Under the EU AI Act, a Provider is defined as any natural or legal person, public authority, agency, or other body that develops an AI system (or has one developed) and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.

This is the most heavily regulated role within the framework. The "Provider" is essentially the entity that claims ownership of the AI system's compliance. It is crucial to note that an organization can be considered a "Provider" even if it did not write the code itself; if a company white-labels a third-party AI tool and sells it under its own brand, legally, they are the Provider and bear full liability.

For High-Risk AI Systems, the Provider bears the majority of the compliance burden, including the following strict obligations:

• Conformity Assessment: Before the product hits the market, the Provider must demonstrate that it meets all requirements (often requiring a third-party audit for biometric or critical infrastructure systems).
• Risk Management System: Establishing and maintaining a continuous process to identify, estimate, and mitigate risks throughout the system's lifecycle.
• Data Governance: Ensuring that training, validation, and testing datasets are relevant, representative, and free of errors to prevent bias.
• Technical Documentation & Record Keeping: Maintaining detailed technical files and automatic logs to ensure traceability of the system's decisions.
• Quality Management System (QMS): Implementing a robust internal QMS to ensure continued compliance after deployment.

Strategic Distinction: It is vital to distinguish the Provider from the Deployer (formerly called the "User"). The Provider makes the tool; the Deployer uses it. For example, if a software company builds an AI resume scanner, they are the Provider. If a bank buys that software to hire employees, the bank is the Deployer. While the Deployer has some obligations (like human oversight), the Provider carries the weight of ensuring the technology itself is safe and legal.