What is a deployer under the EU AI Act?

Under Article 3(4) of the EU AI Act, a deployer is a person or organisation using an AI system under its authority, except where the system is used for a purely personal, non-professional activity. An organisation can therefore be a deployer when it uses an AI tool in its own work, even though another company developed or provides the tool.

What does the role mean in practice?

Deployer obligations depend on the AI system, its intended purpose, risk classification and actual use context. For some systems, practical work can include following instructions for use, assigning human oversight, monitoring operation, retaining relevant logs, informing affected people or workers, and completing an impact assessment where required.

Start by identifying which AI systems the organisation uses, who owns each use case, what data and decisions are involved, and which evidence already exists. Classification and obligations should be assessed per use case rather than from the product name alone.

How Evidory supports deployers

Evidory is a Finnish documentation and workflow tool that helps organisations maintain an AI system inventory, map obligations, collect evidence, identify gaps, monitor providers and produce structured documentation. Evidory is a product of Caplidy Oy. It is not a law firm or consultancy, does not provide legal advice, and does not provide ISO/IEC 42001 certification or act as a certification body.

Primary source: Regulation (EU) 2024/1689, Article 3(4). This page provides general product information, not legal advice.