AI Act roles explained: is your fashion company a provider or a deployer?
Most fashion companies are deployers of tools built by others, but branding, modifying or repurposing a system can make them providers. Here is how to tell which you are.
KEY TAKEAWAYS Summary by the editors
- Under the EU AI Act a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or brand, whether or not it charges for it.
- A deployer is any organisation that uses an AI system under its own authority for professional purposes, which describes most fashion brands, retailers and wholesalers using bought-in tools.
- A deployer can be treated as a provider if it puts its name or trademark on a high-risk system, substantially modifies one, or changes the intended purpose of a system so that it becomes high-risk.
- The Act can reach companies outside the EU when the output of their AI system is used in the Union, so non-EU fashion groups selling into Europe should check their role too.
- Roles are assessed system by system, so one company can be a deployer of its forecasting tool and a provider of a chatbot it brands as its own.
Most fashion companies are deployers under the EU AI Act, because they use AI systems built by technology suppliers. A company becomes a provider when it develops an AI system, or has one developed, and puts it on the market or into service under its own name or brand. The distinction matters because the heaviest obligations in the Act fall on providers, and a deployer can slip into that role more easily than many teams expect.
What do provider and deployer mean in the AI Act?
Article 3 of the Act defines a provider as any person, company, public authority or other body that develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. It makes no difference whether this is done for payment or free of charge. A deployer is any person or organisation that uses an AI system under its authority, except where the use is purely personal and non-professional.
The definitions are about conduct, not company type. A global fashion group, a regional wholesaler and a start-up label are all assessed the same way. Two further roles exist in the supply chain: an importer is an EU-based entity that brings to the EU market an AI system bearing the name or trademark of a company established outside the EU, and a distributor is a supply-chain participant, other than the provider or importer, that makes a system available on the EU market.
| Role | Short definition (Article 3) | Typical fashion example |
|---|---|---|
| Provider | Develops or commissions an AI system and offers or uses it under its own name or brand | A brand that has a customer chatbot built and launches it as its own assistant |
| Deployer | Uses an AI system under its own authority in a professional setting | A merchandising team using a bought-in demand forecasting tool |
| Importer | EU entity placing on the EU market a system carrying the name of a non-EU company | An EU subsidiary that brings a group's non-EU planning tool into the EU |
| Distributor | Makes a system available on the EU market without being provider or importer | A reseller that passes on a vendor's AI module without changing it |
Which role do fashion companies usually hold?
A company that licenses an AI feature inside its PLM, merchandising, e-commerce or CRM platform and uses it as delivered is normally a deployer. The software vendor is the provider. This covers most day-to-day cases: demand forecasting, automated product tagging, image generation tools, recommendation engines and customer service assistants supplied by a third party.
Roles are assessed per system, not per company. A brand can be a deployer of its forecasting engine and, at the same time, a provider of a styling assistant that it commissioned and launched under its own brand. Contracts help to allocate responsibilities, but they do not change how the Act classifies the roles.
When does a deployer become a provider?
Article 25 sets out three situations in which a distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system and takes on the provider's obligations under Article 16:
- Branding: it puts its name or trademark on a high-risk system that is already on the market or in service (contracts may still allocate obligations differently).
- Substantial modification: it makes a substantial modification to a high-risk system after it has been placed on the market or put into service, and the system remains high-risk.
- Change of intended purpose: it changes the intended purpose of a system that was not classified as high-risk, including a general-purpose AI system, so that it becomes high-risk.
The third case deserves attention. A general-purpose model used for copywriting is unlikely to be high-risk. The same model used to rank job applicants falls under the employment category of Annex III, and the company that redirects it may be treated as a provider of a high-risk system. Few fashion use cases are high-risk today, but human resources tools and some workforce management functions are among them.
What does each role have to do?
