Provider or deployer? AI role check sheet for small EU businesses: when rebranding, changing or repurposing an AI tool makes you the provider (EU AI Act Article 25)
What you get: a finished AI role check sheet you can paste into Google Sheets or Excel: one row per AI tool your business uses, builds or sells, seven yes/no questions, and the role that follows under the EU AI Act (deployer, provider, importer or distributor). Plus six filled example rows, a table of what each role has to do, a short email to send your AI supplier, and a checklist. Every rule is taken from Articles 3 and 25 of Regulation (EU) 2024/1689 as shown in the Commission's AI Act Service Desk.
Why your role matters
- The duties depend on the role, not on the size of your business. A deployer uses an AI system under its authority (Article 3(4)). A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge (Article 3(3)). For high-risk AI, providers carry the heavy list in Article 16 (quality management system, technical documentation, conformity assessment, EU declaration of conformity, CE marking, registration). Deployers carry the shorter list in Article 26 (use it as instructed, human oversight, monitoring, keeping logs).
- Most small businesses are deployers, until they change something. Article 25 lists three situations in which a deployer, distributor or importer is treated as the provider of a high-risk AI system. Rebranding a tool, changing it, or using a general tool for a high-risk job such as screening job applicants can move you into that column without you noticing.
- Dates. The Commission's AI Act Service Desk FAQ says national enforcement of the rules already in force, such as the Article 50 transparency rules, started on 2 August 2026. After the Digital Omnibus (Regulation (EU) 2026/1744), the high-risk rules for Annex III systems apply from 2 December 2027, and from 2 August 2028 for high-risk AI built into products under Annex I. Check the official source for the date that applies to your case.
Step 1: answer seven questions for each AI tool
| No. | Question | If "yes" | Source |
|---|---|---|---|
| Q1 | Is the tool used only for a purely personal, non-professional activity? | Outside the deployer duties. Any business use is professional, so for a business this is almost always "no". | Art. 2(10), 3(4) |
| Q2 | Did you build the AI system, or have it built for you (for example by an agency on top of an AI model's API), and do you offer or use it under your own name or brand? | You are likely the provider of that AI system. "Putting into service" includes supply for your own use. | Art. 3(3), 3(11), 3(68) |
| Q3 | Do you pass someone else's AI system on to customers in the EU (resell, bundle, licence on)? | You are a distributor. If you are established in the EU and you are the first to place on the EU market a system bearing the name of a company established outside the EU, you are the importer. | Art. 3(6), 3(7) |
| Q4 | Is the tool, or the job you use it for, high-risk (for example recruitment, credit scoring, see the Annex III check)? | Answer Q5 to Q7 with care; the provider duties of Article 16 are at stake. | Art. 6, Annex III |
| Q5 | Do you put your name or trademark on a high-risk AI system that is already on the market (white label)? | You are considered the provider, unless a contract allocates the obligations otherwise. | Art. 25(1)(a) |
| Q6 | Have you changed a high-risk AI system in a way the provider did not foresee or plan, so that its compliance or intended purpose is affected (a "substantial modification"), and it is still high-risk? | You are considered the provider. | Art. 3(23), 25(1)(b) |
| Q7 | Are you using an AI system that was not classed as high-risk, including a general-purpose chatbot, for a purpose that makes it high-risk (for example ranking job applicants)? | You may be considered the provider of a high-risk AI system. This is the case small businesses most often miss: get advice before you rely on it. | Art. 3(12), 25(1)(c) |
If every answer is "no", you are a deployer of that tool. One business can hold several roles at once: deployer of its accounting software, provider of its own website chatbot, distributor of a tool it resells.
Step 2: what each role has to do
| Role | Main duties for high-risk AI | Transparency duties for any AI (Article 50) |
|---|---|---|
| Deployer | Use it as the instructions say; assign human oversight to competent people; monitor it and tell the provider and authority about risks; keep the logs you control for at least six months; inform workers' representatives and affected workers before using it at the workplace; tell people when an Annex III system makes or helps make decisions about them (Art. 26(1), (2), (5), (6), (7), (11)) | Tell people exposed to emotion recognition or biometric categorisation (Art. 50(3)); disclose deepfakes, and AI-generated text published to inform the public unless it had human editorial review (Art. 50(4)) |
| Provider | Everything in Article 16: meet the Section 2 requirements, name and contact address on the system, quality management system, documentation, logs under its control, conformity assessment, EU declaration of conformity, CE marking, registration, corrective action | Design chatbots so people are told they are talking to an AI system, unless obvious (Art. 50(1)); mark synthetic audio, image, video or text outputs in a machine-readable way (Art. 50(2)) |
| Importer | Before placing it on the market, verify the provider's conformity assessment, technical documentation, CE marking, EU declaration of conformity and instructions, and that an authorised representative is appointed (Art. 23(1)) | As the provider's and deployer's duties apply to the system |
| Distributor | Before making it available, verify the CE marking, the EU declaration of conformity and the instructions for use; do not supply it if you have reason to think it does not conform (Art. 24(1), (2)) | As above |
When Article 25 makes you the new provider, the original provider is no longer the provider of that specific system, but must cooperate with you. The consolidated Article 25(2) on the AI Act Service Desk, as amended by the Digital Omnibus, says this includes, where relevant, technical documentation sufficient to assess compliance with Article 16, known limitations and failure modes, and targeted technical access for testing and validation. It does not apply where the original provider clearly said its system is not to be changed into a high-risk AI system. So read your supplier's terms before you rebrand or repurpose.
