Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
Are we an AI provider or a deployer under the EU AI Act?
Updated
Articles 3, 16, 25 and 26 of Regulation (EU) 2024/1689 split operator roles: provider, deployer, importer, distributor, and product manufacturer. Article 25 can treat a deployer as a provider after a substantial modification. Not legal advice. This page does not determine that YOU are any of those roles.
Provider versus deployer, last verified 9 September 2026 against Articles 3(3)–(8), 3(11), 3(23), 3(63), 3(66), 3(68), 16, 23–26, 53 and 113 of Regulation (EU) 2024/1689 (OJ L 2024/1689, 12.7.2024). Commission AI Act pages, the AI Act Service Desk, and AI Office GPAI-scope guidelines are Commission / AI Office materials — guidance, not the regulation. Regulation (EU) 2026/1744 is an amending regulation; it does not rewrite Article 113(b) for Chapter V. This page is not legal advice, not a filing, not a classification that YOU are a provider, deployer, importer, distributor, or product manufacturer, and does not start a clock.
This is Articles 3, 16, 25 and 26, not YOUR classification
Audience: a company that both builds and uses AI, walking Regulation (EU) 2024/1689 on operator roles. This page is not legal advice. It does not start a clock. Reading it does not start a clock. Mapping a row is not a determination that the Act applies, or that YOU are a provider, a deployer, an importer, a distributor, or a product manufacturer. This page does not file with the AI Office.
The AI Act is Regulation (EU) 2024/1689 of 13 June 2024, OJ L 2024/1689, 12.7.2024. ELI: http://data.europa.eu/eli/reg/2024/1689/oj. Article 3 defines the roles. Article 16 is high-risk provider obligations. Article 26 is high-risk deployer obligations. Article 25 is responsibilities along the AI value chain, including the substantial-modification rule. The EU AI Act overview on this site is the pillar page. The requirements-in-force-2026 guide on this site is the Article 113 dates page. Last verified 9 September 2026. Not legal advice.
- Statute versus guidance: Articles 3(3)–(8), 3(11), 3(23), 3(63), 3(66), 3(68), 16, 23–26, 53 and 113 of 2024/1689 are legal requirements only if they apply. Commission AI Act pages, the AI Act Service Desk, and AI Office GPAI-scope guidelines are Commission / AI Office materials — guidance, not the regulation. This page quotes which kind of text it is relying on.
- The GPAI-requirements guide on this site is the Article 53 baseline page. The GPAI-systemic-risk guide on this site is the Article 51–55 page. The AI-governance-requirements guide on this site is the Articles 4, 14, 26 and ISO 42001 page. The AI-risk-management-requirements guide on this site is the Articles 9 and 55 page. A dedicated AI-ownership-accountability and how-shipreadymetrics-supports-ai-governance guide is not on this site yet. Naming them is not a link.
- This page does not invent a 2 August 2026 start date for GPAI. Article 113(b) of 2024/1689 applies Chapter V from 2 August 2025, with the exception of Article 101. Article 113(c) Annex I product-embedded high-risk is 2 August 2027, not 2026. This page does not invent a 2 August 2026 date for Annex I.
What Articles 3(3) to 3(8) actually say
Last verified 9 September 2026 against Article 3 of Regulation (EU) 2024/1689 on EUR-Lex (OJ L 2024/1689, 12.7.2024). These are legal requirements of the definitions. This page does not apply them to YOU. An organisation can occupy more than one role. Not legal advice.
