Under Regulation (EU) 2024/1689, a natural or legal person that develops an AI system or general-purpose AI model, or has one developed, and places it on the Union market or puts it into service under its own name or trademark.
In practiceThe provider carries the heaviest set of obligations in the Act, including risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight design, accuracy, robustness, cybersecurity, conformity assessment, registration in the EU database, and post-market monitoring. A deployer that substantially modifies a high-risk system, or rebrands it, can itself become a provider and inherit those duties. The boundary between provider and deployer is therefore a critical governance question in any procurement.
A software firm that builds a medical-triage model and licenses it to hospitals under its own brand is the provider, even if the hospital fine-tunes the system on its own patient cohort, provided the fine-tuning stays within the documented intended purpose.
This definition is maintained by Moweb partners and used in live client engagements. For how Provider applies to your estate, or to challenge a working definition, speak to a partner.