The AI Act distinguishes between different categories of operators in relation to AI systems: providers, deployers, importers, distributors, and product manufacturers. The present Guidelines will focus only on providers and deployers given the scope of the prohibited practices in Article 5 AI Act.
According to Article 3(3) AI Act, providers are natural or legal persons, public authorities, agencies or other bodies, that develop AI systems or have them developed and place them on the Union market, or put them into service under their own name or trademark11 (see section 2.3 above). Providers established or located outside the Union are subject to the provisions of the AI Act if they place those systems on the market or put them into service in the Union ,12 or if the output of the AI system is used in the Union.13 Providers must ensure their AI systems meet all relevant requirements before placing them on the market or putting them into service. For example, a provider of a RBI system is the manufacturer of the systemthat markets the system in the Union under its trademark. The provider of such a system could also be a public authority that develops the system in-house and puts it into service for its own use.
Deployers are natural or legal persons, public authorities, agencies or other bodies using AI systems under their authority, unless the use is for a personal non-professional activity.14 ‘Authority’ over an AI system should be understood as assuming responsibility over the decision to deploy the system and over the manner of its actual use. Deployers fall within the scope of the AI Act , if their place of establishment or location is within the Union15 or, if they are located in a third country, the output of the AI system is used in the Union.16
Where the deployer of an AI system is a legal person under whose authority the system is used, i.e. a law enforcement authority or a private security company, the individual employees that act within the procedures and under the control of that person should not be considered to be the deployer . A legal person also remains a deployer if it involves third parties (e.g. contractors, external staff) in the operation of the system on its behalf and under its responsibility and control.
Operators may fulfil more than one role concurrently in relation to an AI system. For example, if an operator develops its own AI system that it use s afterwards, it will be considered both the provider andthe deployer of that system, even if that system is also used by other deployers to whom the system has been provided in return for payment or free of charge.
Continuous compliance with the AI Act is required during all phasesof the AI lifecycle. This necessitates ongoing monitoring of and updates to AI systems placed on the market or put into service in the Union to ensure that an AI system remains compliant with the AI Act throughout its lifecycle and that it does not result in a practice prohibited under Article 5 AI Act. Providers and deployers of AI systems have different responsibilities depending on their roles and control over the design , the development and the actual use of the systemto avoid a prohibited practice. For each of the prohibitions, these roles and responsibilities should be interpreted in a proportionate manner, taking into account who in the value chain is best placed to adopt specific preventive and mitigating measures and ensure compliant development and use of AI systems in line with the objectives and the approach of the AI Act.