What is a “provider” under the EU AI Act?
A provider is any natural or legal person that develops an AI system or a general-purpose AI model — or has one developed — and places it on the EU market or puts it into service under its own name or trademark, whether for payment or free of charge. The definition comes from the EU AI Act (Regulation (EU) 2024/1689) and anchors the Act’s heaviest obligations: for high-risk systems, conformity assessment, technical documentation, risk management, logging, registration and CE marking; for GPAI models, the Article 53 duties, including the training content summary.
How you can become a provider without noticing
- White-labelling: putting your name or trademark on a third-party high-risk system makes you its provider;
- Substantial modification: changing a system’s intended purpose or materially altering it — including repurposing a general system into a high-risk use — moves provider duties for the modified system onto you;
- Fine-tuning a GPAI model: the modifier takes provider status for the modification, with training-content documentation duties to match.
Provider vs deployer: obligations and risk
The provider builds and ships; the deployer uses the system under its own authority. That one-line distinction carries most of the Act’s weight: the allocation decides who prepares documentation, who answers regulators and who bears which liability. Contracts should state explicitly who wears which hat for every integration — silence here is how disputes start. Providers established outside the EU that serve the EU market must also appoint an authorised representative in the Union.
Turkish context
A Turkish company selling AI into the EU under its own brand is a provider in the Act’s eyes, EU establishment or not, and must appoint an EU authorised representative. Türkiye itself has no equivalent AI statute in force; domestically, KVKK (Law No. 6698) and general product and contract rules govern. The practical trap for Turkish startups is white-labelling: rebranding a foreign model as your own product can hand you the full provider burden for a market you never analysed.
Do: map every product line to a role — provider, deployer or both — and write the answer into your customer and vendor contracts. Don’t: assume that building on someone else’s model outsources the obligations; modification and rebranding pull them back to you.
Sources. Regulation (EU) 2024/1689 (AI Act).