AI Governance Engineer
GitHub

EU AI Act operator roles

Seven questions down a spine, each leading to an EU AI Act operator role with its duties and evidence, an Article 25 loop to provider and a registry entry.

By Updated First published

EU AI Act operator roles Seven questions down a spine, each leading to an EU AI Act operator role with its duties and evidence, an Article 25 loop to provider and a registry entry. EU AI Act · operators under Art. 3(8), for one system Which role do you hold for this system? Ask every question: roles name tasks, not organisations, so you can hold several for one system. Do you develop an AI system, or have it developed, and place it on the market or into service under your own name? yes Provider Art. 3(3) Arts. 8 to 17, 43 to 49, 72, 73; 50(1), 50(2) Technical documentation, QMS records, eval results, declaration Do you place a general-purpose AI model on the market? yes GPAI provider Art. 53 Arts. 53 to 55 Model documentation, training summary, copyright policy Do you place a high-risk AI safety component on the market with your Annex I, Section A product, under your name? yes Product manufacturer Art. 25(3) Provider duties (Art. 16) As a provider Are you established in the EU and placing on the market a system that bears a non-EU provider's name? yes Importer Art. 3(6) Art. 23: verify; keep copies 10 years Import verification record Do you make the system available on the EU market without being its provider or importer? yes Distributor Art. 3(7) Art. 24: verify marking and documents Distribution check record Are you established in the EU and acting under a written mandate from a non-EU provider? yes Authorised representative Art. 3(5) Arts. 22, 54: verify; keep documents 10 years Mandate; document copies Do you use the system under your own authority, other than for purely personal, non-professional use? yes Deployer Art. 3(4) Arts. 26, 27, 50(3), 50(4), 86 Use logs, oversight roster, FRIA, notices Registry entry per system: its roles as a list, such as ["provider", "deployer"] No role applies: not an operator for this system. An affected person holds protections, not duties (Art. 2(1)(g)). Art. 25(1): a distributor, importer, deployer or other third party becomes the provider of a high-risk system, with all Art. 16 duties, when it: (a) puts its name or trademark on a high-risk system already on the market; (b) makes a substantial modification to a high-risk system that stays high-risk; (c) changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. The initial provider must cooperate (Art. 25(2)); a written agreement fixes the information and access (Art. 25(4)). Art. 25 Source: chapter 18, Who you are in the value chain (role table and Article 25). As of 2026-09-24 · a reading aid, not legal advice; illustrative, not a claim of conformity
EU AI Act operator roles The questions that tell which EU AI Act operator roles an organisation holds for one system, each role with its core duties and the evidence it produces, and the Article 25 loop that turns a distributor, importer or deployer into the provider. Record the roles per system in the registry and ask the questions again whenever an Article 25 trigger fires. Drawn from chapter 18.

Text alternative

Ask every question for one system: roles name tasks, not organisations, so one organisation can hold several. Provider (Art. 3(3)): develops an AI system, or has it developed, and places it on the market or into service under its own name; Arts. 8 to 17, 43 to 49, 72 and 73, and 50(1) and 50(2); produces technical documentation, QMS records, eval results and the declaration. GPAI provider (Art. 53): places a general-purpose AI model on the market; Arts. 53 to 55; produces model documentation, the training summary and the copyright policy. Product manufacturer (Art. 25(3)): places a high-risk AI safety component on the market with its Annex I, Section A product under its own name, and carries the provider duties of Art. 16. Importer (Art. 3(6)): established in the EU, places on the market a system bearing the name of a provider established outside it; Art. 23; keeps an import verification record. Distributor (Art. 3(7)): makes a system available on the EU market without being its provider or importer; Art. 24; keeps a distribution check record. Authorised representative (Art. 3(5)): established in the EU under a written mandate from a provider outside it; Arts. 22 and 54; keeps the mandate and document copies. Deployer (Art. 3(4)): uses a system under its own authority, other than for a purely personal, non-professional activity; Arts. 26, 27, 50(3), 50(4) and 86; keeps use logs, the oversight roster, the FRIA and notices. The Article 25 loop: a distributor, importer, deployer or other third party becomes the provider of a high-risk system, with all Art. 16 duties, when it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to a high-risk system that stays high-risk, or changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. The initial provider must cooperate (Art. 25(2)), and a written agreement fixes the information and access (Art. 25(4)). The answers end in a registry entry that records the roles per system as a list, such as ["provider", "deployer"]. If no role applies, the organisation is not an operator for that system; an affected person holds protections, not duties (Art. 2(1)(g)). A reading aid, not legal advice; illustrative, not a claim of conformity.

Download

Every file carries the attribution band "aigovernanceengineer.com · CC BY 4.0 · v0.5.0" inside the image, and the version is in the file name, so a copy always says where it came from and which edition it shows. The SVGs keep the text live: the first follows the viewer's light or dark setting, the other two fix one theme for slides and print. The PNGs are drawn with the site's own typefaces.

Seven questions down a spine, each leading to an EU AI Act operator role with its duties and evidence, an Article 25 loop to provider and a registry entry.
The PNG, light, 1600 px wide, as it downloads (shown here as a lighter copy).

Reuse and credit

The figure is published under CC BY 4.0: you may copy, share and adapt it, commercially too, provided you give appropriate credit, link to the licence and say if you changed it. Keep the attribution band in the image. A credit line that covers title, author, source and licence:

“EU AI Act operator roles” by Jorge García Aibar, aigovernanceengineer.com (https://aigovernanceengineer.com/figures/eu-ai-act-operator-roles), v0.5.0, as of 2026-09-24. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

Embed with HTML

<figure>
  <img src="https://aigovernanceengineer.com/downloads/figures/eu-ai-act-operator-roles-v0.5.0-light-1600.png" alt="Seven questions down a spine, each leading to an EU AI Act operator role with its duties and evidence, an Article 25 loop to provider and a registry entry." width="800" height="1146" loading="lazy">
  <figcaption>
    <a href="https://aigovernanceengineer.com/figures/eu-ai-act-operator-roles">EU AI Act operator roles</a> by Jorge García Aibar,
    aigovernanceengineer.com, v0.5.0, as of 2026-09-24.
    Licensed under <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>.
  </figcaption>
</figure>

Embed with Markdown

![Seven questions down a spine, each leading to an EU AI Act operator role with its duties and evidence, an Article 25 loop to provider and a registry entry.](https://aigovernanceengineer.com/downloads/figures/eu-ai-act-operator-roles-v0.5.0-light-1600.png)

*[EU AI Act operator roles](https://aigovernanceengineer.com/figures/eu-ai-act-operator-roles) by Jorge García Aibar, aigovernanceengineer.com, v0.5.0, as of 2026-09-24. Licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).*