Regulation (EU) 2024/1689

Map the AI Act role before the risk class

Provider, deployer, importer, distributor, product manufacturer, and GPAI provider duties begin with role.

Written and reviewed by Fredrik Surtell ·

Why can one company hold more than one AI Act role?

Roles attach to conduct around a particular system or model. An organisation can deploy a vendor system, become a provider after substantial modification or branding, and import another system in a separate flow.

Operating sequence

  1. 01

    Inventory each system, model, intended purpose, geography, brand, contractual chain, and modification.

  2. 02

    Assign roles per use and record the facts that support each conclusion.

  3. 03

    Reassess role when purpose, branding, model, integration, or value-chain position changes.

Failure modes to avoid

  • Using “customer” and “vendor” as legal role labels.
  • Assuming open-source availability eliminates every obligation.
  • Classifying risk before identifying whose intended purpose controls.

The source remains the authority.

Regulation (EU) 2024/1689, definitions and value-chain duties — EUR-Lex