What counts as an AI system
Article 3(1) defines an AI system as a machine-based system with some degree of autonomy that infers, from the input it receives, how to generate outputs — predictions, content, recommendations or decisions — that can influence physical or virtual environments.
The key is inference. A spreadsheet with fixed formulas or a programmed business rule infers nothing; a classifier trained on data, a language model or a recommendation engine does. In borderline cases it is worth documenting why a tool was judged to fall inside or outside the definition.
Provider, deployer and the other operators
A provider is anyone who develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge (Article 3(3)). A deployer is anyone using an AI system under its authority, except in the course of a personal non-professional activity (Article 3(4)).
The chain is completed by the importer, the distributor and the authorised representative; together they are all "operators" (Article 3(8)). Most companies that buy in an AI-enabled tool are deployers, not providers, and their obligations are far narrower.
Who it applies to
Under Article 2(1), the Regulation covers providers placing systems on the EU market, wherever they are established; deployers established in the Union; and providers and deployers in third countries where the output of the system is used in the Union.
Excluded, among others, are systems developed solely for scientific research (Article 2(6)), purely personal use (Article 2(10)) and national security (Article 2(3)).
When a deployer becomes a provider
Article 25(1) makes anyone a provider of a high-risk system if they put their name or trademark on it, substantially modify it or change its intended purpose so that it becomes high-risk. The textbook case is a company that adapts a general-purpose tool to screen job applicants.
After the Omnibus, the original provider ceases to be the provider of that specific system but must cooperate with the new one: sufficient technical documentation, known limitations and failure modes, and technical access for testing, unless it had clearly stated that its system was not to be turned into a high-risk one (Article 25(2)).
What an auditor usually asks for
- Inventory of tools that use AI, with provider and purpose
- The company's role identified for each one: provider or deployer
- Borderline cases documented with the reason for the decision
- Changes of purpose or branding reviewed before they are made
How to tackle it in practice
- 1List the company's applications and mark those that generate predictions, content, recommendations or decisions from data.
- 2For each one, note who the provider is, what it is used for and which people are affected by its outputs.
- 3Before adapting a tool or using it for another purpose, check whether that makes you a provider under Article 25.
The inventory of systems is the basis for everything else: without it you cannot tell which chapters of the Regulation apply to you.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EUR-Lex · OJ L 2024/1689 · 12 July 2024
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 EUR-Lex · OJ L 2026/1744 · 24 July 2026
- Regulation (EU) 2024/1689, consolidated text EUR-Lex · CELEX 02024R1689-20260727 · Version of 27 July 2026