Provider, deployer, importer, distributor: who does what.

Regulation (EU) 2024/1689 — the European AI Act — does not impose the same obligations on everyone who touches an AI system. It splits responsibility across four distinct roles — provider, deployer, importer and distributor — and each answers to different articles, with very different compliance burdens. Getting your role wrong is the costliest mistake a Spanish SME can make: applying a deployer's obligations when you're really a provider (or the other way round) leaves real compliance gaps exposed to the Article 99 penalty regime.

This guide explains what each role owes, using the Regulation's exact text, and lands the nuance that confuses SMEs the most: Article 25, which can turn a deployer, importer or distributor into a provider overnight — with all its obligations — without the company realising it has crossed that line.

Not sure which role applies to you or which obligations follow? See the AI Act compliance service.

How many roles does the AI Act recognise, and how do they differ?

Article 3 of the Regulation defines each role by what the company does with the system, not by its size or sector. A provider (Art. 3.3) develops an AI system or has one developed and places it on the market or puts it into service under its own name or brand, whether paid or free. A deployer (Art. 3.4) is whoever uses the system under its own authority, unless used in a purely personal, non-professional activity. An importer (Art. 3.6) is the person or entity established in the EU that places on the EU market a system bearing the name of a company established outside the EU. A distributor (Art. 3.7) is any other link in the supply chain, other than provider or importer, that makes a system available on the EU market.

Most Spanish SMEs are deployers: they contract an ATS for recruitment, a risk-scoring engine or a chatbot already built by a third party. But reselling that same system under your own brand, integrating it into your own product, or bringing it in from a provider outside the EU is enough to change your role — and with it, your obligations.

What obligations does the provider of a high-risk AI system have?

Article 16 falls on whoever develops the system and places it on the market under its own brand. Its main obligations, listed letter by letter in the article itself:

• Comply with Section 2 of Chapter III: risk management, data governance, technical documentation, automatic logging, transparency towards the deployer, human oversight, accuracy, robustness and cybersecurity (Art. 16.a).
• Identify itself on the system, its packaging or its documentation with name, registered trademark and contact address (Art. 16.b).
• Operate a quality management system compliant with Article 17 (Art. 16.c).
• Keep the technical documentation required under Article 18 (Art. 16.d).
• Keep the automatically generated logs under its control, per Article 19 (Art. 16.e).
• Pass the conformity assessment of Article 43 before placing the system on the market (Art. 16.f).
• Draw up the EU declaration of conformity per Article 47 (Art. 16.g).
• Affix the CE marking on the system or, if not possible, on its packaging or documentation (Art. 16.h).
• Register the system in the EU database per Article 49(1) (Art. 16.i).
• Apply corrective actions and report as required by Article 20 (Art. 16.j).
• Demonstrate conformity to the market surveillance authority on request (Art. 16.k).
• Meet accessibility requirements under Directives (EU) 2016/2102 and (EU) 2019/882 (Art. 16.l).

Almost no Spanish SME is the provider of a system bought unmodified from a third party. If your company develops AI software it sells to other businesses, or does any of the three things Article 25 describes below, this is your role — with the twelve obligations above.

What must the deployer of a high-risk system do?

The deployer is the company using the system under its own authority — your SME, if you contract an ATS or a scoring engine already built by someone else. Article 26 imposes obligations it cannot delegate to the provider:

• Use the system per the provider's instructions for use and assign human oversight to people with sufficient competence, training and authority (Art. 26.1 and 26.2).
• Ensure the quality of input data under its control and relevant to the system's purpose (Art. 26.4).
• Monitor operation per the instructions and, if a risk arises, inform the provider or distributor and the market surveillance authority without undue delay, suspending use if necessary (Art. 26.5).
• Keep the automatically generated logs for at least six months, unless another rule requires longer (Art. 26.6).
• Inform workers and their representatives before deploying the system at the workplace, where labour law requires it (Art. 26.7).
• Register the use in the EU database under Article 71, if the deployer is a public body (Art. 26.8).
• Cooperate with competent authorities on any action related to the system (Art. 26.12).

Article 27 adds an obligation many SMEs don't know about: public bodies, essential public-service providers and deployers using credit or insurance systems (points 5(b) and 5(c) of Annex III) must carry out a fundamental rights impact assessment (FRIA) before putting the system into service. The risk classification and Annex III guide details when this assessment applies and what it must document.

What obligations does an importer of an AI system have?

The importer (Art. 3.6) is whoever places on the EU market a high-risk system bearing the name or brand of a company established outside the European Union. It's a common role if your SME distributes in Spain a product with AI from a US, UK or Asian manufacturer. Article 23 requires it, before marketing the system, to:

• Verify the provider has done its homework: passed the Article 43 conformity assessment, drawn up the technical documentation per Article 11 and Annex IV, that the system bears the CE marking and comes with the EU declaration of conformity, and that it has appointed an authorised representative (Art. 23.1).
• Not market the system if it suspects non-compliance — or if the system is falsified — until it is remedied; and if the system poses a risk, inform the provider, its representative and the authorities without delay (Art. 23.2).
• Identify itself with its name, registered trademark and contact address on the system, its packaging or its documentation (Art. 23.3).
• Ensure storage and transport conditions that don't jeopardise compliance with Section 2 requirements (Art. 23.4).
• Keep copies of the declaration of conformity and relevant documentation for 10 years after the system is placed on the market (Art. 23.5).
• Provide all information and documentation a competent authority requests, and cooperate with it (Art. 23.6 and 23.7).