| Term | What Article 3 says | Kind of text | Last verified |
|---|---|---|---|
| Provider — Article 3(3) | Authentic Article 3(3): 'provider' means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge. | Article 3(3) of 2024/1689. Legal requirement of the definition. This page does not determine that YOU are a provider. | 9 September 2026 |
| Deployer — Article 3(4) | Authentic Article 3(4): 'deployer' means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity. | Article 3(4) of 2024/1689. Legal requirement of the definition. This page does not determine that YOU are a deployer. | 9 September 2026 |
| Authorised representative — Article 3(5) | Authentic Article 3(5): 'authorised representative' means a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation. | Article 3(5) of 2024/1689. Legal requirement of the definition. Article 22 is the high-risk authorised-representative duty. This page does not appoint one. | 9 September 2026 |
| Importer — Article 3(6) | Authentic Article 3(6): 'importer' means a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country. | Article 3(6) of 2024/1689. Legal requirement of the definition. Article 23 is the high-risk importer duty set. This page does not determine that YOU are an importer. | 9 September 2026 |
| Distributor — Article 3(7) | Authentic Article 3(7): 'distributor' means a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market. | Article 3(7) of 2024/1689. Legal requirement of the definition. Article 24 is the high-risk distributor duty set. This page does not determine that YOU are a distributor. | 9 September 2026 |
| Operator — Article 3(8) | Authentic Article 3(8): 'operator' means a provider, product manufacturer, deployer, authorised representative, importer or distributor. Product manufacturer is named here; Article 25(3) is the product-manufacturer-as-provider rule for certain Annex I Section A products. | Articles 3(8) and 25(3) of 2024/1689. Legal requirements of the definition and of that rule. This page does not determine that YOU are a product manufacturer. | 9 September 2026 |
| Putting into service — Article 3(11) | Authentic Article 3(11): 'putting into service' means the supply of an AI system for first use directly to the deployer or for own use in the Union for its intended purpose. Own-use putting into service can sit inside Article 3(3)'s provider definition. | Article 3(11) of 2024/1689. Legal requirement of the definition. This page does not find that YOU put a system into service. | 9 September 2026 |
| Downstream provider — Article 3(68) | Authentic Article 3(68): 'downstream provider' means a provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether the AI model is provided by themselves and vertically integrated or provided by another entity based on contractual relations. | Article 3(68) of 2024/1689. Legal requirement of the definition. Distinct from Article 3(63) GPAI-model provider. This page does not determine that YOU are a downstream provider. | 9 September 2026 |
Article 113(b) is 2 August 2025, not 2 August 2026
Last verified 9 September 2026 against Article 113 of Regulation (EU) 2024/1689 on EUR-Lex (OJ L 2024/1689, 12.7.2024). Article 113(b): Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 shall apply from 2 August 2025, with the exception of Article 101. Chapter V is the GPAI chapter, including Article 53 provider duties. GPAI-model provider duties therefore apply from 2 August 2025 under Article 113(b), except Article 101. They did not start on 2 August 2026. This page does not move that date.
Article 16, Article 25 and Article 26 sit in Chapter III Section 3 (obligations of providers and deployers of high-risk AI systems and other parties). The original Article 113 second paragraph applies the rest of the Regulation from 2 August 2026. Article 113(c) keeps Article 6(1) and the corresponding obligations — Annex I product-embedded high-risk — on 2 August 2027, not 2 August 2026. This page does not invent a 2 August 2026 date for Annex I. Those dates are not one number.
Regulation (EU) 2026/1744 is an amending regulation. It does not rewrite Article 113(b) for Chapter V. Counsel reads the authentic operative article of any amendment. This page does not apply 2026/1744 to YOU. Not legal advice.
Article 16 — high-risk provider obligations as written
Each row is a duty as Article 16 of 2024/1689 states it for providers of high-risk AI systems. Mapping a row is not a finding that it binds YOU, and is not a classification that YOU are a provider. Walk the checklist questions below with counsel. Last verified 9 September 2026. Not legal advice.