Obligations differ by role and by risk level. For high-risk systems, Article 26 asks deployers, among other things, to use the system according to the provider's instructions, assign human oversight to competent people, make sure input data under their control is relevant and sufficiently representative, monitor operation, keep the logs under their control for at least six months, and inform workers and their representatives before using such a system in the workplace. They must also inform people subject to certain decisions that a high-risk system is in use. Providers carry the heavier load of design, documentation and conformity duties under Article 16.
Some duties apply regardless of risk class. Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and others who operate AI systems on their behalf, taking into account their knowledge, experience and context. It does not require a guaranteed level of literacy for any individual. Article 50 transparency duties, such as telling people they are talking to a machine, also apply to systems outside the high-risk category, and the Act sets different duties for providers and deployers under that article.
| Topic | Provider | Deployer |
|---|---|---|
| AI literacy (Article 4) | Support staff literacy | Support staff literacy |
| Chatbot disclosure (Article 50(1)) | Design the system so people know it is a machine | Keep disclosure intact in the customer journey |
| Marking synthetic content (Article 50(2)) | Mark outputs in a machine-readable format | Not the primary duty |
| Deepfake disclosure (Article 50(4)) | Not the primary duty | Disclose artificially generated or manipulated content |
| High-risk oversight and logs (Article 26) | Provide instructions and design for oversight | Use as instructed, oversee, keep logs at least six months |
Does the AI Act apply to fashion companies outside the EU?
Yes, in defined cases. Article 2 covers providers placing AI systems on the EU market wherever they are established, deployers located in the EU, and providers and deployers in a third country where the output produced by the AI system is used in the Union. A non-EU brand that runs a personalisation or pricing system affecting EU customers should therefore assess its position rather than assume the Act is a European matter. The Act also leaves EU data protection law untouched, so GDPR duties continue alongside it.
How can a fashion company work out its role in practice?
A short inventory is the most practical step. For each AI system in use, record who built it, whose name it carries, whether it was adapted, and what it is intended to do. Then answer four questions in order:
- Did we develop this system or have it developed for us, and does it carry our name or brand?
- Have we substantially modified it since the supplier released it?
- Have we pointed it at a purpose different from the one the supplier intended, particularly in hiring or workforce management?
- Is its output used in the EU, whatever our location?
If the answer to the first three questions is no, the company is most likely a deployer. Any yes deserves a closer legal review. Procurement is the natural place to add this check, together with a request to suppliers for their intended-purpose statement, instructions for use and risk classification.
Frequently asked questions
Is a fashion brand that uses ChatGPT or a similar tool a provider?
Normally a deployer, because it uses a system built by someone else under its own authority. It could become a provider if it changes the intended purpose of a general-purpose system so that it becomes high-risk, or if it launches a system under its own name or trademark.
Can a contract make my supplier responsible instead of me?
A contract can allocate obligations between the parties, but the Act's definitions in Articles 3 and 25 decide who counts as provider or deployer. If you brand a high-risk system as your own, you are treated as its provider, although contracts may still allocate some duties differently.
Does the AI Act apply to a non-EU fashion company?
It can. Article 2 covers providers placing systems on the EU market wherever they are established, and providers and deployers in third countries where the output of the AI system is used in the Union.
What does AI literacy require from deployers?
Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and other persons operating AI systems for them, taking into account their knowledge, experience and context. It does not require guaranteeing a specific level of literacy for any individual.
One edition every weekday morning. Read in five minutes. Free for industry professionals.
SOURCES
- AI Act Service Desk (artificialintelligenceact.eu): Article 3, Definitions
- AI Act Service Desk (artificialintelligenceact.eu): Article 25, Responsibilities along the AI value chain
- AI Act Service Desk (artificialintelligenceact.eu): Article 26, Obligations of deployers of high-risk AI systems
- AI Act Service Desk (artificialintelligenceact.eu): Article 2, Scope
- AI Act Service Desk (artificialintelligenceact.eu): Article 4, AI literacy