And the distributor? (Article 24)

The distributor (Art. 3.7) is any other link in the supply chain — other than provider or importer — that makes an AI system available on the EU market, typically a reseller, systems integrator or sales channel. Article 24 requires it to:

• Verify before distributing that the system bears the CE marking, comes with the EU declaration of conformity and instructions for use, and that the provider and, where applicable, the importer have met their respective obligations (Art. 24.1).
• Not distribute the system if it suspects non-compliance until it is remedied, and inform the provider or importer if it poses a risk (Art. 24.2).
• Ensure adequate storage and transport conditions while the system is under its responsibility (Art. 24.3).
• Take corrective actions — including withdrawal or recall — if it detects non-conformity after distributing the system, and immediately inform the provider or importer and the authorities (Art. 24.4).
• Provide information and documentation to a competent authority on a reasoned request, and cooperate with it (Art. 24.5 and 24.6).

Importers and distributors share a philosophy — both verify before moving the system, both keep watch afterwards — but the importer is always the first link when the provider is outside the EU, with the extra obligation of keeping documentation for 10 years, which the distributor does not have.

When does a deployer, importer or distributor become a provider?

This is the nuance that confuses SMEs the most, and the hardest to fix after the fact: Article 25 ("Responsibilities along the AI value chain") states that a distributor, importer, deployer or other third party is deemed to be a provider of a high-risk system — and becomes subject to all the Article 16 obligations above — in any of these three circumstances (Art. 25.1):

1. Rebranding: you put your name or trademark on a high-risk system already placed on the market or put into service by another provider (Art. 25.1.a). Example: you buy a generic recruitment ATS and launch it as your own product.
2. Substantial modification: you substantially modify a high-risk system already placed on the market, in a way that it remains high-risk (Art. 25.1.b). Example: you retrain a credit-scoring model you bought from a third party with your own data, materially changing its behaviour.
3. Change of intended purpose: you modify the purpose of a system — including a general-purpose AI system (GPAI) — that was not classified as high-risk and already placed on the market, to the point it becomes high-risk (Art. 25.1.c). Example: you take a generic language model and adapt it to automate recruitment decisions.

If any of the three applies to you, the Regulation doesn't leave a middle ground: you become a full provider, with all twelve obligations of Article 16 — conformity assessment, technical documentation, quality management system, registration, CE marking — even though you never "built" the system from scratch. The original provider is released from those specific obligations, but Article 25.2 still requires it to closely cooperate with the new provider and make available the information and technical access reasonably needed. Article 25.4 requires that cooperation to be set out in a written agreement between both parties — unless the component is offered under a free and open-source licence — and allows the AI Office to publish voluntary model contract terms, free of charge.

For SMEs integrating third-party models (GPAI, external providers' APIs) into their own product, this is the single riskiest compliance point in the whole cluster: it's easy to cross the Article 25 line without realising it, especially under scenario (c), change of intended purpose. The GPAI and foundation models guide goes deeper into when integrating a general-purpose model turns you into a "downstream" provider.

Comparison table: obligations by role

How do I know which role I have, step by step?

Before applying any of the obligation blocks above, answer these questions in order:

1. Did you develop the system, or have it developed under your brand? If yes, you're a provider (Art. 16) from the outset.
2. Do you use it as delivered by a third party, unmodified and without your brand on it? You're a deployer (Art. 26-27).
3. Do you bring it into the EU bearing the brand of a company outside the Union? You're an importer (Art. 23), plus a deployer if you also use it.
4. Do you market it in Spain without being the one who developed or imported it? You're a distributor (Art. 24).
5. Have you put your brand on it, substantially modified it, or changed its purpose until it became high-risk? You become a provider (Art. 25), whatever your starting role was.

The AI Act risk classifier walks you through these questions alongside your system's classification, free and with no signup. If you're also unsure whether GDPR, ENS, NIS2 or DORA apply, the "which regulation applies to you?" wizard clarifies it in ten questions.

Prefer to work out your role together and leave with an action plan by article? Book a diagnostic session.

Does the Digital Omnibus change the split of roles?

Not directly. The AI Digital Omnibus (COM(2025) 836, procedure 2025/0359(COD)), adopted by the Council of the EU on 29 June 2026 and signed on 8 July 2026, delays the applicability timeline of Annex III to 2 December 2027 and Annex I to 2 August 2028 — but it does not touch the text of Articles 16, 23, 24, 25, 26 or 27, which define the roles and their obligations without an expiry date of their own. What changes with the delay is when those obligations become enforceable for a given Annex III system, not who has to comply with each block.

As of this guide, the Omnibus remains pending publication in the OJEU, so the date applicable to Annex III high-risk systems is 2 August 2026 (Art. 113), not December 2027. The full timeline — including what's already in force today without exception: prohibited practices since February 2025, GPAI obligations since August 2025, Article 50 transparency unchanged — is in AI Act 2026: the compliance timeline after the Digital Omnibus.