Overview: the actors in the AI Act
The AI Act provides for many roles in the AI value chain. The various players are by no means unknown, and the EU legislator orientated itself in many respects on EU product law standards (see, for example, the Product Safety Regulation and the Medical Devices Regulation).
The actors in the AI Act include, in accordance with Art. 3 (8):
- Provider;
- Product manufacturer;
- Authorised representative;
- Importer;
- Distributor;
- Deployer.
There are also "users" and "affected persons", but these are not referred to as actors within the meaning of the AI Act.
Placing on the market, making available, commissioning
The various players take on different activities in the AI value chain. A distinction is made between "placing on the market", "making available on the market" and "putting into service", which are also legally defined in the AI Act. These terms are not new, as they already exist in EU product law.
According to Art. 3(9) of the AIA, "placing on the market" means "the first making available of an AI system or a GPAI modelon the Union market."
According to the definition, placing on the market also includes "making available on the market", which in turn means "the supply of an AI system or a GPAI model for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge (Art. 3 (10) AIA).
The difference between "placing on the market" and "making available" lies in the fact that placing on the market means making available on the market for the first time. Within the EU, the placing on the market is usually carried out by the manufacturer of the product or, in the case of the AI system/GPAI model the provider; for products or AI systems outside the EU, it is the importer. Once the initial provision has taken place, the further making available (colloquially referred to as "distribution") is usually carried out by the distributor, who takes over typical activities such as sales, storage, transport (e.g. in the case of high-risk AI systems integrated into physical products), customer support or maintenance.
This form of supply chain primarily represents the traditional way of a supply chain, where the product finds its way from the manufacturer via the importer and (intermediate) distributor to the final customer. Distance selling has also led to the development of new forms of distribution. Providers and distributors from third countries can offer their products on the Union market via online interfaces, which also allows providers in particular to exclude certain players (e.g. distributors). This form of sales plays a particularly important role for digital products such as software applications, which can be purchased via a simple download.
The Union legislator has also reacted to the changes in sales channels in the Market Surveillance Regulation (Recital 15): If a product is offered online or through other means of distance sales, the product should be considered to have been made available on the market if the offer for sale is targeted at end-users in the Union. Whether such an offer for sale is made to end-users is a case-by-case analysis and shall take into account criteria such as the geographical areas to which dispatch is possible, the languages available, used for the offer or order and the means of payment. The mere accessibility of the operator's or the intermediaries' website is not in itself sufficient to presume the making available on the Union market.
According to Article 3(11) of the AIA, "putting into service" means "the supply of an AI system for first use directly to the deployer or for own use in the Union for its intended purpose". In short, "intended purpose" means the use for which an AI system is intended or promoted according to the provider (see Art. 3(12) AIA).
The individual players
Depending on which actor and which AI system or GPAI models is involved, different far-reaching obligations must be complied with. It is therefore of fundamental importance to differentiate between the individual addressees of the obligation. In certain situations, an actor can also fulfil several roles simultaneously. The following explanations and diagram are intended to provide an overview.
Who is the provider?
In Art. 3 (3) AIA, a provider is defined as follows:
a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge
The provider is the link in the AI value chain that develops the AI system or GPAI model. Typically, these are persons and institutions involved in the individual development phases - data preparation, model training, evaluation and optimisation - of AI systems or GPAI models.
Since the development of an AI system or GPAI model usually involves several professional disciplines, several specialists such as data scientists, engineers, domain experts and designers often work together. A provider is therefore also considered to be a provider if it has the AI system or a GPAI model developed (in other words, "commissions" it) in order to subsequently place it on the market or put it into service under its own name or trademark, whether for a payment or free of charge. Providers may also outsource certain tools, services, components or processes, such as training, retraining, testing and evaluation of models, integration into software or other aspects of model development. However, the obligations in connection with the AI Act apply more broadly to providers.
Note: In order to ensure that the AI Act is also applied in these situations, the obligations must be contractually regulated. In this regard, the AI Office is authorised to draw up and make available model contractual provisions (Art. 25 para. 4 AI Act).
