Deployer
A deployer is a natural or legal person, public authority, agency or other body that uses an AI system under its authority for professional/organisational purposes (excludes personal use).
How the laws define this
Global regulatory frameworks agree that a deployer is an entity or individual that puts an artificial intelligence system into operational use or integrates it into real-world services and workflows, assuming direct responsibility for risk management, human oversight, and monitoring. However, frameworks diverge significantly on who qualifies as a deployer and under what operational circumstances. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on Artificial Intelligence explicitly excludes personal non-professional activity, whereas An act relating to creating oversight and liability standards for developers and deployers of inherently dangerous artificial intelligence systems explicitly includes non-professional users. Scope also varies by organizational context: Colorado SB24-205 and the High-Risk Artificial Intelligence Developer and Deployer Act limit deployers to entities doing business in their states using high-risk systems, while Kentucky SB 4 restricts deployers strictly to state government agencies. Additionally, the Dubai DIFC AI and Emerging Technology Regulatory Sandbox equates deployers to data controllers.
Synthesised from the 43 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 42 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| European Union | Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) | In Force (Amended) | Excludes use of AI systems in personal non-professional activities, narrowing the scope from professional/organisational purposes. |
| Colorado, United States | Colorado SB24-205 — Consumer Protections for Artificial Intelligence Act | Repealed | Limits deployers to persons doing business in Colorado deploying high-risk AI systems, with explicit downstream obligations like impact assessments. |
| Kentucky, United States | Kentucky SB 4 — AI Governance Framework and Election Integrity Act | In Force | Restricts deployers to Kentucky state agencies or cabinets implementing or using AI, distinguishing from developers and requiring COT approval. |
| Montana, United States | Montana SB 212 - Right to Compute Act | In Force | Focuses on entities or individuals deploying AI within critical infrastructure facilities, emphasising safety and risk management accountability. |
| California, United States | California SB 503 — Health Care Services: Artificial Intelligence | Awaiting Entry | Limits deployers to health facilities, clinics, or physician offices using covered clinical decision support systems, requiring bias mitigation monitoring. |
| Slovakia | Act No. 318/2025 Coll., amending and supplementing Act No. 56/2018 Coll. on product conformity assessment (EU AI Act adaptation) | In Force | Adds responsibility for operation and monitoring of AI systems to the standard EU definition, in the context of product conformity assessment. |
| India | India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation | In Force | Includes responsibility for governance controls, documentation, risk assessments, and incident reporting in production or public use. |
| Qatar | Principles and Guidelines for Ethical Development and Deployment of Artificial Intelligence (MCIT) | In Force | Emphasises procurement decisions, deployment controls, and compliance with governance and safety measures during operation. |
| Saudi Arabia | AI Adoption Framework (SDAIA) | In Force | Specifies operationalizing AI in production environments with duties for controls, performance monitoring, and legal compliance. |
| Australia | AI Ethics Framework (Australia) / Australia’s AI Ethics Principles | Adopted | Covers organisations or individuals who implement, operate, procure, or configure AI systems, focusing on governance and mitigation during deployment. |
What it triggers
- In Colorado, deployers must conduct impact assessments, implement risk management programs, provide consumer disclosures, ensure human oversight, and retain documentation.source
- In Kentucky state government, deployers must conduct inventories, risk assessments, obtain COT approval, maintain registry entries, and ensure human oversight, non-discrimination, and data security.source
- In Montana critical infrastructure facilities, deployers must comply with safety and risk management mandates.source
- In California health care, deployers must monitor covered clinical decision support systems and mitigate known or foreseeable biased impacts.source
Definitions (44)
A person or organization that incorporates developed AI models into products, services or operational processes and makes decisions about intended uses, deployment contexts, mitigation measures and ongoing monitoring; held responsible for safe deployment and user-facing controls.
The natural or legal person, public authority, agency or other body that deploys or uses an AI system in the Union, distinct from the provider, and responsible for complying with certain operational obligations (e.g., ensuring appropriate use, human oversight, incident reporting and cooperating with market surveillance). Deployers have duties complementary to providers to ensure safe, lawful deployment and ongoing monitoring.
