Am I a "Deployer" Under the EU AI Act? (If You Use AI Tools, Probably Yes)

"Deployer" is one of those regulatory words that sounds like it must mean someone else. It does not. Under the EU AI Act, if your business uses an AI system in its professional activity — ChatGPT, an AI-powered CRM, a hiring tool, a support chatbot — you are almost certainly a deployer, and deployers have obligations. The good news is that for most SMEs those obligations are manageable. This guide explains what a deployer is, what you actually have to do, and how to tell whether you have accidentally taken on the heavier duties of a provider.

What is a deployer under the EU AI Act?

A deployer is any person or business that uses an AI system in the course of its professional activity. If your company operates an AI tool — rather than building and selling one — you are a deployer. This covers the overwhelming majority of SMEs that have adopted AI in any form.

The Act draws its main line between providers (who develop AI systems and put them on the market) and deployers (who use them). Buying a subscription to an AI tool and using it in your work makes you a deployer of that tool. There is no threshold of size or sophistication to cross — a sole trader using an AI writing assistant is a deployer just as much as a 200-person firm running an AI recruitment platform.

Does the AI Act apply to businesses that only use AI tools?

Yes. The Act's obligations follow the use of AI, not only its creation. A business that merely uses AI tools bought from someone else still has deployer obligations — most importantly AI literacy, and for certain uses, transparency and human oversight. Using AI does not exempt you from the rules.

This is the single most common misunderstanding we see. Businesses assume the Act targets the companies building AI models, so a firm that just uses those models feels out of scope. The Act is deliberately structured the other way: because deployers are the ones putting AI in front of real people, they carry duties too. The duties are lighter than a provider's, but they are not zero, and one of them — AI literacy — has already been in force since February 2025.

What are the main deployer obligations for an SME?

Deployers must use AI systems according to instructions, ensure appropriate human oversight, keep relevant logs, and — for certain uses — inform affected people and provide transparency. For most SMEs the two live, immediate duties are AI literacy under Article 4 and transparency under Article 50.

The deployer duties that matter most

• Use per instructions — operate the AI system the way its provider intends, not in ways it was not designed for.
• Human oversight — keep a human meaningfully in the loop, especially for decisions that affect people.
• AI literacy (Article 4) — ensure staff using AI understand it well enough to use it responsibly. In force since February 2025.
• Transparency (Article 50) — tell people when they are dealing with an AI system or AI-generated content. Due August 2026 for deployers.
• Record-keeping — retain logs where the system generates them, so use can be reviewed.

For the full picture of how these fit together, see our EU AI Act Compliance for SMEs guide; for the literacy duty specifically, AI Act Article 4 AI Literacy.

What is the difference between a deployer and a provider?

A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses an AI system in its work. Providers carry the heavy obligations — risk management, documentation, conformity assessment; deployers carry lighter use-and-oversight duties.

The distinction matters because the two roles sit at opposite ends of the compliance burden. If you are a deployer, most of the intensive high-risk machinery is the provider's responsibility, not yours. But the line can blur, and crossing it accidentally is a real risk worth understanding.

Can an SME accidentally become a provider?

Yes. If you put your own brand on an AI system, substantially modify a high-risk system, or use one for a purpose that makes it high-risk, you can take on provider obligations. This is the trap for SMEs that build on top of existing AI rather than simply using it as supplied.

Three situations commonly convert a deployer into a provider: rebranding an AI system as your own product, making substantial modifications to a high-risk system, or repurposing a system in a way that changes its risk profile. If your business does more than use an AI tool as delivered — if you are customising, white-labelling or embedding it into something you sell — it is worth checking your role carefully, because the provider obligations are far heavier. When in doubt, our free EU AI Act self-assessment establishes your role in a few minutes.

What should a deployer do first?

Start by confirming you are a deployer and listing the AI systems you use, then address the two live obligations: put AI literacy measures in place under Article 4, and add transparency disclosures where Article 50 applies. Keep records of both, because evidence is what compliance ultimately rests on.

The practical starting sequence for a deployer is short: confirm your role, build a simple register of the AI you use, deliver proportionate AI literacy training, and add the transparency disclosures your uses require. None of it needs a lawyer, and most of it can be done in-house. What it does need is to actually happen and be documented — which, for the businesses that would rather not manage it themselves, is exactly what our Compliance Guard service maintains on an ongoing basis.

A quick deployer checklist for SMEs

Run through five questions: do you use AI in your work, do you use it as supplied or modify it, does any use affect people's rights, have you trained staff on it, and do you disclose AI where required. Your answers map directly to your deployer duties and show where any gaps are.

If you want to sense-check your position without a formal assessment, work through these:

• Do you use any AI tool in your business? If yes, you are a deployer — start here rather than assuming exemption.
• Do you use it as supplied, or do you customise, rebrand or embed it? Modification can push you toward provider duties.
• Does any AI use affect people's rights or opportunities — hiring, credit, access to services? If so, human oversight matters most there.
• Have you given staff any training on responsible AI use? If not, that is your Article 4 gap, and it is live now.
• Do you disclose AI where you should — chatbots, public AI-generated content? If not, that is your Article 50 gap for August 2026.

Two or more "no" answers among the last three point to live obligations you have not yet met. That is not cause for alarm — it is simply the to-do list, and it is short. The free EU AI Act self-assessment turns these questions into a documented result you can act on.

Frequently asked questions

Does the AI Act apply to AI users, or only AI developers?

It applies to both. AI developers are providers with heavy obligations; AI users are deployers with lighter but real duties, chiefly AI literacy and, for some uses, transparency and human oversight. Using AI does not put you outside the Act.

Am I a deployer if I only use ChatGPT for work?

Yes. Using ChatGPT in your professional activity makes you a deployer of that system. Your main live obligation is AI literacy under Article 4, plus sensible data-handling rules, and transparency where you publish AI-generated content to the public.

What is the AI Act deployer definition in simple terms?

A deployer is any business or person that uses an AI system in their work, as opposed to building and selling one. If you operate an AI tool rather than develop it, you are a deployer regardless of your size.

How are deployer obligations different from provider obligations?

Deployers must use systems per instructions, ensure human oversight, keep logs and meet literacy and transparency duties. Providers additionally must build risk management systems, produce technical documentation and pass conformity assessments for high-risk systems — a much heavier burden.