| Point | What the cited text says | Kind of text | Last verified |
|---|---|---|---|
| Article 16(a) | Ensure that their high-risk AI systems are compliant with the requirements set out in Chapter III Section 2. | Article 16(a) of 2024/1689. Legal requirement, only if it applies. This page does not run Section 2 for YOU. | 9 September 2026 |
| Article 16(b) | Indicate on the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, as applicable, their name, registered trade name or registered trade mark, the address at which they can be contacted. | Article 16(b) of 2024/1689. Legal requirement, only if it applies. | 9 September 2026 |
| Article 16(c)–(e) | Have a quality management system which complies with Article 17; keep the documentation referred to in Article 18; when under their control, keep the logs automatically generated by their high-risk AI systems as referred to in Article 19. | Article 16(c)–(e) of 2024/1689. Legal requirements, only if they apply. This product does not keep YOUR Article 18 file. | 9 September 2026 |
| Article 16(f)–(h) | Ensure the relevant conformity assessment procedure as referred to in Article 43, prior to placing on the market or putting into service; draw up an EU declaration of conformity in accordance with Article 47; affix the CE marking in accordance with Article 48. | Article 16(f)–(h) of 2024/1689. Legal requirements, only if they apply. This product does not issue CE marking and does not draw up YOUR declaration. | 9 September 2026 |
| Article 16(i)–(l) | Comply with the registration obligations referred to in Article 49(1); take the necessary corrective actions and provide information as required in Article 20; upon a reasoned request of a national competent authority, demonstrate conformity with Section 2; ensure accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882. | Article 16(i)–(l) of 2024/1689. Legal requirements, only if they apply. This page does not file Article 49 registration. | 9 September 2026 |
Article 26 — high-risk deployer obligations as written
Each row is a duty as Article 26 of 2024/1689 states it for deployers of high-risk AI systems. Mapping a row is not a finding that it binds YOU, and is not a classification that YOU are a deployer. Last verified 9 September 2026. Not legal advice.
| Point | What the cited text says | Kind of text | Last verified |
|---|---|---|---|
| Article 26(1) | Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems. | Article 26(1) of 2024/1689. Legal requirement, only if it applies. This page does not write YOUR instructions-for-use file. | 9 September 2026 |
| Article 26(2) | Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. | Article 26(2) of 2024/1689. Legal requirement, only if it applies. This page does not assign YOUR overseers. | 9 September 2026 |
| Article 26(4) | To the extent the deployer exercises control over the input data on the basis of which the system produces an output, that deployer shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system. | Article 26(4) of 2024/1689. Legal requirement, only if it applies. This page does not assess YOUR input data. | 9 September 2026 |
| Article 26(5) | Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that use in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. | Article 26(5) of 2024/1689. Legal requirement, only if it applies. This page does not start a clock and does not file that notice. | 9 September 2026 |
| Article 26(6) | Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data. | Article 26(6) of 2024/1689. Legal requirement, only if it applies. This product does not keep YOUR Article 26 logs. | 9 September 2026 |
| Article 26(7)–(9), (11)–(12) | Workplace information to workers' representatives and affected workers before putting into service or using a high-risk AI system at the workplace — Article 26(7). Public-authority registration under Article 49 — Article 26(8). Use Article 13 information to carry out a data-protection impact assessment under GDPR Article 35 or Directive (EU) 2016/680 Article 27 — Article 26(9). Inform natural persons subject to Annex III high-risk systems that make or assist decisions related to them — Article 26(11). Cooperate with competent authorities — Article 26(12). | Article 26(7)–(9), (11)–(12) of 2024/1689. Legal requirements, only if they apply. This page does not file YOUR DPIA. | 9 September 2026 |
| Article 27 — FRIA, certain deployers | Article 27(1): prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce. | Article 27 of 2024/1689. Legal requirement, only if it applies. Distinct from Article 26. This page does not run YOUR FRIA. | 9 September 2026 |
Importer, distributor, and product manufacturer
Articles 23, 24 and 25(3) are legal requirements of 2024/1689, only if they apply. Mapping a row is not a classification that YOU occupy that role. Last verified 9 September 2026. Not legal advice.
