EU AI Act Deployer vs Provider: Which One Are You?

TL;DR

If you buy or use an AI system at work, you are probably a deployer, not a provider. Article 4 asks deployers and providers for role-tailored AI literacy. Get AI Safety Certified is literacy training for that deployer, not an official EU certificate.

A deployer uses AI under its authority. A provider places a system on the market.

Key Takeaways

• Safety = protect people from the model (accidental harm: bias, hallucinations, leaking PII, over-reliance) — guardrails. Security = protect the model from attackers (adversarial: prompt injection, breaches, exfiltration). Intent is the key distinction.
• A deployer uses an AI system under its authority. A provider develops or places a system on the market.
• High-risk duties expand in August 2026. Literacy is the part you can start in Module 0 this week.

Do I need EU AI Act training as a deployer?

If your company uses ChatGPT, Copilot, a vendor model inside a product, or an internal RAG bot, you are acting as a deployer. Most product, legal, HR, and operations teams never train a foundation model. They still deploy one.

That is why “EU AI Act certification” searches dump people into security catalogs. They needed a deployer briefing: who is on the hook, what literacy means, and which logs and human reviews a deployer should already be able to describe.

Deployer vs provider in 30 seconds

Provider: you build the system or put it on the market under your name. Deployer: you use the system in your organization. A law firm that uses a contract-review tool is a deployer. The vendor that sells that tool is a provider. A bank that wraps a third-party model in a customer chatbot is still a deployer of that model.

Get the noun right before you buy training. A deployer who studies only model-theft still cannot answer “who reviews the output?”

What a deployer actually owes

A deployer needs staff who understand the system’s limits, a human who can override high-impact outputs, transparency when people interact with AI, and records that show what happened. Article 4 literacy is the floor.

Module 0 through Module 5 is built as that literacy path for builders. It is curriculum alignment, not a government stamp. High-risk product obligations in August 2026 still belong with counsel. Start with the 12-point checklist on the EU AI Act page.

Enter the free classroom

Watch Module 0 — Why AI Safety Is Not Security — with no login. Write and quiz stay in your classroom. Unlock M1–M5 for $199. If you are a deployer, also read the EU AI Act deployer page.