← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Article 3: provider vs. deployer, and why it changes your duties

Article 3 is the definitions article, and two definitions decide which obligations apply to you: provider (Article 3(3)) and deployer (Article 3(4)).

The two definitions

A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. A deployer uses an AI system under its own authority, except where the system is used in the course of a personal, non-professional activity.

Why the label matters

Providers carry the heavier load: risk management (Article 9), data governance (Article 10), technical documentation (Article 11), conformity assessment, and post-market monitoring (Article 72). Deployers carry a shorter but still real list under Article 26: use per instructions, human oversight, monitoring, incident reporting, and log retention — see our deployer obligations guide.

The trap: substantial modification

Article 25 says a deployer that puts its name or trademark on a high-risk system, makes a substantial modification, or changes its intended purpose so that a previously non-high-risk system becomes high-risk, is reclassified as a provider and inherits provider duties. Many teams that fine-tune, wrap, or re-purpose a third-party model sit closer to "provider" than they assume.

What evidence this implies

Whichever role you hold, you need to show what you actually did to the system: configuration, prompts, fine-tuning, guardrails, and how the deployed behaviour maps back to what the upstream provider documented.

Gaps to state honestly

The dividing line between "using" a system and "substantially modifying" it is a judgment call the Act does not fully resolve with bright lines. See our high-risk classification guide for the related question of whether the system is high-risk at all.

How Vetro helps

Whether you are the provider or the deployer of record, Vetro's hash-chained, signed ledger records exactly what changed and when — prompts, policies, fine-tuning events, tool calls — so the "what did you actually build" question has an answer. Vetro Attest verifies it for free or, for 29 USD, issues a counter-signed report against the Act. Not legal advice.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.