Which transparency obligations under Article 50 of the UI Act apply to a particular legal entity depends on whether, within the framework of the UI Act, it acts as a provider, an implementer, or in both roles simultaneously.
The Agency will outline both roles in two consecutive publications. In this one, it explains how the UI Act defines a provider, in which cases a legal entity is considered a provider, and which transparency obligations apply to it. In the next news item, it will outline the role of the implementer, examples of concurrent roles as provider and implementer, and borderline cases that arise in practice. The explanations are general in nature and are based on the interpretations currently available at EU level. Nor do the explanations cover all possibilities or potential cases, as the role of an individual legal entity always depends on the circumstances of the specific development or application of the UI system.
Who is a provider? In accordance with Article 3(3) of the AI Act ,a provider is ‘a natural or legal person, a public authority, agency or other body that develops a general-purpose AI system or AI model, or has developed a general-purpose AI system or AI model and places it on the market or makes the AI system available under its own name or trade mark, whether for a fee or free of charge’. The definition covers all types of legal entities, from companies and sole traders to public authorities; therefore , the collective term ‘legal entity’ is used hereafter .
A provider is defined by two conditions: the legal entity (1) develops the AI system itself or commissions its development, and (2) places it on the market or makes it available for use under its own name or trade mark. It is therefore not decisive whether the provider has technically developed the system itself; the provider may also be a legal entity that commissions the development from an external contractor. However, commissioning the development must be distinguished from obtaining access to a system already developed by another provider, for example through a licence or a service subscription.
In accordance with points 9 and 10 of Article 3 of the AI Act, ‘placing on the market’ means that the AI system is made available on the EU market for the first time, that is to say, that it is supplied for distribution or use on the EU market in the course of a commercial activity, whether for a fee or free of charge. These definitions also apply to general-purpose AI models; however, the transparency obligations set out in Article 50 relate to AI systems, and the Agency therefore focuses in this text on providers of AI systems. In relation to the subject matter under consideration, the Guidelines on Prohibited Practices in Artificial Intelligence (hereinafter: the Guidelines on Prohibited Practices) clarify that the method of delivery of the AI system is irrelevant in this context: an AI system may be made available via an application programming interface (API), in the cloud, by direct download, as a physical copy or embedded in a product. Since, in accordance with Article 3(11), ‘making available’ also covers the supply of a system for one’s own use, the provider may also be a legal entity that develops the system exclusively for its own needs. As explained in the Guidelines on Prohibited Practices, ‘making available’ covers both the supply of a system to third parties for first-time use and the development and implementation of a system within an organisation.
Under the AI Act, providers with their registered office or place of business outside the EU are also considered to be providers; and, in accordance with point (c) of the first paragraph of Article 2 of the AI Act, they are subject to the obligations set out therein whenever the output of their AI system is used in the EU. The Guidelines on the implementation of transparency obligations for certain AI systems under Article 50 of the AI Act (hereinafter: the Transparency Guidelines) clarify what applies to a third-country provider who does not place their interactive or generative AI system on the market or make it available for use in the EU. In the case of such a provider, merely incidental, unforeseeable or unauthorised further use of output data within the EU should not, in itself, trigger transparency obligations. However, this provision is without prejudice to the powers of market surveillance authorities to consider such output data to be non-compliant with the AI Act.
Examples of providers under the AI Act:
A legal entity that places a chatbot, image generator or AI agent on the EU market under its own name or brand.
A legal entity that develops a chatbot internally and makes it available for its own use under its own name. As it also uses the system itself, it is simultaneously a deployer.
Other examples where a legal entity is considered a provider of an AI system
A provider of an AI system (including a general-purpose AI system) may also be a legal entity which, pursuant to point 68 of Article 3, incorporates an AI model into its system, regardless of whether it offers the model itself and is vertically integrated, or whether it is offered by another legal entity on the basis of contractual arrangements. An AI model is not, in itself, an AI system; to become one, other components must be added to it, such as a user interface. A legal entity that incorporates another provider’s model into its own UI system and places it on the market or puts it into service under its own name is therefore a system provider, even though it did not develop the model itself.
Examples:
A legal entity develops a chatbot for customer support based on a general-purpose UI model accessed via a programming interface (API), and offers it to other companies under its own brand.
A legal entity further trains a model with open weights and integrates it into an image-generation tool, which it places on the market under its own brand.
To summarise, a UI system provider is a legal entity defined by the following criteria:
- it develops the UI system itself or commissions its development (‘has developed’ the UI system), and
- it places the UI system on the market or puts it into service, which also includes supplying the system for its own use, and
- it does so under its own name or brand, whether for a fee or free of charge.
Specific features of providers of high-risk UI systems
The definition of a provider set out in Article 3 also applies to high-risk AI systems. Furthermore, the AI Act stipulates in the first paragraph of Article 25 that a distributor, importer, introducer or other third party shall, for the purposes of the Medical Devices Act, be deemed to be a supplier of a high-risk medical device system and shall be subject to the obligations of a supplier set out in Article 16, if:
they label a high-risk UI system that has already been placed on the market or put into service with their name or trade mark, without prejudice to contractual arrangements stipulating that obligations are allocated otherwise;
it substantially modifies a high-risk UI system that has already been placed on the market or put into service in such a way that it remains a high-risk UI system;
change the intended purpose of an AI system, including a general-purpose AI system that has not been classified as high-risk, so that it becomes a high-risk AI system. This may occur, for example, when a legal entity uses a general-purpose chatbot to analyse and filter job applications.
In such cases, the provider who originally placed the system on the market or put it into service shall, in accordance with the second paragraph of Article 25, no longer be considered the provider for that particular system. They must cooperate closely with the new provider and provide them with the necessary information, technical documentation and technical access, unless they have explicitly stated that their system must not be converted into a high-risk AI system.
What follows from the application
Providers must ensure that AI systems intended for direct interaction with natural persons are designed in such a way that persons are made aware of their interaction with the AI system (first paragraph of Article 50; see the news item here), and that synthetic content generated by their systems is labelled in a machine-readable format and identifiable as artificially generated or manipulated (second paragraph of Article 50; more in the news item here).