| Role | What the cited text says | Kind of text | Last verified |
|---|---|---|---|
| Importer — Article 23 | Article 23(1): before placing a high-risk AI system on the market, importers shall ensure that the system is in conformity with this Regulation by verifying that the relevant Article 43 conformity assessment has been carried out by the provider; the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV; the system bears the required CE marking and is accompanied by the EU declaration of conformity and instructions for use; and the provider has appointed an authorised representative in accordance with Article 22(1). | Article 23 of 2024/1689. Legal requirement, only if it applies. This page does not determine that YOU are an importer. | 9 September 2026 |
| Distributor — Article 24 | Article 24(1): before making a high-risk AI system available on the market, distributors shall verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer of that system, as applicable, have complied with their respective obligations as laid down in Article 16, points (b) and (c) and Article 23(3). | Article 24 of 2024/1689. Legal requirement, only if it applies. This page does not determine that YOU are a distributor. | 9 September 2026 |
| Product manufacturer — Article 25(3) | Authentic Article 25(3): In the case of high-risk AI systems that are safety components of products covered by the Union harmonisation legislation listed in Section A of Annex I, the product manufacturer shall be considered to be the provider of the high-risk AI system, and shall be subject to the obligations under Article 16 under either of the following circumstances: (a) the high-risk AI system is placed on the market together with the product under the name or trademark of the product manufacturer; (b) the high-risk AI system is put into service under the name or trademark of the product manufacturer after the product has been placed on the market. | Article 25(3) of 2024/1689. Legal requirement, only if it applies. Article 113(c) Annex I corresponding obligations are 2 August 2027, not 2026. This page does not determine that YOU are a product manufacturer. | 9 September 2026 |
Article 25 — quote the substantial-modification rule, do not invent it
Last verified 9 September 2026 against Article 25 of Regulation (EU) 2024/1689 on EUR-Lex (OJ L 2024/1689, 12.7.2024). Authentic Article 25(1): Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances: (a) they put their name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated; (b) they make a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service in such a way that it remains a high-risk AI system pursuant to Article 6; (c) they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a high-risk AI system in accordance with Article 6.
Authentic Article 25(2), first sentence of 2024/1689: Where the circumstances referred to in paragraph 1 occur, the provider that initially placed the AI system on the market or put it into service shall no longer be considered to be a provider of that specific AI system for the purposes of this Regulation. That is the article as written. This page does not paraphrase it from memory and does not run it for YOU.
Authentic Article 3(23): 'substantial modification' means a change to an AI system after its placing on the market or putting into service which is not foreseen or planned in the initial conformity assessment carried out by the provider and as a result of which the compliance of the AI system with the requirements set out in Chapter III, Section 2 is affected or results in a modification to the intended purpose for which the AI system has been assessed. Article 25(1)(b) uses that defined term. Fine-tuning or wrapping is not automatically Article 25(1)(b). Counsel reads Article 3(23) and Article 25 against YOUR facts. Regulation (EU) 2026/1744 is an amending regulation. Counsel reads any authentic operative amendment. This page does not apply it to YOU. Not legal advice.
High-risk versus GPAI — side-by-side by role
High-risk system duties (Chapter III) and GPAI-model duties (Chapter V) are different tracks. A person can sit on both. Mapping a row is not a finding that either track binds YOU. The GPAI-requirements guide on this site is the Article 53 baseline page. Last verified 9 September 2026. Not legal advice.
