Glossary › Regulation and law

deployer (of an AI system)

The deployer is the company, authority, or professional that uses an AI system on its own responsibility during its work – it did not develop it but deploys it.

In plain terms

The EU Artificial Intelligence Act (AI Act) assigns roles, and each comes with different obligations. The deployer is the one who puts the finished AI system to work: the bank that uses credit-scoring software, the hospital that uses a program to evaluate medical test results, or the company that screens résumés with AI.

It is like with cars. The manufacturer is responsible for the car being safe. The transport company, however, is responsible for having a trained driver, using the vehicle as intended, and stopping if something goes wrong. In AI, the manufacturer is the 'provider', and the transport company is the 'deployer'.

The concept is important because most Hungarian companies and institutions do not develop AI but use it. They are therefore typically subject to the rules for deployers. If you use a chatbot purely for private purposes at home, you are not a deployer under the regulation.

How it works

1. First, it must be clarified whether the organization uses the AI system within its own scope of responsibility for professional activities. If yes, it counts as a deployer, even if the system was purchased ready-made or subscribed to.
2. Every deployer must ensure that its staff who handle AI have adequate knowledge. This is called AI literacy.
3. If the system is high-risk (for example, one that supports hiring, credit scoring, education or public-authority decisions), more is required. It must be operated according to the instructions for use, a competent person must be designated to oversee it, its operation must be monitored, and logs must be kept for at least six months.
4. Affected individuals must be informed. Employees must know in advance if high-risk AI is being introduced at their workplace, as must those about whom decisions are made using such systems. Image, audio, and video recordings (deepfakes) that appear real but are AI-generated or manipulated must be labeled as artificially created.
5. The role can also flip. If a deployer offers an already marketed high-risk system under its own name or trademark, substantially transforms such a system, or changes the system's purpose so that it becomes high-risk, from that point on it counts as the system's provider, with all associated burdens.

An everyday example

Who is affected

A common misconception

Limits and risks

• In practice, the boundary between roles is not always sharp: with a heavily customized system or one offered under your own brand name, it may be disputed whether you are still a deployer or already a provider.
• Deployer status does not replace the other rules: data protection (GDPR), labor law and consumer protection requirements all continue to apply.
• The strictest obligations apply only to high-risk systems, so the system's risk classification must always be clarified first.
• Deadlines and detailed rules are still subject to change, so it is worth following the latest official text and regulatory guidance.

Similar, but not the same

• provider (AI system provider) – The provider develops the system or has it developed and places it on the market under its own name, while the deployer uses the finished system in its own activities.
• user – In the common sense, a user can be anyone using AI, while the deployer is a legal role that does not include personal use.
• data subject – The affected person is the one about whom a decision is made using AI (for example, a loan applicant), while the deployer is the one who uses the system for that decision.

Related concepts

A brief history

The European Commission's 2021 draft regulation still referred to this role as the "user". During the legislative process, the term was replaced with "deployer", and it was included in the AI Act adopted in 2024, which entered into force on 1 August 2024; its official Hungarian text translates it as "alkalmazó" (deployer).

Where things stand

The AI literacy obligation has been in force since February 2025, and the transparency rules (such as deepfake labeling) apply from August 2, 2026. The deployer obligations for high-risk systems were originally also due to start in August 2026, but the EU simplification package (the digital omnibus) postponed them: to December 2, 2027 for standalone high-risk systems (such as recruitment and credit scoring), and to August 2, 2028 for systems embedded in products. As a result, most companies are still preparing at the end of 2026.

Status: 2026 November

In the news

• Claude Code leaked users' email addresses in web search headers; Anthropic deployed a privacy fixNov 6, 2026 · Jog
• European partnership supports AI adoption among Hungarian small businesses; two-thirds of users also use personal devicesNov 5, 2026 · Marketing
• Apple, Microsoft and Meta tighten internal AI usage limitsNov 5, 2026 · Code
• Bug report alleges Claude Code writes user's email address into User-Agent headerNov 5, 2026 · Code
• Anthropic adds personal finance feature to Claude, with bank account connectionNov 5, 2026 · Money
• Survey: four in five industrial players face skills shortages; two-thirds of AI users also use personal devicesNov 4, 2026 · Ipar
• Regular AI users work more: mental load and time spent fixing "AI slop" riseNov 3, 2026 · Work & HR
• Zalando launches AI shopping agent that can also buy from other retailersNov 3, 2026 · Marketing

Also known as

deployer · AI system deployer · AI system deployer · deployer · AI deployer · deployer of an AI system · user

Sources

• Artificial Intelligence Act – Wikipedia

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.