Who the AI Act applies to. You don't pick your role. What you do picks it for you.

Most people stop at the line between building and using, and for most businesses that's enough. But one article moves a company from the second box to the first without anyone deciding it, and it's the most overlooked article in the regulation.

This piece belongs to the guide on AI Act obligations for businesses and SMEs and looks more closely at who the regulation covers. It's written for people running a business, and it stops where a lawyer's work begins.

The seven categories in Article 2

Article 2(1) lists who the regulation applies to, and the list is wider than most people think. It covers providers placing AI systems on the market or putting them into service in the Union, whether established here or in a third country, and deployers that have their place of establishment or are located in the Union.

It goes on to providers and deployers in third countries when the output reaches the Union, importers and distributors, product manufacturers placing an AI system on the market together with their product and under their own name, authorised representatives of providers not established in the Union, and affected persons located in the Union.

That last entry is a surprise, and it matters. The people a system is used on have no obligations, but they have standing: the regulation names them because they are the people its rules protect, and complaints start with them.

The test that takes the regulation outside Europe

Point (c) of paragraph 1 is what gives the AI Act global reach. It covers providers and deployers established in a third country, where the output produced by the system is used in the Union.

The test is where the result goes, not where the infrastructure sits. An American provider serving European customers is covered, and so is a non-European company using a system whose output ends up here. For an Italian SME the practical upshot is reassuring: the tools you buy are subject to the regulation even when the seller is on another continent, and you can ask for that in the contract.

The main guide explains the same principle as it applies to the transparency obligations in Article 50. The point here is broader, and holds for the whole regulation.

Six roles, not two

Article 3 defines the figures, and the regulation groups them under the term operator. Knowing them matters because obligations aren't handed out at random: they follow the role, and the role follows from the facts.

What it does	The regulation's definition	When it's yours
ProviderArticle 3, point 3	Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.	If you build a tool, or have one built, and release it under your own name. Even for free.
DeployerArticle 3, point 4	Uses an AI system under its own authority, except in the course of a personal, non-professional activity.	Almost every SME. You buy third-party tools and use them in the business.
ImporterArticle 3, point 6	Is established in the Union and places on the market a system bearing the name or trademark of a company established in a third country.	If you resell a non-European maker's tool in Europe under its original brand.
DistributorArticle 3, point 7	Sits in the supply chain, is neither the provider nor the importer, and makes a system available on the Union market.	If you resell or integrate other companies' tools for your customers.
Authorised representativeArticle 3, point 5	Is established in the Union and has received and accepted a written mandate from a provider to carry out obligations on its behalf.	Only with a written mandate. Nobody ends up in this role by accident.
Product manufacturerArticle 2, point (e)	Places a product on the market together with an AI system, under its own name or trademark.	If you make machines or devices with an intelligent component built in.

In practice, the two main roles differ in how many obligations they carry. The provider answers for Article 16 and the whole conformity framework; the deployer of high-risk systems answers for Article 26, which is much lighter. Below high-risk, the deployer's obligations are mostly about informing people.

The role still matters when it comes to consequences. Article 99(4) puts the provider obligations in Article 16 and the deployer obligations in Article 26 in the same band, up to €15 million or 3% of total worldwide annual turnover. The role changes how many obligations you have, not what getting them wrong costs, and for SMEs the lower of the two figures applies.

When a user becomes a provider

This is Article 25, and it changes a company's position without anyone signing anything. A distributor, importer, deployer or other third party is treated as the provider of a high-risk system, with every obligation in Article 16, in three situations.

“They put their name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated.”
Regulation (EU) 2024/1689, Article 25(1)(a)

The second is a substantial modification to a high-risk system already in circulation. The third is the one to watch: changing the intended purpose of a system not classified as high-risk, including a general-purpose system, so that it becomes high-risk under Article 6.

Here's what that looks like in real life. A company takes a general-purpose generative model and uses it to screen job applications. That use falls under point 4 of Annex III, so the company has changed the purpose and taken the system into high-risk, and Article 25 puts it in the provider's shoes. The full picture of how systems are classified is on the page about the AI Act risk levels.

Paragraph 2 closes the loop: when this happens, the original provider is no longer treated as the provider of that system, and must cooperate by making available the information and technical access that can reasonably be expected. Point (a) preserves contractual arrangements, which makes the contract with your supplier worth reading before you rebrand anything.

Who the regulation doesn't apply to

The exclusions sit in the same Article 2, and they are narrower than they're usually made out to be. The regulation does not apply to systems placed on the market, put into service or used exclusively for military, defence or national security purposes, regardless of who carries out the activity.

It doesn't apply to systems developed and put into service solely for scientific research and development, or to research, testing and development before a system is placed on the market. There's a firm limit on that last one: testing in real-world conditions isn't covered by the exclusion.

The exclusion most often invoked wrongly is paragraph 10, on the obligations of deployers who are natural persons using AI systems in the course of a purely personal, non-professional activity. It's about private use at home. A business owner using a generative model for company work doesn't qualify, even on their own laptop.

Areas outside the scope of EU law are also left out, and the regulation is without prejudice to the rules on the liability of intermediary service providers, on consumer protection and product safety, or to the GDPR, as the page on the AI Act and the GDPR explains.

The line that leaves Member States room on workers

Article 2(11) says something that has already had effects in Italy. The regulation doesn't prevent the Union or Member States from keeping or introducing rules more favourable to workers on employers' use of AI systems, or from encouraging more favourable collective agreements.

That's the door Article 11 of Law 132/2025 comes through: it requires employers and contracting businesses to inform workers when artificial intelligence is being used, in the cases and in the ways set out in Legislative Decree 152 of 1997.

For an Italian business, this means the European regulation alone won't tell you what you owe your own employees. On that front the law to read is Italian, and it sets an obligation the AI Act doesn't contain.

How to work out your role in ten minutes

Your role follows from the facts, so the quickest way is to answer three questions for every system you use. Ask them system by system, because the same company can be the deployer of one tool and the provider of another.

One: whose name is on it. If the tool arrives and is used under the brand of the company that built it, you're a deployer. If you put your own name on it in front of customers, read Article 25 before going any further.

Two: what you have it do. Its real use, not the one in the catalogue. If you've taken a general-purpose tool into one of the Annex III cases, your role changed with the use.

Three: who comes after you. If you resell, integrate or make the tool available to others, you're a distributor as well, and the obligations add up rather than replacing each other.

The human checkpoint, and what we sign before we build

When a system is built to measure, the question of who the provider is has to be settled before the first line of code, not after. Point (a) of Article 25 expressly preserves contractual arrangements that allocate the obligations differently, and that clause either goes into the contract or doesn't exist.

In the systems we build, the operating rule is written down together with the scope: any message that commits the business, such as offers, quotes, prices and confirmations, goes out only after a person has read and approved it. Replies drawing on information the owner has already approved can go out on their own, the owner switches that on and off channel by channel, and the reply says it comes from a system, as Article 50 requires from 2 August 2026.

The full scope, including what we never do, is in our AI principles, and the list of systems we actually use is on the AI transparency page.

Questions and answers

This article is a practical overview, not legal advice. On what your role is in a specific case, which has contractual consequences, the answer has to come from a professional who looks at your business.