EU AI Act: deep dive
AI role
Every business touching AI needs to understand how it is classified under the EU AI Act: provider, deployer, importer, distributor, product manufacturer or authorised representative
This determines which compliance obligations apply, particularly for providers and deployers
How can you be classified under the EU AI Act?
An organisation becomes a provider by doing these things:
develops an AI system (AI system) or general purpose AI model (GPAI) - internally and/or by outsourcing development or
puts an AI system or GPAI into the market (for example, for others to license and use) or
puts an AI system or GPAI into service under own name or trademark (for example, as part of its own product)
An organisation becomes a deployer by using an AI system under its authority (for example, incorporating a licensed in AI system into its own product)
An organisation becomes an importer if:
it is established in the EU plus
it places a third party-branded AI system from outside the EU onto the market inside the EU (for example, as an international reseller)
An organisation becomes a distributor if:
it is not a provider or importer but
it makes an AI system available inside the EU market (for example, as a local reseller)
An organisation becomes a product manufacturer if:
it manufactures a product (including those subject to safety rules under EU law) under its own name or trademark and
it combines an AI system with the product
An organisation acts as an authorised representatives where it is appointed to represent those above who are not established in the EU
(If an AI system is used only for personal non-professional activity, then it is not caught by the above.)
Pay attention! Can start out as one thing, but be re-classified as a provider!
If an organisation is a deployer, importer, distributor or authorised representative, it can change classification to become a provider because of doing certain things:
Put a different name/trademark on the AI system (for example, the organisation’s own)
Modify intended purpose of an AI system already in operation (for example, use a simple speech to text AI system for a wider use)
Carry out a substantial modification an AI system not contemplated by original provider during its compliance activities (for example, by use of training data with a different purpose)
If an organisation is a product manufacturer, it can change classification to become a provider because of the nature of its AI system:
AI system included with product is considered a safety component of the product within one of the following categories:
machinery
safety of toys
recreational craft and personal watercraft
lifts and safety components for lifts
equipment and protective systems intended for use in potentially explosive atmospheres
radio equipment
pressure equipment
cableway installations
personal protective equipment
appliances burning gaseous fuels
medical devices
in vitro diagnostic medical devices
And either of these is done under product manufacturer name/trademark:
Product + AI system put onto market at same time or
Product put onto market and AI system activated later on
What happens to the original provider when a new provider arises?
The EU AI Act manages this: new provider must be given prescribed detailed information, technical access and assistance by original provider to help fulfil their new obligations under the EU AI Act.
Need help determining which category you fall under? Or which obligations apply/don’t apply to you?