Provider or deployer — which one are you?
This single question decides every obligation that follows. Most companies answer it wrong, and a surprising number become providers without noticing.
Last reviewed:
Sound familiar?
- You bought an AI system, so you assume you are only the deployer — and stop reading there.
- You put your own name or brand on a purchased system, which can move you into the provider role.
- You substantially modified a system or repurposed it for something the original vendor never intended.
- Legal, procurement and engineering each hold a different answer, and none of them is written down.
What we do
Role assessment per system
We go through each AI system you use or sell and determine the role you actually hold — provider, deployer, importer, distributor, or several at once.
The trigger points
Own branding, substantial modification, change of intended purpose: we check the specific facts that flip a deployer into a provider.
Obligation map
For every role we list what it means in practice: documentation, oversight, incident reporting, information duties towards downstream users.
Written classification
A short, defensible memo per system with the reasoning behind it — the document you show when someone asks why you classified yourself this way.
Questions we get
We only use ChatGPT internally. Are we a provider?
Using a third-party system as an employee-facing tool normally makes you a deployer, not a provider. It changes if you build a product on top of it, sell it under your own name, or modify it substantially for a purpose the vendor did not intend.
What counts as a substantial modification?
Fine-tuning on your own data, changing the intended purpose, or altering how outputs are used in a decision can all count. The line is fact-specific, which is exactly why the assessment gets written down rather than assumed.
Can we be provider and deployer at the same time?
Yes, and that is common. You can be the provider of the system you sell and the deployer of three tools you bought. The obligations are tracked per system, not per company.
Tell us what's running in production.
We'll tell you what we'd check first — and what we wouldn't bother with.
Book a call