The natural or legal person, public authority, agency or other body that uses an AI system under its control, including integrating the system into products or services, and who must ensure compliant use, implement required transparency measures and fulfil certain operational obligations under the Regulation. Deployers have duties for safe operation, incident reporting and user-facing transparency where applicable.
Any person doing business in Colorado that deploys a high-risk AI system; deployers are responsible for downstream obligations including conducting impact assessments, implementing risk management programs, providing consumer disclosures, ensuring human oversight, and retaining documentation.
The natural or legal person who makes an AI system available to a third party or uses it within the Union; deployers are responsible for implementing human oversight measures, providing required information to users, and carrying out certain post‑market and monitoring duties under the Regulation.
A natural or legal person that places an AI system into service within the Union, distinct from the provider, and responsible for ensuring proper use, risk management and compliance during operation as specified by the AI Act and national rules.
A natural or legal person that uses an AI system under its authority, including integrating, operating or applying the system in a real-world context. Deployers have responsibilities for safe operation, human oversight, monitoring and ensuring compliance during use.
Those who integrate, configure, operate or place an AI system into service (including organisations procuring or deploying systems), responsible for ensuring operational controls, monitoring, and that the system is used in line with documented intended uses and safeguards.
A natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity.
The person or organisation that integrates or uses an AI system in a real-world context (e.g., within an enterprise or public body), responsible for conducting contextual risk assessments, implementing mitigation measures, and ensuring lawful and safe operation in line with guidance and regulatory obligations.
A deployer is an actor (typically a public body or enterprise) that integrates, configures, or uses an AI system within its operational context, thereby taking responsibility for its local deployment and compliance with applicable rules. The Strategy distinguishes deployers from providers (developers/suppliers) and assigns deployers obligations such as mapping AI use, identifying high-risk applications, and embedding procurement and oversight safeguards.
An entity (public or private) that integrates, configures, operates, or otherwise places an AI system into a specific operational context or service, bearing responsibility for context-specific risk assessments, mitigation measures, and compliance with deployment requirements.
Any state agency or cabinet entity that implements, operates, or uses an AI system within Kentucky state government; deployers are responsible for conducting inventories, risk assessments, obtaining COT approval, maintaining registry entries, and ensuring compliance with human oversight, non-discrimination, and data security requirements. The term distinguishes operational implementing entities from developers of AI tools.
An entity that integrates or operates an AI system within operational workflows or services (e.g., public agencies or firms), responsible for conducting AI Impact Assessments, incident reporting, and ensuring compliance with sectoral and NAIO requirements when deploying high‑risk systems.
The natural or legal person or entity that places an AI system into operation within the Union, responsible for following instructions for use, monitoring performance, post-market surveillance and notifying serious incidents where required.
Those who integrate a model into an application or service, responsible for contextual deployment decisions such as input filtering, user disclosures, monitoring, and implementing operational controls under shared-responsibility arrangements.
A firm or individual who decides to launch or use an AI System and determines the purposes and means of processing personal data through that System, equivalent to a 'Controller' under the DIFC Data Protection Law. The Deployer bears primary responsibility for compliance with Regulation 10 obligations applicable to decision‑makers.
Any natural or legal person, public authority, agency, or other body using an AI system under its authority; deployers are responsible for the operational use of AI systems and must comply with deployer-facing obligations such as enabling human oversight and following transparency requirements.
A person, public agency, or organization that integrates, configures, and makes an AI system operational in real-world contexts, taking responsibility for deployment decisions, operational settings, and ensuring compliance with impact assessments and procurement criteria set out in the Policy.
A natural or legal person, public authority, agency or other body that uses an AI system within the Union by making it operational in the course of its activities; deployers have duties related to safe use, human oversight, reporting and ensuring compliance during operation.
A person or organisation that operates an AI system in the EU (including making operational use of a system provided by others); deployers have duties under the Act such as ensuring appropriate classification, implementing required human‑oversight and transparency measures, and complying with applicable operational obligations regardless of where they are established.
The entity that uses an AI system in the course of its activities within the Union; responsible for obligations related to deployment, user information, post‑market monitoring and ensuring the system is used in accordance with its intended purpose.
