Provider (EU AI Act)

Term: Provider (EU AI Act)

A provider under the EU AI Act is any organisation or person that develops an AI system or general-purpose AI model, or has one developed and places it on the EU market or puts it into service under their own name or trademark, whether for payment or free of charge.

Why it matters

Provider is the status that carries the heaviest obligations under the Act. Providers of high-risk AI systems own risk management, data governance, technical documentation, human oversight design, post-market monitoring and serious incident reporting. If your organisation carries provider status, these functions must each have a named owner with the authority and evidence to discharge them.

Many organisations assume they are only using AI, so they cannot be providers. This is often wrong. Fine-tuning a model, rebadging a system under your own name or substantially modifying a high-risk system can make you a provider even when you did not build the original technology. The status follows what you do, not what you call yourself, which is why a fashionable title such as Chief AI Officer tells you nothing about your legal exposure until you have mapped the underlying activity.

How it works in practice

Consider an NHS trust that takes a commercial diagnostic model and fine-tunes it on local patient data before deploying it in clinical pathways. The original vendor is a provider, but the trust may become a provider too because of the modification. It now inherits documentation and monitoring duties it did not expect. The distinction between provider and deployer is the first question any accountability mapping must answer, because everything downstream depends on it.

UK and other non-EU organisations are frequently in scope. If you place an AI system on the EU market, or the output of your system is used in the EU, provider obligations can apply regardless of where you are established.

This definition tracks the text of the Act and may evolve as official guidance is published. It is informed guidance, not legal advice; confirm your status with qualified legal review.

Related terms: EU AI Act, AI Governance.