Deployer
A business or organisation that puts an AI system to work in its operations, buying or licensing it from a provider and using it on real users or processes.
The Simple Version
A business or organisation that puts an AI system to work in its operations, buying or licensing it from a provider and using it on real users or processes.
Detailed Explanation
Deployers of high-risk AI systems must implement the provider's human oversight instructions, monitor system operation, log events, inform affected natural persons, and report serious incidents. Deployers using GPAI models in their own AI systems take on responsibility for downstream use. The Act distinguishes between professional deployers (in scope) and end-users using AI for personal purposes (out of scope). Public authorities deploying high-risk AI for benefit determinations, law enforcement, or migration assessment face specific disclosure duties.
Key Characteristics
- Uses AI for professional purposes, not personal hobby use
- Must implement human oversight and monitoring as instructed by the provider
- Responsible for logging, incident reporting, and notifying affected persons
- Becomes a provider if the system is substantially modified
Why It Matters
HR departments using AI screening tools, banks using algorithmic credit scoring, and hospitals using AI diagnostics are all deployers bearing specific compliance obligations alongside the provider's duties.
Real-World Analogy
A hospital that uses a medical imaging device is the deployer, it must maintain the equipment, train staff on its proper use, and report malfunctions, even though the manufacturer certified the device.
Common Misconceptions
- Deployers have no compliance obligations, deployers of high-risk AI carry significant duties around human oversight, monitoring, and incident reporting.
- Using a compliant product relieves the deployer of all responsibility, the deployer remains accountable for how the system is operated and monitored.