In this article (7 sections)
AI Act obligations are not “the same for every company that uses AI”. They follow your role. For the same AI system, the company that develops it, the company that sells it under its own brand, the company that imports it and the company that uses it at work carry very different responsibilities. Get the role wrong and you either do unnecessary work or miss responsibilities you actually have. This article sets out the six roles in the AI Act and the situations Taiwanese companies meet most often.
Key takeaways
- A provider is anyone who places an AI system on the market or puts it into service under its own name or trademark, whether it developed the system itself or had it developed (Article 3(3)). Most high-risk AI obligations sit with the provider.
- A deployer is anyone using an AI system under its authority (Article 3(4)). A European subsidiary that uses AI in its operations is a deployer.
- A provider of high-risk AI established in Taiwan must appoint, by written mandate, an authorised representative established in the EU (Article 22).
- Putting your own brand on a system, making a substantial modification or changing its intended purpose can all turn a distributor, importer or deployer into a provider (Article 25(1)).
What roles does the AI Act define?
| Role | Key points of the definition | Provision |
|---|---|---|
| Provider | Develops an AI system or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge | Article 3(3) |
| Deployer | Uses an AI system under its authority (except in the course of a personal, non-professional activity) | Article 3(4) |
| Authorised representative | Established in the EU and has received a written mandate from a third-country provider | Article 3(5), Article 22 |
| Importer | Established in the EU and places on the EU market an AI system bearing the name or trademark of a third-country operator | Article 3(6), Article 23 |
| Distributor | Anyone in the supply chain, other than the provider or importer, who makes an AI system available on the EU market | Article 3(7), Article 24 |
| Product manufacturer | Places an AI system on the market together with its own product, under its own name or trademark | Article 2(1)(e), Article 25(3) |
Despite the name, a deployer does not have to install or host the system itself: what matters is that it uses the system in its own business.
How are high-risk AI obligations divided?
| Role | Main obligations |
|---|---|
| Provider (Article 16) | Meet the Chapter III, Section 2 requirements; indicate name and contact address; quality management system; documentation keeping; log keeping; conformity assessment; EU declaration of conformity; CE marking; registration in the EU database; corrective actions; accessibility requirements |
| Importer (Article 23) | Before placing on the market, verify that the provider has carried out the conformity assessment, drawn up the technical documentation, affixed the CE marking and issued the declaration of conformity, and has appointed an authorised representative |
| Distributor (Article 24) | Before making available, verify the CE marking, declaration of conformity and instructions for use; do not make the system available if it is found not to conform |
| Deployer (Article 26) | Use in accordance with the instructions for use; assign human oversight to competent persons; ensure input data under its control is relevant; monitor operation; keep logs for at least six months; inform workers’ representatives and affected workers before use in the workplace |
The provider’s obligations are the heaviest and need the most preparation from the design stage. The deployer’s obligations are lighter, but they are all ongoing obligations during operation, and informing workers under Article 26(7) works alongside the information and consultation procedures of each country’s labour law.
Which one is your company?
- You develop equipment or software with AI for European brands (ODM, OEM)
- You sell AI products or software in Europe under your own brand
- Your European subsidiary uses AI in recruitment, scheduling, customer service or quality control
- You integrate another company's AI system into your own solution and resell it
Many companies hold several roles at once, and the answer can differ by product and by market.
Five common situations for Taiwanese companies
Situation 1: You develop equipment with AI features as an ODM for a European brand. The product is placed on the market under the European brand’s name, so by definition the brand owner is the provider, having “had it developed and placed it on the market under its own name”. The Taiwanese ODM is usually not the provider, but is a third party supplying an AI system, model or component. If the system is high-risk, Article 25(4) requires both parties to agree in writing on information, technical access and assistance. This is the subject of Part 6.
Situation 2: You sell AI software or equipment in Europe under your own brand. You are the provider. If the system is high-risk, a provider established in Taiwan must appoint an authorised representative established in the EU by written mandate before making it available on the EU market (Article 22); European importers will also check that you have done so before placing it on the market (Article 23(1)(d)).
