How the EU AI Act splits obligations by role in the supply chain: what a provider owes, what a deployer owes, what distributors and importers owe, when a deployer becomes a provider, and how a company maps its role before building a compliance program.
The EU AI Act does not place the same obligations on everyone who touches an AI system. It divides the obligations by role in the supply chain: who develops the system, who uses it, and who moves it between the two. A company's first step is not to ask which obligations apply to it, but which role or roles it fills, because the role determines the obligations.
The same AI system passes through several hands before it reaches the end user, and each party along the way carries a different responsibility. The act defines distinct roles and places its own package of obligations on each. One company can fill more than one role, and sometimes it enters a stricter role without noticing.
Mapping the role is therefore the basis of any compliance program; without it, it is easy to misjudge the scope of the obligations.
The provider is the party that develops an AI system, or has it developed, and places it on the market under its own name. It carries the heaviest package of obligations, especially when the system is classified as high risk: a risk management system, data quality and governance, technical documentation, transparency, human oversight, and a declaration of conformity.
The provider is responsible for the system meeting the requirements before it ever enters the market.
The deployer is the party that uses an AI system in the course of its professional activity, for example an organization that integrates an AI tool into its workflows. Its obligations are lighter than the provider's, but they are real: use the system according to the instructions, ensure effective human oversight, monitor its operation, and in certain cases inform people that they are subject to an AI system.
A deployer that ignores its obligations is exposed, even if the provider did its part.
The distributor and the importer are the links that move the system between the provider and the deployer. The importer is the party that brings a non-EU provider's system into the Union, and it must verify that the provider met its obligations before the system enters the market. The distributor is the party that makes the system available in the supply chain, and it must check that it carries the required marking and documentation.
These roles are a kind of gatekeeper: they do not develop the system, but they are responsible for not passing on a system that does not conform.
A critical point is that the boundary between roles is not fixed. A deployer that makes a substantial modification to a system, that markets it anew under its own name, or that changes its purpose in a way that makes it high risk, may be treated as its provider and carry the heavy package of obligations.
A company that thinks it is only a user may find that it has become, in legal terms, a manufacturer. Every substantial change therefore calls for a fresh look at the role.
Preparation starts with mapping: for every AI system the company develops, integrates, imports, or distributes in the European context, determine which role it fills. On that map, build the package of obligations that fits each role, and check where the company fills more than one. An Israeli company that exports an AI product to Europe is usually a provider, and sometimes also a deployer of components it integrates itself, so it is important not to narrow the analysis to a single role.
Under the EU AI Act, the role determines the obligations. A provider carries the heavy package, a deployer carries use and oversight obligations, and a distributor and importer carry gatekeeper obligations. The boundary between roles is mobile, and a substantial change can turn a deployer into a provider.
A company that maps its role, or roles, correctly builds a precise compliance program instead of guessing at the scope of its obligations.
Note: nothing here is legal advice or a substitute for it, and it is not a binding opinion. Every case requires an individual review with a licensed lawyer.
נושא: בינה מלאכותית וממשל סיכונים
Real estate advisory & opinion · AI advisory & opinion · Advisory · Mediation & dispute resolution · Articles · Q&A · Readiness assessment · Book a call