Deployer (EU AI Act)

Article 3, point 4 of the EU AI Act defines a deployer as "a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". The definition is about use and authority. Who built the model does not decide the role.

For an agent, the deployer is usually the company that runs it, sets its purpose and decides when it is used. A company can be a provider and a deployer at once, if it develops a system and also runs it.

In practice

When an agent is handed to a client, the question is which party is using it under its authority. If the client's staff operate the agent and decide how it is used, the client is the deployer. The builder may still carry provider duties if it places the system on the market.

Write this down in the handover pack, with the named owner who operates the agent for the deployer.

Example

[Composite] A systems integrator built an agent for a client's claims team. The client's claims manager set the rules and ran the agent day to day, so the client was the deployer. The integrator kept the provider documentation and the record of changes it made.

Common mistakes

• Assuming that the vendor is the only party with duties.
• Failing to write down who uses the agent and under whose authority.
• Forgetting that a company that builds and runs its own agent is both provider and deployer.