| Role | High-risk AI system track | GPAI model track | Kind of text | Last verified |
|---|---|---|---|---|
| Provider | Article 16, if YOU are the provider of a high-risk AI system. Article 25(1) can treat a distributor, importer, deployer or other third-party as that provider. | Article 53, if YOU are the provider of a general-purpose AI model under Articles 3(3) and 3(63). Article 55 extras if Article 51 classifies systemic risk. The GPAI-systemic-risk guide on this site is the Article 51–55 page. | Articles 16, 25(1), 51, 53 and 55 of 2024/1689. Legal requirements, only if they apply. This page does not determine that YOU are either kind of provider. | 9 September 2026 |
| Deployer | Article 26, if YOU are the deployer of a high-risk AI system. Article 27 FRIA for the deployers it names. | Chapter V does not create a GPAI-model 'deployer' duty set. Using an AI system that integrates a GPAI model is an Article 3(4) deployer question for that system, and an Article 26 question only if that system is high-risk. | Articles 3(4), 26, 27 and Chapter V of 2024/1689. Legal requirements, only if they apply. This page does not determine that YOU are a deployer. | 9 September 2026 |
| Downstream provider — Article 3(68) | A downstream provider is a provider of an AI system which integrates an AI model. If that system is high-risk, Article 16 attaches to that provider, not automatically to the model provider. | Article 53 attaches to the GPAI-model provider. Article 53(1)(b) and Annex XII are information for downstream providers. Integrating a model does not by itself make YOU the GPAI-model provider under Article 3(63). | Articles 3(68), 16 and 53(1)(b) of 2024/1689. Legal requirements. This page does not determine that YOU are a downstream provider. | 9 September 2026 |
| Importer / distributor | Article 23 importer; Article 24 distributor; Article 25(1) can treat either as a high-risk provider. | Chapter V authorised-representative duty for third-country GPAI-model providers is Article 54, not Article 23. Distinct tracks. | Articles 23, 24, 25(1) and 54 of 2024/1689. Legal requirements, only if they apply. | 9 September 2026 |
| Product manufacturer | Article 25(3) treats the product manufacturer as the Article 16 provider for certain Annex I Section A safety-component systems. | Article 25(3) is not a GPAI-model provider rule. Annex I corresponding obligations are Article 113(c), 2 August 2027, not 2026. | Articles 25(3) and 113(c) of 2024/1689. Legal requirements, only if they apply. | 9 September 2026 |
| When the duty starts | Chapter III Section 3 (Articles 16, 25, 26) is in the original Article 113 second-paragraph residual — 2 August 2026 — except Article 6(1) corresponding obligations on 2 August 2027 under Article 113(c). Those dates are not one number. | Chapter V GPAI, including Article 53, from 2 August 2025 under Article 113(b), except Article 101. They did not start on 2 August 2026. This page does not invent a 2 August 2026 start date for GPAI. | Article 113 of 2024/1689. Legal requirement of the original regulation. 2026/1744 is an amending regulation. Counsel reads it. | 9 September 2026 |
Role-mapping — questions, not a classification
The table below is a question list. Answering a row is not a classification that YOU are a provider, a deployer, an importer, a distributor, or a product manufacturer. Walk it with counsel. Last verified 9 September 2026. Not legal advice.
| Question | What the cited text points at | What this page does not do |
|---|---|---|
| Does the Act apply to YOU at all? | Articles 2 and 3 — AI system or GPAI model placed on the Union market, put into service in the Union, or producing output used in the Union, and the Article 2 exclusions. | Does not run applicability for YOU. |
| Did YOU develop an AI system or a GPAI model, or have one developed, and place it on the market or put the AI system into service under YOUR own name or trademark? | Article 3(3) provider. Article 3(11) putting into service includes own use in the Union. | Does not determine that YOU are a provider. |
| Are YOU using an AI system under YOUR authority, other than a personal non-professional activity? | Article 3(4) deployer. The same organisation can also be a provider under Article 3(3). | Does not determine that YOU are a deployer. |
| Did YOU put YOUR name or trademark on a high-risk AI system already placed on the market or put into service? | Article 25(1)(a). Contractual arrangements stipulating that the obligations are otherwise allocated are without prejudice, as the article writes them. | Does not run Article 25(1)(a) for YOU. |
| Did YOU make a substantial modification to a high-risk AI system already placed on the market or put into service, such that it remains high-risk pursuant to Article 6? | Article 25(1)(b) plus the Article 3(23) definition. Fine-tuning or wrapping is not automatically this limb. | Does not run the substantial-modification test for YOU. |
| Did YOU modify the intended purpose of an AI system, including a general-purpose AI system, so that it becomes high-risk in accordance with Article 6? | Article 25(1)(c). Article 3(66) defines a general-purpose AI system. | Does not classify YOUR system under Article 6. |
| If Article 25(1) looks like it is in play, is the initial provider still the provider of that specific AI system? | Article 25(2), first sentence of 2024/1689: the provider that initially placed the AI system on the market or put it into service shall no longer be considered to be a provider of that specific AI system for the purposes of this Regulation. | Does not reassign YOUR provider status. |
| Are YOU a GPAI-model provider, a downstream provider, or both? | Articles 3(3), 3(63) and 3(68). The GPAI-requirements guide on this site is the Article 53 baseline page. Article 113(b) is 2 August 2025, not 2 August 2026. | Does not determine that YOU are a GPAI provider. Does not invent a 2 August 2026 start date for GPAI. |
Worked examples — questions, not findings about YOU
These are question lists for two common patterns. They are not findings about YOU, not classifications, and not legal advice. Walk them with counsel. Last verified 9 September 2026.
