EU AI Act Provider vs Deployer for HR AI

Quick answer

Provider vs Deployer for HR AI matters because EU AI Act evidence is split by role. A provider and deployer may look at the same HR AI system but have different duties.

Primary legal hook for this page: Regulation (EU) 2024/1689 Article 16 / Article 26 (Article 16 / Article 26).

Provider vs deployer

For HR AI, the vendor building or placing the system on the EU market is usually the provider, while the employer using it in recruitment or workforce decisions is usually the deployer. Both sides need evidence, but the provider and deployer obligations are not the same.

Provider evidence to prepare

• Maintain technical documentation and conformity evidence
• Run risk management, testing, logging, and post-market monitoring
• Provide instructions for use to deployers
• Register where required before EU market placement

Deployer evidence to prepare

• Use the system according to instructions
• Assign trained human oversight
• Monitor operation and keep logs where under their control
• Complete FRIA duties when Article 27 applies

Common contract questions

• Which party controls model updates and instructions for use?
• Who monitors post-market performance and incidents?
• Who keeps logs and can access them?
• Who completes a FRIA if the deployment context triggers Article 27?

Run the questionnaire

Use the questionnaire to classify the use case, identify the likely primary role, and generate source-cited evidence-prep drafts.

FAQ

Can a company be both provider and deployer? Yes. A company can carry both sets of obligations when it develops or substantially modifies a system and also uses it.

Does using a third-party HR AI tool remove deployer duties? No. Deployer duties can still apply, especially around use according to instructions, human oversight, monitoring, and FRIA where required.