This overview is part of a wider series of articles on the AI Act. For recommended steps to take in the first six months, our latest update is available here.

The European AI Act has a broad material and territorial scope of application. We have outlined below the main categories of actors that are impacted.

Key Takeaways

• The AI Act covers a wide range of actors in the AI value chain, namely in the development, use and commercialization of AI systems and general-purpose AI models.
• All categories of actors are impacted regardless of their place of establishment. The AI Act applies as soon as an AI system or general-purpose AI model is commercialized and/or used (or the outputs of a system are used) in the EU unless an exemption applies.
• Most of the AI Act’s obligations apply to providers and deployers while importers and distributors are mainly subject to regulatory compliance verification and documentation obligations. One of the first steps to determining which obligations of the AI Act apply is to identify which role or roles your company fulfills in relation to AI systems and general-purpose AI models.

Categories of operators covered by the AI Act

The AI Act applies to all operators in the AI value chain: providers, deployers, importers, distributors and product manufacturers.

• Providers: A provider is defined as a natural person or legal entity that develops an AI system or a general-purpose AI model or that has an AI system, or a general-purpose AI model developed and places it on the market or puts the system into service under its own name or trademark, whether for payment or free.
  • Deployers, distributors and importers are considered providers if they:
  • Put their name or trademark on a high-risk AI system already on the market or put into service or
  • Make a substantial modification to a high-risk AI system already on the market or put into service or
  • Modify the intended purpose of an AI system not classified as high risk, resulting in the AI system being classified as high risk.
• Deployers: A deployer is a natural person or legal entity using an AI system under its authority as part of its professional or commercial activity.
• Importers: An importer is a natural person or legal entity located or established in the EU that places on the EU market an AI system under the name or trademark of a natural person or legal entity established outside the EU.
• Distributors: A distributor is a natural person or legal entity in the supply chain, other than the provider or importer, that makes an AI system available in the EU.
• Product manufacturers: The AI Act does not define product manufacturers and refers instead to the definition of each relevant product regulation. Manufacturers are brought into scope as part of the AI value chain when integrating AI systems in their products. For high-risk AI systems that are safety components of products subject to the legislation listed in Annex II of the AI Act the manufacturer shall be considered the provider of the AI system if:
  • The high-risk AI system is placed on the market with the product offered under the name or trademark of the product manufacturer and/or
  • The high-risk AI system is put into service under the name or trademark of the product manufacturer after the product has been placed on the market.

Making available, placing on the market, putting into service and use of output in the EU

The notions of “placing on the market” and “making available on the market” are key in the analysis of the scope of the regulation. The AI Act refers to these activities for specifying its application to different actors:

• “Making available on the market” means the supply of an AI system or a general-purpose AI model for distribution or use on the EU market as part of a commercial activity, whether in return for payment or free of charge.
• “Placing on the market” is the first time an AI system or a general-purpose AI model is made available on the European Union market.
• “Putting into service” refers to the supply of an AI system for first use directly to the deployer or for use in the EU for its intended purpose.

The use of output in the EU is also a criterion for the applicability of the AI Act. The regulation does not define what this means, but a practical example is provided under Recital 11.^[1] Operators should look for guidance provided by the EU Commission or any other body on this specific concept.

Are operators located outside the EU covered?

Next Steps

Businesses should assess whether the regulation applies to them, and which category of actor they belong to. This will help a company identify key priorities as part of the compliance process. See our note regarding initial measures to adopt, here.

[1] “This is the case for example of an operator established in the Union that contracts certain services to an operator established outside the Union in relation to an activity to be performed by an AI system that would qualify as high risk. In those circumstances, the AI system used by the operator outside the Union could process data lawfully collected in and transferred from the Union, and provide to the contracting operator in the Union the output of that AI system resulting from that processing, without that AI system being placed on the market, put into service or used in the Union”