"Who is the provider of your AI system?" — the provider question

Last updated: 28 July 2026 · By the Deal Rescue team · Not legal advice — a drafting guide for the question as it appears in vendor questionnaires.

This question looks administrative. It is not. It tests whether you know which role — and therefore which obligations — you hold under Regulation (EU) 2024/1689, the EU AI Act. It is also the easiest question to get wrong, because the intuitive answer ("OpenAI is the provider, we just use the API") is usually wrong for the system you actually sell.

Why buyers ask this

The AI Act assigns different transparency duties to different roles. Under Article 50, disclosing that a person is interacting with an AI system (50(1)) and machine-readable marking of synthetic content (50(2)) sit with the provider; the disclosure duties for emotion recognition (50(3)) and deepfakes (50(4)) sit with the deployer. Your buyer will be a deployer of your product, so before signing they need to know which duties you cover and which land on them. These obligations apply from 2 August 2026 and were not postponed by the Digital Omnibus. A vendor who cannot say who the provider is cannot say who owes what — and buyer legal teams read that as risk.

The rule that decides the answer: rebranding

Here is the part that is easy to miss. A company that places an AI system on the market under its own name or trademark — or substantially modifies it — takes on the provider role for that system. A SaaS product that integrates GPT, Claude or Gemini via API and ships the feature under its own brand is, for the purposes of Article 50(1), the provider of the resulting system. Your model supplier is your upstream provider — and typically a name on your subprocessor list — but it is not the provider of your product. The buyer is asking about your product.

The honest answer structure

Three moves: name your role for the system you sell, name your upstream supplier accurately, and map the split of duties between you and the customer.

Two drafting notes. First, 50(1) has a statutory exception where the AI interaction is obvious to a "reasonably well-informed, observant and circumspect" person — if you rely on it, say so explicitly; using the Act's own standard signals you know the terrain. Second, if your product generates audio, image, video or text content, address 50(2) marking separately: it has a transitional window until 2 December 2026 for systems already on the market, so state your current status and plan rather than a bare "compliant".

The mistake that costs deals

"The provider is OpenAI — we are only a user of their API." This is the #1 trap in AI questionnaires, and it fails three ways. It misstates your role under the rebranding rule — and a legal reviewer will catch it against your own marketing, since the feature ships under your brand. It assigns your transparency duties to a party who will not perform them for you. And once one legal claim in the document is wrong, every other answer gets re-read with suspicion. The mirror-image mistake also exists: claiming all Article 50 duties, including deployer duties (50(3)–(4)) only your customer can perform. The credible answer is the split, stated precisely.

Mini-FAQ

If our product runs on GPT or Claude, isn't OpenAI or Anthropic the provider?

Not for the system you sell. Placing it on the market under your own name or trademark puts the provider role — and the Article 50(1)–(2) duties — on you. Your model supplier remains your upstream provider, typically named on your subprocessor list.

Can our company be a provider and a deployer at the same time?

Yes, for different systems: provider of the product you sell, deployer of the AI tools you use internally. A strong answer maps each duty to the party that owes it.

When do these provider obligations start to apply?

Article 50 applies from 2 August 2026 — not postponed by the Digital Omnibus. The only grace period is 50(2) marking, until 2 December 2026 for systems already on the market. High-risk (Annex III) obligations run later, from 2 December 2027.

Not sure which duties your feature triggers? Run it through the free Article 50 checker (six questions, no email), read the full role map in who owes what under Article 50, or start from the method for the whole AI section. Questionnaire just landed? The first-24-hours playbook. Next in the series: the human-oversight question.