In the EU AI Act, the role question decides more than the risk class, and almost nobody asks it. In the meetings we sit in, the conversation is about traffic-light colours: are we high risk, limited, minimal? That answer is of little use to you while the line before it is still open. That line sits in Article 3, and it sorts you into one of two lists of obligations that differ in length and in cost.
What the EU AI Act regulates, when each part applies and how the risk levels are meant to work is in our overview. This piece is about the question that comes first.
Provider or deployer: the difference in one sentence
Under Article 3(3), a provider is anyone who develops an AI system, or has it developed, and places it on the market under their own name or trademark. Under number 4, a deployer is anyone who uses an AI system under their own authority, outside a purely personal activity. If you buy and use ChatGPT, Copilot or an industry tool, you are a deployer.
That reads like a definition you skip. It is the junction, though. It decides whether Article 26 applies to you or Article 16, and between those two lists lies the difference between a policy and a project.
What the Act asks of a deployer
Article 26 is titled "Obligations of deployers of high-risk AI systems". Every line in it assumes the system is high risk. For an SME running text generators, meeting notes and Copilot in the office, this article does not apply. Anyone who has been working towards a large compliance programme reads that with mixed feelings.
What remains is short. Under Article 4, providers and deployers have to take measures to support the AI literacy of their staff, and that has applied since 2 February 2025 (we have broken down this AI training requirement separately). On top of that come the transparency obligations in Article 50, applicable since 2 August 2026: deployers of emotion recognition inform the people affected, and deployers who generate deepfakes disclose that the content is artificially generated. If you run an assistant in customer contact, the detailed line is drawn there.
That is the honest balance for most Swiss companies. The Act asks remarkably little of an ordinary deployer. The longer list comes from somewhere else, from the Swiss Data Protection Act and from your contract with the provider.
It looks different when a deployer does run a high-risk system. Then Article 26 requires technical and organisational measures in line with the instructions for use, and human oversight by people who have the necessary competence, training, authority and support. Added to that is keeping the automatically generated logs for at least six months. And, where the system is used at the workplace, informing workers' representatives and the affected employees before it is put into service. That is real operational work, but it is still not a conformity assessment.
Three cases turn a deployer into a provider
The line that appears in almost no AI policy is Article 25. Its first paragraph opens like this: distributors, importers, deployers or other third parties are considered providers of a high-risk AI system for the purposes of the Regulation, and are subject to the provider obligations under Article 16, in the following cases. Three cases follow.
The first: when they put their name or trademark on a high-risk system that has already been placed on the market. This is the case that happens most quietly in practice. A supplier delivers a white-labelled tool, marketing puts the company logo on it, and a purchase turns into your own market participation.
The second: when they make a substantial modification to such a system that was not foreseen or planned in the provider's original conformity assessment.
The third is the one that is most likely to happen in daily work: when they modify the intended purpose of an AI system, including a general-purpose AI system, that has not been classified as high risk and has already been placed on the market or put into service, in such a way that it becomes a high-risk AI system within the meaning of Article 6. In plain words: you take an ordinary tool and give it a task the Act classes as high risk.
Annex III, point 4(a), names AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates. Take a fiduciary firm with 40 people that advertises two positions and receives 90 applications. The HR lead builds a prompt in the company chatbot that sorts the applications by her criteria and adds a recommendation. With that, the intended purpose has been modified in exactly the way Article 25 describes. She started no project, filed no request and asked nobody, because it looked like saving time and not like a change of role.
What lands on the table afterwards
A change of role brings a new list of obligations. Article 16 requires the provider of a high-risk system to have, among other things, a quality management system under Article 17, the documentation under Article 18, the logs kept under Article 19, the conformity assessment procedure under Article 43 before placing the system on the market, an EU declaration of conformity under Article 47, the CE marking under Article 48 and the registration under Article 49(1).
Two points tend to get lost in the discussion. Under Article 25(2), the original provider stops being the provider of that system at that moment. It has to cooperate, hand over information and grant technical access, but the role sits with you. And Article 25(4) requires a written agreement on the information, capabilities, technical access and other assistance needed so that the provider can meet its obligations. Anyone operating between buying and building rarely gets that agreement after the fact in the shape they would need.
Our work in AI governance and secure AI adoption sits exactly at that seam. We record which role the company holds for which tool, and who checks that before somebody rebuilds something.
Does the EU AI Act apply to a Swiss SME at all?
The Act sets its scope in Article 2(1). It covers providers who place AI systems on the market or put them into service in the Union, regardless of where they are established. It covers deployers established in the Union. And it covers providers and deployers established in a third country where the output produced by the system is used in the Union. A Swiss company whose AI output lands with customers, applicants or employees in the EU is in scope.
For everyone else, the Act is a preparation task today. Switzerland has no AI law of its own. On 12 February 2025, the Federal Council decided on its own route: ratify the Council of Europe's AI Convention and adjust Swiss law selectively. The Federal Office of Justice is drafting the consultation proposal by the end of 2026, aimed at transparency, data protection, non-discrimination and oversight. BAKOM states that the consultation is scheduled for spring 2027. Until then, the binding Swiss law for AI is the Data Protection Act, and it does not ask about provider or deployer, it asks about controller and processor. The two pairs of roles are not the same thing, and an SME with EU business needs both answers.
Where the fines hang, and where they do not
Article 99(4) lists the obligations that carry the bracket of up to EUR 15 million or 3% of worldwide annual turnover: obligations of providers under Article 16, of authorised representatives under Article 22, of importers under Article 23, of distributors under Article 24, of operators under Article 25(2) and (4), of deployers under Article 26, and the transparency obligations under Article 50. The prohibited practices in Article 5 sit above that, at up to EUR 35 million or 7%.
Article 4, AI literacy, does not appear in that list. That does not make the duty free of charge, because under paragraph 1 the Member States lay down the rules on penalties themselves, taking into account the interests of SMEs, including start-ups, and their economic viability. The large numbers, though, are not decided by training. They are decided by the role. And under paragraph 6, for SMEs including start-ups, the lower of the two amounts applies in each case. That takes away the drama the topic tends to be given in the market, and leaves the actual question standing.
If you want to sort the roles for your tools once, properly, without turning it into a year-long project, that is what the free initial conversation is for: get in touch. How we support AI in day-to-day operations is on our AI consulting page.
The role is already set, even if it is written down nowhere
You do not need to know the EU AI Act by heart. You need a list of your AI tools with one column next to it, and in our experience that column is exactly what is missing from the inventories we record in our mandates: bought and used unchanged, or adapted, repurposed, passed on under your own name. The first column is deployer and stays that way. The second one leads to Article 25, and it does not get filled in at management level, it gets filled in by people who wanted to solve a problem quickly.
Who in your company has, in the past twelve months, rebuilt or passed on an AI tool in a way that changed the role, without anyone asking about it?
Frequently asked questions
Are we a provider or a deployer under the EU AI Act?
Anyone who buys an AI system and uses it in their own operations is a deployer under Article 3(4). A provider, under number 3, is anyone who develops a system, or has it developed, and places it on the market under their own name or trademark. That makes most Swiss SMEs deployers.
When does a deployer become a provider?
Article 25 names three cases: when you put your name or trademark on a high-risk system, when you make a substantial modification to it, or when you change the intended purpose of a system so that it becomes high risk under Article 6. From then on, the provider obligations in Article 16 apply to you.
What does a deployer of an ordinary AI tool owe?
Article 26 applies to high-risk systems only. For ordinary tools, what remains is AI literacy under Article 4, applicable since 2 February 2025, and the transparency obligations under Article 50 since 2 August 2026. In Switzerland the longer list of duties comes from the Data Protection Act and from your contract.