| Pattern | Questions the cited text points at | What this page does not do |
|---|---|---|
| SaaS reselling a third-party model | Did YOU develop the AI system or have it developed and place it on the market under YOUR own name or trademark (Article 3(3))? Are YOU using it under YOUR authority (Article 3(4))? Did YOU put YOUR name or trademark on a high-risk system already placed on the market (Article 25(1)(a))? Did YOU make a substantial modification as Article 3(23) and Article 25(1)(b) write it? Did YOU modify intended purpose so a non-high-risk system, including a general-purpose AI system, becomes high-risk (Article 25(1)(c))? Are YOU a downstream provider under Article 3(68)? Are YOU an importer under Article 3(6) or a distributor under Article 3(7)? | Does not find that a SaaS reseller is a provider. Does not find that YOU are a provider or a deployer. |
| Internal tool builder | Did YOU develop an AI system or have it developed and put it into service for own use in the Union under YOUR own name or trademark (Articles 3(3) and 3(11))? Are YOU also using it under YOUR authority (Article 3(4))? If the tool is high-risk, which Article 16 points and which Article 26 points, if any, look like they are in play? If YOU started from a third-party system already on the market, do Article 25(1)(a)–(c) look like they are in play? | Does not find that an internal tool builder is a provider. The same organisation can occupy both Article 3(3) and Article 3(4). This page does not assign either. |
Legal requirement versus Commission and AI Office guidance
The table below labels each text. Do not treat guidance as the article, and do not treat the article as optional because a guideline exists. Last verified 9 September 2026. Not legal advice.
| Text | What it is | What this page does not do |
|---|---|---|
| Regulation (EU) 2024/1689 Articles 3(3)–(8), 3(11), 3(23), 3(63), 3(66), 3(68), 16, 23–26, 53, 113 | Legal requirement — the regulation, only if it applies. Chapter V GPAI, including Article 53, from 2 August 2025 under Article 113(b), except Article 101. Article 113(c) Annex I is 2 August 2027, not 2026. | Does not determine that YOU are a provider or a deployer. Does not date GPAI from 2 August 2026. |
| Regulation (EU) 2026/1744 — Digital Omnibus on AI | An amending regulation. It does not rewrite Article 113(b) for Chapter V. | Does not treat an amending-regulation recital as moving GPAI provider duties to 2 August 2026. Article 113(c) Annex I remains 2 August 2027 in the original regulation. |
| European Commission AI Act page and AI Act Service Desk | Commission materials. Guidance, not the regulation. | Does not treat a Commission timeline as rewriting Article 113(b). |
| Commission guidelines on the scope of obligations for providers of GPAI models (18 July 2025) | Commission materials. Guidance, not the regulation. They discuss when modifying a third-party model may make someone a GPAI provider. | Does not run that test. Counsel reads Article 3 and Article 25. The guidelines are not a substitute for those articles. |
What to do now
As of last verification on 9 September 2026, Chapter V GPAI-model provider duties have applied since 2 August 2025 under Article 113(b), except Article 101. High-risk Chapter III Section 3 duties sit on the original 2 August 2026 residual, except Article 6(1) corresponding obligations on 2 August 2027 under Article 113(c). The list below is operational preparation. It is not a classification that YOU are a provider or a deployer. Walk it with counsel.
