Step 2
What you are for each system, and whether it applies to you
By the end of this step, each row of the inventory will say whether the Regulation covers that use and in what capacity —provider or deployer—, with the reason written down.
What this step is
The Regulation allocates obligations according to the role you play for each system, not according to the type of company. The question “are we a provider or a deployer?” is badly framed: the role goes system by system, and within the same inventory you can be the deployer of twelve tools and the provider of one.
This step adds two columns to the inventory. The first answers whether the Regulation applies to that use. The second, in what capacity: provider, deployer or both. Under each answer goes one line with the reason, so that whoever reads it a year from now understands why it was decided that way.
Most SMEs are deployers of almost everything they use. The work in this step lies in finding the exceptions: the tool you developed and offer to customers under your brand, the third-party model you built into a product of your own, the system whose purpose you changed.
Why
Article 3 defines the two figures. A provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge; putting into service includes own use. A deployer is whoever uses an AI system under its authority, except where it is used in the course of a personal non-professional activity. Each figure has its own obligations, which is why the role is the first thing to settle.
Scope is set by Article 2. It applies, among others, to providers placing AI systems on the market or putting them into service in the Union, wherever they are established, and to deployers that are established or located within the Union. It leaves out, among other cases, uses exclusively for military, defence or national security purposes; systems developed and put into service for the sole purpose of scientific research and development; research and testing activities prior to placing on the market, except testing in real-world conditions; and use by natural persons in a purely personal activity. For a company that uses AI in its business, the normal outcome is that the Regulation applies.
The role can change, and Article 25(1) says when. A deployer comes to be considered the provider of a high-risk system if it puts its name or trademark on a high-risk system previously placed on the market or put into service; if it substantially modifies one in such a way that it remains high-risk; or if it changes the intended purpose of a system that was not high-risk in such a way that it becomes high-risk. All three scenarios concern high risk: putting your brand on a minimal-risk system does not make you a provider through Article 25, although provider status is still assessed against the general definition in Article 3(3).
How, in three actions
First, whether the Regulation applies
For each row, check that the use is professional and that your organisation is established in the Union or, if it is outside, that the system’s output is used in the Union. If an Article 2 exclusion seems to fit, do not simply take it as given: write down which one and why, and flag it for expert review. In an SME that uses AI in its business, that column will say “applies” on nearly every row.
Then, your role in that system
Ask who developed the system and under what name or trademark it is offered. If you use it under your authority and someone else developed it and markets it under their brand, you are the deployer. If you developed it, or had it developed, and place it on the market or put it into service under your brand —including for your own use—, you are the provider. If you do both with the same system, mark both.
Finally, Article 25 and the reason in writing
If a system may be high-risk, check whether you have put your brand on it, substantially modified it or given it a purpose other than the one its provider intended. Write down the role, one line of reasoning —“we use it under our authority; the provider develops and markets it under its own brand”— and the date. If the role changes later, the row is updated and the previous version is kept.
The typical mistake
Deciding the role once for the whole company.
It is convenient to write “deployer” at the top and forget about it, and it is usually true for almost everything. The problem is the row where it is not: the assistant your team built on a third-party model and offers to customers under your brand, or the internal tool that ended up becoming a product. That row carries different obligations, and it is exactly the one a single role hides. You avoid it by deciding row by row, with the reason written down.
Estimated time
One working day, between days 8 and 12 of the Route, overlapping with the close of the inventory’s first version.
What you take away
The inventory’s role column, system by system: whether the Regulation applies, in what capacity, one line of reasoning and the date of the decision.
How it works in Alethexis
In Alethexis, each system in the inventory carries its role —deployer, provider or both— and the table can be filtered by it; the classification assistant asks again in its first step, “Your organisation’s role in this system”.
If a system has no role of its own, it inherits the one the organisation stated in its settings, and if none is stated there either, it is not presumed: if the system triggers Article 50, it stays at the transparency level (P3) and the section goes into review until someone decides.