, non-professional activity. For high-risk systems, Article 16 assigns providers obligations including conformity assessment, technical documentation, quality management and registration. A MedTech organisation may occupy both roles. Article 26 requires deployers of high-risk AI to follow instructions, assign competent human oversight, monitor operation and retain automatically generated logs under their control, normally for at least six months. Where they control input data, deployers must ensure it is relevant and sufficiently representative for the intended purpose. Article 25 can transfer provider responsibilities to deployers or other parties following rebranding, substantial modification or certain changes of intended purpose. The Act generally applies from 2 August 2026; Article 6(1) and corresponding obligations for qualifying product-related high-risk AI, including certain medical-device AI, apply from 2 August 2027.

What this means in practice

A device manufacturer is almost always the provider for its AI-enabled device. A hospital or clinic that uses the device is a deployer with a narrower but real set of duties, including human oversight, input-data governance, monitoring, and (for certain public bodies and services) a Fundamental Rights Impact Assessment. Contracts should make the split explicit.

Examples

A MedTech company that develops and sells an AI-powered diagnostic imaging system is the provider of that system, responsible for its initial compliance with the AI Act.
A hospital that purchases and integrates the AI-powered diagnostic imaging system into its clinical workflow for patient care acts as the deployer, with duties including appropriate human oversight and data governance.
A research institution developing a new AI algorithm for drug discovery is a provider when it makes the algorithm available for use, while a pharmaceutical company utilizing this algorithm in its research efforts is a deployer.

Common pitfalls

•Assuming deployers have no AI Act obligations. Article 26 imposes concrete duties on them.
•Rebranding a system under a hospital's name without recognizing that this can make the hospital the provider under Article 25.

Frequently asked questions

A hospital using an AI-enabled device within its intended purpose and under the manufacturer's name is generally a deployer under Article 3(4), since it is using the system under its own authority in a professional capacity but did not develop it or place it on the market under its own name. The device manufacturer remains the provider under Article 3(3) in this typical scenario, carrying the primary obligations for conformity assessment, technical documentation, and risk management.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

Fundamental Rights Impact Assessment(FRIA)

Assessment deployers of certain high-risk AI systems must complete before first use.

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (4)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 2

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1FDA·1European Commission·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

The two primary role categories in the AI Act. Providers place systems on the market; deployers put them into use in a professional capacity.

·A device manufacturer is almost always the provider for its AI-enabled device.
·Contracts should make the split explicit.
·Article 3(4) defines a deployer as a natural or legal person using an AI system under its authority, except where use is in the course of a personal non-professional activity.

Remember this

Watch out: Assuming deployers have no AI Act obligations. Article 26 imposes concrete duties on them.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.