- Ask counsel whether YOU occupy Article 3(3), Article 3(4), Article 3(6), Article 3(7), Article 3(8) product manufacturer, Article 3(68), or more than one. This page does not run those tests. Marking eu_ai_act in an obligation map is not that determination and is not a role classification.
- If a third-party system is already on the market, walk Article 25(1)(a)–(c) and Article 3(23) against YOUR facts. Quote the article. Do not treat fine-tuning or wrapping as automatically Article 25(1)(b). This product does not run that test.
- If counsel finds YOU are a GPAI-model provider, walk Article 53. Do not date those duties from 2 August 2026. Article 113(b) is 2 August 2025. The GPAI-requirements guide on this site is the Article 53 baseline page.
- The EU AI Act overview on this site is the pillar page. The requirements-in-force-2026 guide on this site is the Article 113 dates page. The GPAI-systemic-risk guide on this site is the Article 51–55 page. The AI-governance-requirements guide on this site is the Articles 4, 14, 26 and ISO 42001 page. The AI-risk-management-requirements guide on this site is the Articles 9 and 55 page. A dedicated AI-ownership-accountability and how-shipreadymetrics-supports-ai-governance guide is not on this site yet. Naming them is not a link.
Checklist
This is a question list, not a classification, and not a filing. Walk it with counsel. The EU AI Act overview on this site is the pillar page.
- Does the Act apply to YOU at all? Articles 2 and 3. This page does not run that test.
- Are YOU a provider under Article 3(3)? A deployer under Article 3(4)? Both? This page does not determine that YOU are a provider or a deployer.
- Are YOU an importer under Article 3(6), a distributor under Article 3(7), a product manufacturer under Articles 3(8) and 25(3), or a downstream provider under Article 3(68)? This page does not assign those roles.
- Do Article 25(1)(a), (b) or (c) look like they are in play? Article 25(1)(b) uses the Article 3(23) substantial-modification definition. This page does not run that test.
- If high-risk, which Article 16 points and which Article 26 points, if any? This page does not pick YOUR points.
- If a GPAI model, Article 53 from 2 August 2025 under Article 113(b), not 2 August 2026. Article 113(c) Annex I is 2 August 2027, not 2026.
- Document the assessment, including a not-provider and not-deployer decision. This page does not keep YOUR file and does not classify YOUR role.
Where this shows up in ShipReady Metrics
The bundled framework key eu_ai_act is customer-visible. Its version label is Regulation (EU) 2024/1689 high-risk obligations (starter subset). It is not in INTERNAL_TESTER_ONLY_FRAMEWORKS. The control-set is a starter subset, illustrative, to be tailored by a compliance owner; not legal advice; not a conformity determination; not CE marking. Readiness is not compliance and not an EU-database registration.
If you already have a session: signed-in app → Compliance → AI governance holds the AI inventory and AI-governance posture. The AI risk register lives with that AI-governance surface. That inventory does not classify YOUR role under Article 3, does not decide that YOU are a provider or a deployer, and does not file with the AI Office or a market-surveillance authority. Marking in-scope is not a role determination and not auto-filing. A named human still owns the assessment.
This product does not run the Article 25 substantial-modification test, does not assign provider or deployer status, does not produce Article 16 technical documentation, does not keep Article 26 logs, does not file with the AI Office, and does not issue certifications. The obligation map lists frameworks the organisation has marked in-scope, including eu_ai_act if that mark is set. Marking eu_ai_act in-scope is not a determination that you are a provider or a deployer.
