AI Deployer Obligations under the EU AI Act: A SaaS Guide

Who this page is for

You already know you use an AI system in a professional context — an LLM API inside support, a third-party ranking engine, or a model embedded in your workflow. This guide covers deployer obligations, not a full comparison of every AI Act role.

For role mapping across provider / deployer / GPAI provider, use the pillar article: Provider vs deployer vs GPAI provider.

Deployer in one sentence

A deployer uses an AI system under its own authority in the course of a professional activity. You do not need to have trained the model to be a deployer.

Core deployer duties (especially if high-risk)

When the system is high-risk, deployers typically face duties under Article 26, including:

1. Use as intended — follow the provider’s instructions for use
2. Human oversight — assign competent people who can understand and override outputs where required
3. Input data — ensure data under your control is relevant and sufficiently representative for the intended purpose
4. Monitoring & logs — monitor operation and keep automatically generated logs for the required period
5. Incident reporting — inform the provider / authorities of serious incidents as required
6. Worker / affected-person information — inform natural persons where the Act requires it

Standalone Annex III high-risk duties apply from 2 December 2027 (Digital Omnibus). Art. 50 transparency can still apply earlier (2 August 2026) when people interact with AI.

The SaaS trap: deployer of the model, provider of the product

Calling OpenAI does not automatically make you “only a deployer” of everything users see.

Treat deployer checklists as necessary but not sufficient until counsel confirms you are not also a provider of the system you ship.

Deployer readiness checklist

• [ ] Named owner for each AI feature in production use
• [ ] Instructions for use from the provider (or your own if you are also provider)
• [ ] Human oversight SOP for decisions that affect people
• [ ] Logging retention plan (legal if high-risk; recommended otherwise)
• [ ] Incident contact path to model/vendor and internal on-call
• [ ] Disclosure if users interact with AI (Art. 50)
• [ ] Written list of open questions for counsel

Templates: Human oversight SOP · AI system card

What to do this week

1. Inventory AI features you use vs AI features you place on the market.
2. Draft the oversight SOP for any path that ranks, scores, or decides about people.
3. Get a free readiness brief for your product — then send deployer vs provider open questions to counsel.

Related

• Provider vs deployer vs GPAI provider
• AI Act compliance for OpenAI-powered SaaS
• Prepare for legal review

Not legal advice. Deployer duties are fact- and classification-specific.