The organisation that places an AI system into operation or makes it available to end users, responsible for procurement decisions, deployment controls, monitoring and ensuring compliance with recommended governance and safety measures.
The natural or legal person who places an AI system on the market or puts it into service and is responsible for its operation and use; deployers must follow provider instructions, implement organisational measures and human oversight, report serious incidents, and—where applicable—register uses, especially for public authorities.
The natural or legal person (other than the provider) who places an AI system into operation within the Union, assuming responsibilities for appropriate use, user information, human oversight and certain post‑market duties as set out in the Act.
Any entity or individual responsible for the operational deployment of an artificial intelligence system, particularly within a critical infrastructure facility. This term assigns accountability for compliance with safety and risk management mandates.
Any natural or legal person who uses an artificial intelligence system under its authority, whether in a professional or non-professional capacity. This includes end-users, organizations, and public authorities that integrate AI systems into their operations.
'Deployers' are those using an AI system under their authority.
The entity or person that uses or implements a covered automated decision-making technology to make, guide, or assist a consequential decision.
A 'deployer' is an entity that uses an AI system in a professional context, distinct from the provider who develops or places the system on the market. Deployers have specific obligations under the EU AI Act, particularly when using high-risk AI systems.
Any person or entity that uses or implements an artificial intelligence system in New York State.
An entity doing business in Colorado that deploys a high-risk AI system.
Any natural or legal person, public authority, agency, or other body that uses an AI system under its authority, responsible for its operation and monitoring.
A deployer is defined as a person doing business in Colorado that deploys a covered Automated Decision-Making Technology. Deployers bear primary responsibility for consumer interaction and compliance at the point of decision-making.
Any natural or legal person, public authority, agency, or other body using an AI system under its authority.
A person doing business in Colorado that deploys a covered automated decision-making technology.
An entity that implements or provides an AI system for making consequential decisions that affect consumers. Deployers are mandated to implement comprehensive risk management policies and conduct annual impact assessments to mitigate risks of algorithmic discrimination.
An organization doing business in Virginia that deploys or uses high-risk AI systems to make consequential decisions about Virginians in their individual or household capacities.
Organisations or operators that put AI systems into operational use, integrating models into products or services and operating them in real-world contexts. The interim response treats deployers as accountable parties for deployment, monitoring, incident reporting and remediation actions.
Organisations or individuals responsible for deploying AI systems into production or public use, including implementing governance controls, maintaining required documentation, conducting risk assessments, and participating in incident reporting mechanisms as outlined in the Guidelines.
Entities (public or private) that operationalize and place AI systems into production environments and are responsible for implementing operational controls, monitoring performance, and ensuring compliance with applicable laws and SDAIA guidance.
Organisations or individuals who implement, operate, procure or configure AI systems in real‑world settings; responsible for applying governance, oversight, and mitigation measures during deployment and operation.
Organisations that place AI systems into operational use and are responsible for their deployment, operation, oversight and risk management. Deployers must implement the governance, monitoring and incident‑response controls described in the Guidelines.
A health facility, clinic, physician’s office, or office of a group practice that uses a covered clinical decision support system. Deployers must monitor the system in operation and take reasonable and proportionate steps to mitigate known or reasonably foreseeable biased impacts.
Not to be confused with
Questions and answers
What obligations do deployers have under the EU AI Act?
Deployers must use AI systems under their authority except for personal non-professional activities and comply with operational obligations like monitoring.
Who counts as a deployer in Colorado high-risk AI laws?
Any person doing business in Colorado that deploys high-risk AI systems, responsible for impact assessments and risk management.
What are deployer duties for health care AI in California?
Health facilities or clinics using covered clinical decision support systems must monitor operations and mitigate biased impacts.
Related Terms
Provider
An entity (natural or legal person, public authority or body) that develops or commissions an AI system or general-purpose AI model and places it on the market or puts it into service under its name or trademark....
Operator
Any entity in the AI value chain with regulatory obligations....
Authorised Representative
EU-based entity mandated to represent non-EU AI providers....
Downstream Provider
Provider integrating AI models into their systems....
deployment
Operational adoption of AI in products, services, or administration....