Provider vs. Deployer Under the EU AI Act: Which One Are You?

Under the EU AI Act, "provider" and "deployer" aren't interchangeable words for "company using AI" — they're two legally distinct roles that Article 50 hands completely different duties. Get your role wrong, and you'll either miss an obligation that applies to you, or waste effort satisfying one that doesn't.

You develop an AI system, or have one developed for you, and place it on the market or put it into service under your own name or trademark — whether for payment or free. Providers are the companies building the AI system itself: the foundation model labs, the image-generation platforms, the API vendors.

A provider's Article 50(2) duty: mark the synthetic content your system generates in a machine-readable format detectable as artificially generated, where technically feasible. This is a systemic obligation on your product, not a per-file judgment call — it applies to your outputs generally, not because any one output was flagged by a detector.

You use an AI system under your own authority in a professional context — you didn't build it, you're putting it to work. This is the far more common position: agencies, publishers, marketers, in-house teams, and businesses generating or editing images with an existing AI tool (Midjourney, DALL·E, Stable Diffusion, a platform's built-in AI features) are almost always deployers, not providers.

A deployer's Article 50(4) duty is different in kind: if the content you're publishing meets the Article 3(60) deepfake definition (see our deepfake disclosure guide), you must disclose that to the people who see it — clearly, perceivably, at first exposure. This is a per-content judgment, not a systemic one: you're assessing the specific image or piece of content you're about to publish.

Yes — if you build your own generative AI tool and use it yourself to publish content, you carry both sets of duties simultaneously: mark your system's outputs as a provider, and separately assess and disclose specific deepfake content as a deployer. The two obligations don't merge or substitute for each other just because you're the same legal entity wearing both hats.

Ask: "Did my organization build the AI model or system that produced this content, or did we use someone else's tool?" Built it → you likely have provider duties for that system's outputs generally. Used someone else's tool → you're a deployer, and your duty is assessed content-by-content under Article 50(4).

Still not sure, or need to check a specific image against your actual role? Run it through signator.ai — the tool asks for your role directly and applies the matching branch of the decision tree, rather than assuming one.