A provider is also referred to when it integrates an AI model into its AI system or GPAI system. It is irrelevant whether the model is provided and vertically integrated by the provider itself or comes from someone else. In this case, the term "downstream provider" is used (see Art. 3 para. 68 AIA)
The rule in Art. 25 para. 1 AIA also treats importers, distributor, operators and other third parties as suppliers if they:
- label a high-risk AI system that has already been placed on the market or put into service with their name or trademark, irrespective of contractual agreements that provide for a different allocation of obligations. The respective actor thus acts as the provider of an AI system even though it was not developed by them ("quasi-manufacturer");
- make a substantial modification to a high-risk AI system that has already been placed on the market or put into service in such a way that it remains a high-risk AI system within the meaning of Art. 6 AIA;
- modification of the intended purpose of an AI System, including a GPAI System that has not been classified as high-risk and has already been placed on the market or put into service, in such a way that the AI System concerned becomes a high-risk AI System within the meaning of Art. 6 AIA.
Who is the product manufacturer?
Although product manufacturers are listed as actors, there is no corresponding definition in the AI Act. As Annex I of the AI Act refers to EU product law standards, the term product manufacturer in the AI Act refers to the manufacturer of the respective product.
For example, a manufacturer within the meaning of the Lifts Directive is "any natural or legal person who manufactures a safety component for lifts or has such a component designed or manufactured, and markets it under his own name or trade mark" (Article 2(8) of the Lifts Directive).
If an AI system is built into a product as a safety component, the product manufacturer must fulfil the obligations of a provider of an AI system set out in the AI Act. In these cases, the product manufacturer is treated as a provider.
Who is the authorised representative?
Pursuant to Art 3(5) AIA, an authorised representative is defined as follows:
a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation.
An authorised representative is necessary if the provider of the AI system or the GPAI model is not established within the Union. In order to ensure compliance with the requirements of Union law for AI systems or GPAI models, the appointment of an authorised representative is mandatory. The authorised representative ensures compliance with the obligations set out in the AI Act on behalf of the providers of the AI system or GPAI model and also conducts proceedings. This obligation does not apply to providers of exempt open source models and systems within the meaning of Art. 2 para. 12 AIA.
Who is the importer?
According to Art. 3(6) AIA, an importer is defined as follows:
a natural or legal person located or established in the Union that places on the market an AI-system that bears the name or trademark of a natural or legal person established in a third country.
The importer is the link in the AI value chain that places on the market an AI system from a provider outside the EU. The importer therefore only plays a role for AI systems from third countries. In certain situations, the role of the importer may coincide with that of the distributor, namely when the importer purchases the AI system from the provider and makes it available at the same time.
Under certain circumstances, the importer may also be treated as a provider (see Art. 25 para. 1 AIA).
Who is a distributor?
A distributor is legally defined as follows pursuant to Art. 3(7) AIA:
a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.
The distributor is the person in the AI value chain who makes available an AI system on the Union market. The mere making available comes after the placing on the market in terms of time.
Under certain circumstances, the distributor may also be treated as a provider (see Art. 25 para. 1 AIA).
Who is the deployer?
According to Art. 3(4) AIA, a deployer is defined as follows:
a natural or legal person, public authority, agency or other body using an AI system under its authority, except the AI system is used in the course of a personal non-professional activity.
The deployer is the link in the AI value chain that uses an AI system under its own responsibility. The institutions, bodies, authorities and agencies of the Union are mentioned as examples (recital 23). In the AI value chain, they are downstream of the providers; they implement the AI system in practice. The deployer is the person, authority, etc. that decides whether and how an AI system is used and is also responsible for this. The purely private use of AI systems is excluded from the definition of deployer.
Under certain circumstances, the deployer may also be treated as a provider (see Art. 25 para. 1 AIA).
Who is a user?
The term "user" appears in the AI Act, but is not legally defined. The term user is mentioned in various places in the AI Act, e.g. in Annex XIII as "end-users" and "business users" or in various recitals (see recital 16: "to allow users"; recital 102: "software and data, including models [...] that users can freely access, use, modify and redistribute them", "if it allows users"). In the version approved by Parliament , this term was partially equated with the operator.
"Affected" persons
Depending on the type of AI system, the use may affect persons other than the operator (recital 13 AIA). This refers to those persons who are the subject to the use of the AI system or who are otherwise affected by the use of an AI system.
Examples of this can also be found in the AI Act, such as the use of a chatbot or generating synthetic audio, image, video or text content such as deepfakes (see Art. 50 para. 1 and 2 AIA), the use of an emotion recognition system or a system for biometric categorisation (see Art. 50 para. 3 AIA), the use of a real-time biometric remote identification system (Art. 5 para. 2 AIA) or the commissioning or use of a high-risk AI system in the workplace (Art. 26 para. 7 AIA).