Situation 3: The product itself is regulated by EU product legislation, and the AI is a safety component. For products covered by the product legislation in Annex I Section A, where the AI safety component is placed on the market together with the product under the manufacturer’s name, the product manufacturer is considered the provider of the high-risk AI (Article 25(3)). This is explained in Part 4 and Part 5.
Situation 4: Your European subsidiary uses AI in its operations. The subsidiary is a deployer. Even if the system was developed by the Taiwan headquarters and provided to the subsidiary free of charge, the headquarters may be the provider, because “putting into service” includes supply for own use (Article 3(11)). Internal group tools also need a role assessment.
Situation 5: You integrate someone else’s AI system into your own solution and sell it under your own brand. System integrators can easily become providers without realising it. See the next section.
When does a role change?
Under Article 25(1), a distributor, importer, deployer or other third party is considered a provider of high-risk AI if it:
- puts its name or trademark on a high-risk AI system already placed on the market (unless contractual arrangements allocate the obligations otherwise);
- makes a substantial modification to a high-risk AI system in such a way that it remains high-risk;
- changes the intended purpose of an AI system that is not high-risk (including a general-purpose AI system) in such a way that it becomes high-risk.
The third case is the one most often overlooked. For example, using a general generative AI tool to screen job applicants or evaluate employee performance means using it for a high-risk purpose under point 4 of Annex III.
The Digital Omnibus rewrote Article 25(2): after the role changes, the original provider is no longer the provider of that system, but must cooperate closely with the new provider and make available the technical documentation, known limitations and failure modes, and the technical access needed for testing and validation. The original provider does not have this cooperation obligation if it has clearly stated that the system must not be changed into a high-risk use. The Omnibus also added breaches of Article 25(2) and (4) to the penalties in Article 99(4), with a maximum of EUR 15 million or 3% of worldwide annual turnover.
Is it clear in your contracts?
Rebranding, customisation, integration and resale each allocate roles and responsibilities differently, and the Omnibus has attached penalties to "who must provide what". How to determine the roles and reflect them in contracts depends on the actual products and transaction structure.
FAQ
What is the difference between a provider and a deployer under the AI Act?
A provider places an AI system on the market or puts it into service under its own name; a deployer uses an AI system under its own authority. For high-risk AI, design, documentation and conformity assessment sit with the provider; the deployer is responsible for use in accordance with the instructions, human oversight, monitoring and log keeping.
We use another company’s AI system and have only changed the prompts and interface. Do we become a provider?
Look at three things: whether you launch it under your own name, whether the change is a substantial modification under Article 3(23), and whether the use has become high-risk. If you only adjust settings and use the system within its original intended purpose, you usually remain a deployer.
Does a Taiwanese company have to find an authorised representative in Europe?
A provider of high-risk AI established in a third country must appoint an authorised representative by written mandate before making the system available on the EU market (Article 22). There is no such obligation for AI that is not high-risk; providers of general-purpose AI models are subject to separate rules in Article 54.
Does AI developed by our Taiwan headquarters and used only internally by our European subsidiary carry provider obligations?
Possibly. “Putting into service” includes supply for own use, so if the headquarters puts the system into service in the EU under its own name, it may be the provider, and the subsidiary is the deployer. How many obligations apply still depends on whether the system is high-risk.
Next in the series
Part 4: AI in machinery: what changes after the move to Annex I Section B
Previous: Part 2: Do AI-generated marketing materials and customer service chatbots need labelling?
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and can help you confirm your AI Act role and applicability by product and market.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 2, 3, 16, 22 to 26 and 99: EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · Regulation (EU) 2026/1744 (Digital Omnibus on AI) · AI Act consolidated text (27 July 2026). This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI Actproviderdeployerprovider vs deployerauthorised representativerole determination2024/1689