This page does not document a public demo URL. There is no public EU AI Act demo path. This product does not start a clock.
Primary sources (last verified 9 September 2026)
Every regulatory or guidance claim on this page is taken from one of these. If a later revision of a source changes the rule, the date above is how you can see we have not re-checked yet.
Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act), Articles 3(3)–(8), 3(11), 3(23), 3(63), 3(66), 3(68), 16, 23–26, 53 and 113, is a legal requirement only if it applies. Entry into force 1 August 2024. Article 113(a) 2 February 2025; Article 113(b) 2 August 2025; general application 2 August 2026; Article 113(c) Article 6(1) from 2 August 2027. Regulation (EU) 2026/1744 is an amending regulation; it does not rewrite Article 113(b) for Chapter V. The European Commission's AI Act page and the AI Act Service Desk are Commission materials, not the regulation. Commission GPAI-scope guidelines (18 July 2025) are agency/Commission guidance, not the regulation. These are not a complete world list. Not legal advice.
The EU AI Act overview on this site is the pillar page. The requirements-in-force-2026 guide on this site is the Article 113 dates page. The GPAI-requirements guide on this site is the Article 53 baseline page. The GPAI-systemic-risk guide on this site is the Article 51–55 page. The EU AI Act framework guide on this site is the education page under frameworks. The AI-governance-requirements guide on this site is the Articles 4, 14, 26 and ISO 42001 page. The AI-risk-management-requirements guide on this site is the Articles 9 and 55 page. A dedicated AI-ownership-accountability and how-shipreadymetrics-supports-ai-governance guide is not on this site yet. Naming them is not a link.
Frequently asked questions
Is this legal advice?
No. It is a dated map of operator roles distilled from Regulation (EU) 2024/1689 Articles 3, 16, 25 and 26, with Commission and AI Office materials labelled as guidance, not the regulation. Whether YOU are a provider, a deployer, an importer, a distributor, or a product manufacturer is a legal question for counsel on your facts. This page does not start a clock and does not file with the AI Office.
Does this page determine that we are a provider or a deployer?
No. Mapping a row is not a determination that the Act applies, that YOU are a provider under Article 3(3), that YOU are a deployer under Article 3(4), or that Article 25 has reassigned provider status. Counsel applies those articles to YOUR facts. Last verified 9 September 2026.
If we fine-tune or wrap a third-party model, are we the provider?
This page does not run that test. Counsel reads Article 3 and Article 25 of Regulation (EU) 2024/1689. Article 25(1)(b) uses the Article 3(23) substantial-modification definition; fine-tuning or wrapping is not automatically that limb. Commission GPAI-scope guidelines (18 July 2025) are guidance, not the regulation. Marking eu_ai_act in-scope is not a role determination. Last verified 9 September 2026.
Does marking eu_ai_act in-scope classify our role?
No. Marking the bundled framework key eu_ai_act in-scope on the obligation map is not a determination that you are a provider, a deployer, an importer, a distributor, or a product manufacturer, and is not auto-filing. Counsel applies Articles 3, 16, 25 and 26 to YOUR facts. A named human still owns the assessment.
Did GPAI provider duties start on 2 August 2026?
No. Article 113(b) of Regulation (EU) 2024/1689 applies Chapter V from 2 August 2025, with the exception of Article 101. Chapter V includes Article 53 GPAI-model provider duties. That is not 2 August 2026. Article 113(c) Annex I product-embedded high-risk is 2 August 2027, not 2026. Last verified 9 September 2026.
Does ShipReady classify our role, or file with the AI Office?
No. This product does not classify YOUR role under Article 3, does not run the Article 25 substantial-modification test, does not file with the AI Office, and does not issue certifications. Signed-in app → Compliance → AI governance holds the AI inventory and AI-governance posture the organisation recorded. Marking in-scope is not a role determination and not auto-filing. A named human still owns the assessment.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.