Eu AI Act Roles Oliver Schmidt Prietz

EU AI Act Role Determination

Determine the organization's role under the AI Act (Regulation (EU) 2024/1689) — provider (Anbieter), deployer (Betreiber), importer, distributor, or quasi-provider — and assess Art. 25 quasi-provider risk.

Disclaimer (show at session start, do not block)

Important: This skill provides structured AI Act role-determination guidance based on Regulation (EU) 2024/1689 and Commission value chain guidance. It is not legal advice. Final role determinations should involve qualified legal counsel with AI Act expertise.

When to Search the Web

On activation — search for:

EU AI Act Commission guidance provider deployer roles value chain [current year]
EU AI Act Art. 25 substantial modification guidance latest

For finetuning assessment — search for:

EU AI Act finetuning substantial modification technical standards [current year]
EU AI Act open source model modification provider status

For value chain obligations — search for:

EU AI Act provider deployer responsibility allocation guidance [current year]
EU AI Act Art. 25(2) original provider support duty interpretation

Workflow: Ask Questions ONE AT A TIME

Phase 1: Context Gathering (Adaptive Intake)

Prior Assessment Context (optional):

"If you have previously run another EU AI Act skill, you may paste the Assessment Context block here. This pre-fills several fields and avoids redundant input."

If context is provided, pre-populate applicable fields and skip to confirmation. If any field conflicts with user answers, flag the inconsistency.

Batch 1 — Open-ended question (single prompt):

"Let's determine your organization's role under the EU AI Act."

You can answer in your own words — a short paragraph or bullet points. I'll ask follow-up questions only if needed.

Describe your organization's relationship to this AI system: how you obtained it, what you do with it, whether you've modified it, and how it reaches users.

Coverage Analysis (internal — do not show this table to the user):

After the user responds, silently extract these 4 fields from their natural-language answer:

Apply generous extraction — e.g., "bought from US vendor" covers System acquisition (Purchased/licensed) + Market status (First placement) + potential Importer dimension. "We finetuned it and sell it under our brand" covers Modifications (Finetuning/retraining + Own brand) + Organizational relationship (Developing for others / Distributing).

Batch 2 — Adaptive follow-up (only if needed):

• If all 4 fields are clearly covered → skip Batch 2 entirely. Confirm extractions: "Based on your description, I've identified: [field summary]. Does this look correct?"
• If 1-2 fields are partially covered → confirm partial extractions: "You mentioned [X] — is this specifically [normalized value]?"
• If 2+ fields are missing → ask about gaps only: "A couple of details I still need: [specific missing fields]"
• Maximum 2 interaction turns for intake.

Information Normalization (internal):

Before proceeding to Phase 2, normalize all extracted information into the 4 structured fields above. If a field remains unclear after Batch 2, mark it as [UNCLEAR — proceeding with cautious assumptions] and note which assumption was made.

Phase 2: Primary Role Determination

Read references/role-definitions.md for full legal definitions.

Apply the decision tree through Art. 3(3)-(7):

ROLE DETERMINATION DECISION TREE

System acquisition + Organizational relationship → Role mapping:

Develops or commissions development + places on market/puts into service
  under own name/trademark?
  └─ YES → PROVIDER (Anbieter) — Art. 3(3)

Uses AI system under own authority in professional capacity?
  └─ YES → DEPLOYER (Betreiber) — Art. 3(4)

Imports AI system from third country to place on EU market?
  └─ YES → IMPORTER (Einführer) — Art. 3(6)

Makes AI system available on EU market (not as provider/importer)?
  └─ YES → DISTRIBUTOR (Händler) — Art. 3(7)

Integrates AI system into product as manufacturer?
  └─ YES → Product manufacturer — Art. 25(3), treated as PROVIDER

Multiple roles: An organization can hold multiple roles simultaneously (e.g., provider of one system and deployer of another). Assess each system separately.

Output after primary role determination:

"Based on your answers, your primary role appears to be [Role] under Art. 3([X]) AI Act. [Brief reasoning based on answers]"

Role Determination Visual Decision Tree

                ┌──────────────────────────────┐
                │ Did your org DEVELOP or       │
                │ COMMISSION the AI system?     │
                └──────────────┬───────────────┘
                               │
              ┌── YES ─────────┼─────────── NO ──┐
              │                                   │
              ▼                                   ▼
   ┌──────────────────┐              ┌──────────────────────┐
   │ Place on market / │              │ How does your org    │
   │ put into service  │              │ interact with the    │
   │ under OWN name?   │              │ system?              │
   └────────┬─────────┘              └──────────┬───────────┘
            │                                   │
     YES ───┤                    ┌──────────────┼──────────────┐
            ▼                    │              │              │
   ┌────────────────┐   Uses under      Imports from    Makes available
   │ PROVIDER       │   own authority   non-EU to EU    on EU market
   │ (Anbieter)     │        │              │              │
   │ Art. 3(3)      │        ▼              ▼              ▼
   └────────────────┘  ┌──────────┐  ┌──────────┐  ┌──────────┐
                       │ DEPLOYER │  │ IMPORTER │  │DISTRIBUTOR│
                       │(Betreiber)│  │(Einfuehrer)│ │(Haendler)│
                       │ Art. 3(4)│  │ Art. 3(6)│  │ Art. 3(7)│
                       └──────────┘  └──────────┘  └──────────┘

   Note: Product manufacturers integrating AI → Art. 25(3) → PROVIDER

For sector-specific role determination nuances, see references/sector-guidance-crossref.md. For worked role determination examples, see references/case-studies.md.

Phase 3: Quasi-Provider Risk Assessment (Art. 25)

Only proceed with this phase if:

1. The system is high-risk, AND
2. The user is not already classified as the original provider

Read references/quasi-provider-scenarios.md and references/substantial-modification.md.

"I will now assess whether your organization could be treated as a new provider under Art. 25 ('quasi-provider'). This applies when certain modifications or actions cause a deployer, distributor, or importer to assume provider obligations."

Scenario 1 — Own Name/Brand — Art. 25(1)(a):

"Have you put your own name, trademark, or brand on the AI system, or do you present it to end users under your own branding?"

If YES → quasi-provider under Art. 25(1)(a). Organization assumes full provider obligations.

Scenario 2 — Substantial Modification — Art. 25(1)(b):

"Have you made a substantial modification (wesentliche Veränderung) to the AI system?"

Read references/substantial-modification.md for the 3-step checklist.

Apply the 3-step determination:

Step 1: Identify the change

"What specific changes were made to the AI system? (technical parameters, data, architecture, deployment context)"

Step 2: Assess foreseeability

"Were these changes foreseen or covered in the original provider's conformity assessment or intended purpose documentation?"

Step 3: Evaluate risk impact

"Did the changes affect compliance with requirements in Chapter III, Section 2 (Art. 8-15), or did they alter the system's risk profile?"

If finetuning is involved → apply graduated assessment from references/finetuning-assessment.md: