Deployers under the EU AI Act
A deployer is anyone who uses an AI system under their own authority in a professional capacity (Art. 3(4)). Almost every company that uses ChatGPT, Copilot or AI functions in its software is therefore a deployer and falls under the AI literacy obligation in Art. 4.
Who counts as a deployer under the EU AI Act?
A deployer is any natural or legal person, public authority, agency or other body that uses an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity (Art. 3(4)). As a rule, that is the company, not the individual employee: someone who works with an AI system on the employer’s instructions does not become a deployer themselves. Typical examples:
- A tax advisory firm has an AI writing assistant draft its client letters.
- A sales team uses the AI functions of its CRM.
- An HR department pre-sorts job applications with AI. From 2 December 2027, the high-risk obligations for deployers also apply here (Art. 26, Annex III).
Anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name is, by contrast, a provider (Art. 3(3)). A company can hold both roles at once. The roles are shown at a glance on the EU AI Act page.
Who needs training?
Art. 4 covers staff and other persons dealing with the operation and use of AI systems on the deployer’s behalf (Art. 4(1)). The law does not prescribe training, but it is the simplest measure. This means everyone who actually uses or looks after the AI systems:
- Full-time and part-time employees, casual workers, apprentices and working students.
- Freelancers and service providers who work with your AI systems on your behalf. As examples of these “other persons”, the Commission names contractors, service providers and clients (questions and answers on AI literacy).
- Temporary agency workers who work with your AI systems at your company under your instructions. This is not expressly regulated; because you know the systems and the context of use, you should take on the measures as the user company.
- Managers who decide on the use of AI.
For employees who do not work with AI systems, Art. 4 requires no measures. The measures depend on the knowledge, experience, education and context of use of the persons concerned; nobody has to guarantee a particular level of competence. More on the page AI literacy obligation under Art. 4.
How often does training need to be refreshed?
The EU AI Act sets no fixed deadline. A refresher makes sense when something significant changes:
- A new AI system or a new function is introduced.
- A person moves into a role with different AI use.
- The legal position changes, as on 27 July 2026 through the rewording of Art. 4 (Digital Omnibus).
The personal certificate from the AI-Konform training is valid for 1 year, and the expiry date is shown in the audit report. That way you can see when a refresher is due.
How do we prove the measures?
The law does not require a certificate. The Commission makes clear that an internal record of the training and other measures is enough. Record who completed which measure when and for which AI system. At AI-Konform this happens automatically: a personal certificate for each person and an audit report for the company, as CSV or PDF. More on the page EU AI Act training.
Frequently asked questions about deployers
Am I a provider if I build my own chatbot?
It depends on the case. Anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name is a provider (Art. 3(3)), even when it is used in-house. Anyone who simply uses a ready-made service with their own instructions generally remains a deployer. Both roles are possible at the same time.
Does the obligation also apply to casual and temporary staff?
Yes, if they use AI systems on your behalf. Art. 4 does not distinguish by working hours or type of contract, but by who deals with the operation and use of the AI systems.
What applies to private use of AI?
Anyone who uses AI purely personally and not professionally is not a deployer within the meaning of the Regulation, and the deployer obligations do not apply (Art. 3(4), Art. 2(10)). If employees use private AI accounts for work tasks, that is no longer purely personal use. Rules on this belong in an AI policy.
Train your team now Do we need an AI officer?
Note: this article is for general information only and does not constitute legal advice.