The role check sheet (copy and fill in)
AI role check sheet · Business: [name] · Checked by: [name, role] · Date: [dd/mm/yyyy] · Next check: [when a tool, its use or its branding changes, and at least yearly]
| No. | AI tool and supplier | What we use it for | Q1 | Q2 | Q3 | Q4 | Q5 | Q6 | Q7 | Our role | Duties to check | Supplier or contract note | Checked (date, by) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | [Website chat widget, SaaS vendor] | [answer shop questions] | no | no | no | no | no | no | no | Deployer | [vendor's chatbot says it is AI? Art. 50(1) is the vendor's duty; check it works on our site] | [asked vendor dd/mm] | [dd/mm, name] |
| 2 | [Own-brand chatbot built by an agency on an AI model API] | [customer support under our name] | no | yes | no | no | no | no | no | Provider of this chatbot (not of the AI model) | [AI notice at the first message, Art. 50(1), 50(5)] | [agency contract: who maintains the notice] | [dd/mm, name] |
| 3 | [AI image generator] | [ad and product images] | no | no | no | no | no | no | no | Deployer | [label deepfakes, Art. 50(4); see label sheet] | [n/a] | [dd/mm, name] |
| 4 | [CV screening tool, sold to our clients under our brand] | [recruitment service] | no | no | yes | yes | yes | no | no | Provider (Art. 25(1)(a)) unless the contract allocates it otherwise | [Art. 16 list; get legal advice] | [ask original provider for Art. 25(2) documentation] | [dd/mm, name] |
| 5 | [General AI chatbot subscription] | [staff paste CVs in and ask for a shortlist] | no | no | no | yes | no | no | yes | Possibly provider of a high-risk system (Art. 25(1)(c)) | [stop or get advice; see Annex III check] | [supplier terms on high-risk use] | [dd/mm, name] |
| 6 | [AI bookkeeping add-on from a non-EU company, which we are first to sell in the EU] | [resold to our clients] | no | no | yes | [check] | no | no | no | Importer | [if high-risk: Art. 23 checks before selling] | [ask for CE marking and declaration if high-risk] | [dd/mm, name] |
The six rows above are made-up examples to show how to fill the sheet, not real businesses or legal conclusions.
Keep one row per tool and per use: the same tool used for two jobs (for example answering customers and ranking applicants) gets two rows, because the role can differ. When a row says "provider" or "possibly provider" for a high-risk use, stop and get legal advice before you go on.
Email to your AI supplier
| When | Short wording |
|---|---|
| Before you rebrand, change or repurpose a tool | "We use [system, version] for [purpose] and plan to [put our brand on it / change [what] / use it for [new purpose]]. Under Article 25 of the EU AI Act, please confirm in writing: (1) whether you class the system as high-risk for that use; (2) whether your terms allow this, or say the system is not to be changed into a high-risk AI system; (3) which role and obligations stay with you under our contract; (4) if we would become the provider, which technical documentation, known limitations and technical access you will give us." |
| To confirm you are only a deployer | "Please confirm that you are the provider of [system] for the purpose stated in your instructions for use, and send the instructions for use and your contact for incidents." |
Checklist
- Every AI tool is listed in your AI inventory first, so the role sheet can name it exactly (SME AI inventory template)
- Each use of each tool has a row and a role
- Any "yes" at Q5, Q6 or Q7 has gone to a lawyer before use continues
- Supplier terms checked for high-risk use, branding and modification (AI vendor questions)
- Own-brand chatbots tell people they are AI at the first message (Article 50 chatbot checklist)
- Staff know they must not use general AI tools for recruitment, credit or other high-risk jobs without approval (staff AI use policy)
- Sheet re-checked whenever a tool, its use or its branding changes
This sheet is a starting point, not a legal opinion or proof of compliance. Whether a change is a "substantial modification" or a new intended purpose depends on the facts and on the provider's documentation. Rules for general-purpose AI model providers (Chapter V) are not covered here. The articles above were checked against the AI Act text and the consolidated text on the Commission's AI Act Service Desk on 20 October 2026; check the official source before relying on it. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often say "we only use AI, we don't make it". At your next review, ask three questions: "do you sell or pass on any AI tool to your own customers?", "is any AI tool sold or shown under your brand?", and "does anyone use AI to screen job applicants or customers' creditworthiness?". Note the answers with a date and hand them this sheet. It fits next to the client AI inventory workshop. Stay inside your professional rules and pass legal questions to a lawyer.
Keep the record with your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool, pick its role, and store the date of this role check as an evidence record against that tool.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then record each tool's role from this sheet. Related: Annex III high-risk check · AI vendor questions · AI incident and complaint log.
Sources
- Regulation (EU) 2024/1689 (AI Act): Articles 2(10), 3(3), 3(4), 3(6), 3(7), 3(11), 3(12), 3(23), 3(68), 16, 23, 24, 25, 26, 50 and Annex III
- European Commission AI Act Service Desk: Article 25 (consolidated text with Digital Omnibus amendments)
- European Commission AI Act Service Desk: Article 3 definitions
- European Commission AI Act Service Desk: FAQ (enforcement from 2 August 2026; Annex III high-risk rules from 2 December 2027)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), published 24 July 2026
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.