Provider vs Deployer vs GPAI Provider under the EU AI Act

Why role analysis comes first

Risk category answers what obligations might apply. Role answers who must do the work. Mixing them up produces wrong checklists (and wrong counsel questions).

Quick definitions (operational)

Many SaaS companies are providers of a system that uses a third-party GPAI model. That is not “OpenAI is the only provider.”

Common SaaS patterns

1. Wrapper chatbot on GPT

• You likely provide a customer-facing AI system
• Model vendor may be a GPAI provider
• You still own product disclosure, intended purpose, and customer contracts

2. HR ranking SaaS

• Potentially Annex III.4 system → your provider duties may be heavy if confirmed high-risk
• GPAI model vendor ≠ substitute for your Annex III evidence pack
• Deadline for standalone high-risk system duties: 2 December 2027

3. Customer uses your AI inside their HR process

• You may be provider; customer may be deployer
• Contracts should allocate oversight and acceptable use

What to ask counsel

1. For each AI feature, who is provider vs deployer?
2. Does integrating GPAI change our obligations?
3. Do we need an authorised representative as a non-EU provider?
4. Which Art. 50 duties apply from 2 August 2026 regardless of Annex III?

Next step

Map roles in one page, then run a free readiness brief. Related: AI deployer obligations.

Not legal advice. Role labels are fact-specific.