The operator roles under the AI Act, in plain terms
Provider and deployer are the two everyone knows. The Regulation also assigns duties to importers, distributors, product manufacturers and authorised representatives. What each one actually means.
The Act assigns obligations by the role a party plays toward a specific system, not by what kind of company it is. Seven roles appear in the text; for most organisations only two or three are live at any moment, but the others matter when the system crosses a border or changes hands.
The two that carry most of the weight
Provider — develops an AI system or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free. Calling an API does not make you a non-provider: if you built the application layer and it goes to customers under your brand, that application is your system.
Deployer — uses an AI system under its own authority, in a professional context. Staff using a third-party tool for work makes the organisation that tool's deployer.
The others
- Importer — places a system from a third country on the EU market under its own name.
- Distributor — makes a system available on the market without changing it.
- Product manufacturer — integrates an AI system into their own product and supplies it under their own name.
- Authorised representative — a person established in the Union mandated in writing by a third-country provider.
- Affected person is not an operator, but is the reason the obligations exist, and appears in the Art. 27 assessment.
One organisation routinely holds several roles at once across different systems. That is normal. It is also why the useful unit of triage is the system, not the company.
Not legal advice. Confirm each role against the definitions in Chapter III and the current consolidated text.