Which transparency obligations under Article 50 of the AI Act apply to a particular legal entity depends on whether, within the framework of the AI Act, it acts as a provider, an implementer, or in both roles simultaneously. The link provides an explanation of who is a provider of an AI system, i.e. a legal entity that develops an AI system itself or commissions its development, and places it on the market or puts it into service under its own name or brand. Below is an explanation of how the UI Act defines an implementer and what transparency obligations apply to them. Examples of a provider simultaneously acting as an implementer and of borderline cases that arise in practice are also presented. The explanations are general in nature and are based on interpretations currently available at EU level. Furthermore, the explanations do not cover all possibilities or potential cases, as the role of an individual legal entity always depends on the circumstances of the specific development or use of the AI system.
Who is a controller? In accordance with Article 3(4) of the AI Act ,a controller is ‘a natural or legal person, a public authority, agency or other body that uses an AI system within its remit, except where the AI system is used in the context of a personal non-professional activity’.The Guidelines on the implementation of transparency obligations for certain AI systems under Article 50 of the AI Act (hereinafter: the Transparency Guidelines) clarify that ‘within its jurisdiction’ means assuming responsibility for the decision to introduce the system and for the manner of its actual use, including the input data.
The Guidelines on Prohibited Practices in Artificial Intelligence (hereinafter: the Guidelines on Prohibited Practices) further clarify that the ‘use’ of an AI system must be understood broadly. It covers use at any stage in the life cycle of an AI system after it has been placed on the market or put into service, including the integration of the AI system into the services and processes of the user, including as part of more complex systems, processes or infrastructure. In this regard, the implementer is responsible for complying with the conditions of use of the system. Any activity through which a natural person regularly derives economic benefit or is otherwise engaged in a business, commercial, professional or liberal activity is considered ‘professional ’.
Examples of implementers under the AI Act:
A legal entity whose employees, with the support of AI, prepare texts on matters of public interest and publish them online.
A legal entity that uses AI to generate deepfakes for an advert displayed in the EU.
A legal entity whose employees, acting on its instructions and under its supervision, use an AI system in the performance of their work tasks. In this context, the employees are not separate operators.
In accordance with points (b) and (c) of the first paragraph of Article 2 of the AI Act, operators are subject to the obligations set out in the third and fourth paragraphs of Article 50 , provided they are established or located in the EU; importers established in a third country are subject to these obligations where the system’s output data is used in the EU. The Transparency Guidelines clarify that importers from third countries are subject to these obligations where they themselves envisage the dissemination and use of content within the EU, for example by directing or authorising distribution within the EU, including the publication of deep fakes on the globally accessible internet. However, they are not obliged to do so where the content reaches an audience in the EU through channels that are unforeseeable and beyond their control.
To summarise, an AI system operator is a legal entity defined by the following criteria:
it uses the AI system, which encompasses use at any stage of the system’s life cycle, including the integration of the system into its own services and processes, and
they use the AI system within their sphere of responsibility, meaning they decide independently on the implementation of the system and on the purpose and manner of its use, including the input data (technical control over the system is not required), and
the system is used in the course of professional activities.
The definition of an implementer also applies to high-risk UI systems, for which Article 26 of the UI Act sets out additional obligations for implementers.
What follows from the application
Implementers must inform individuals exposed to systems for emotion recognition or biometric categorisation (third paragraph of Article 50; more here), and disclose deepfakes and texts published with the aim of informing the public about matters of public interest (fourth paragraph of Article 50; more here).
Concurrent role of provider and implementer
A legal entity may also act in both roles, that is, as both a provider and an implementer at the same time.As explained in the guidelines on prohibited practices, a legal entity that develops its own AI system and subsequently uses it itself is is simultaneously both the provider and the implementer of that system, even where the system is also used by other implementers to whom it has been made available, either for a fee or free of charge. In such a case, its obligations must be assessed from the perspective of both roles. The Transparency Guidelines illustratethis with the example of a legal entity that develops its own generative AI system and uses it to create deepfakes. Such a legal entity must:
as a provider, ensure that the output is labelled in a machine-readable format (second paragraph of Article 50) and
as a distributor, disclose that the content of the deepfake has been artificially created or manipulated (fourth paragraph of Article 50).
A machine-readable disclosure label does not constitute a substitute for disclosure, as the disclosure must be understandable to an individual without the need for specialised tools. However, simultaneous use does not mean that all the obligations under Article 50 automatically apply: for each one, it must be specifically verified whether the conditions for its application are met, and any exceptions must be taken into account.
Borderline cases: use, integration or modification of a system
When using a system already developed by another provider within the scope of the options provided by that provider (e.g. settings, integration into processes without modifications or additional components), the legal entity generally acts as an implementer. An example is a legal entity that uses another provider’s chatbot on its website. As a general rule, the obligations of an implementer apply to it; the notification obligation under the first paragraph of Article 50 is addressed to the service provider.
If an existingAIsystemfrom another provideris modified, for example with new training data, and the legal entity makes it available for use under its own name, it becomes the provider of the new system. In this context, the original provider’s responsibilities for the original system remain unchanged.
The guidelines do not specify precise boundaries between routine adaptation and the development of a new system; these must therefore be assessed on a case-by-case basis. Merely adapting a solution to the needs of a legal entity does not in itself determine the nature of that entity’s role. In making this assessment, particular importance is attached to the subject matter of the contract, the nature and scope of the adaptations, the name or brand under which the system is placed on the market or put into service, and the contractual and technical documentation. It is the factual circumstances that are decisive, not the designation of roles in the contract.
To define the role of a particular legal entity and, consequently, its obligations under Article 50, it is advisable to also read the explanatory note on the UI system provider.
