AI Governance: Which Corporate Roles Should Be Involved According to the AI Act

01

The short answer

The AI Act distinguishes precise roles: the provider that develops or places an AI system on the market, the deployer that uses it under its own authority, and the possible authorised representative in the Union. Added to this is a framework of responsibility that assigns tasks to leadership and other staff, and an obligation of AI literacy for those who operate the systems.

02

Why these distinctions matter

The provider is whoever develops the system or has it developed and places it on the market under its own name; the deployer is whoever uses it under its own authority, except for non-professional personal use. The authorised representative is a person in the Union who has received a written mandate from the provider to carry out obligations on its behalf. Knowing which role the company occupies determines which obligations apply.

03

How to assign roles step by step

Steps

1. Check whether the company develops an AI system or uses it under its own authority.
2. Define a framework of responsibility that assigns tasks to leadership and staff.
3. Identify who manages the systems and procedures for data used by the AI system.
4. Ensure a sufficient level of AI literacy for those who operate the systems.
5. Set up communication channels with competent authorities in case of an incident.

04

A hypothetical case

Hypothetical example: an SME uses an AI system for preliminary screening of candidates. In this case the company acts as deployer, since it uses the system under its own authority. HR management should receive sufficient training on how the system works, while leadership defines who is accountable for decisions made with its support.

05

Verification checklist

• Is it clear whether the company is a provider, a deployer, or both for each AI system?
• Is there a framework of responsibility naming who is accountable for each aspect?
• Do staff operating the systems have a sufficient level of AI literacy?
• Are procedures for data management and record retention defined?
• Is it clear who manages communication with competent authorities in case of an incident?

06

What a company can set up with the support of a software partner

A company can ask its software partner to help maintain an inventory of the AI systems it uses, indicating who is provider or deployer for each, who is part of the responsibility framework, and who has received sufficient training. These elements remain operational choices of the company, not guaranteed features, but a good traceability setup helps keep assigned roles consistent with activities actually carried out.

07

Frequently asked questions about roles

The deployer is not automatically the provider: it depends on who develops and places the system on the market versus who uses it under its own authority.

The framework of responsibility does not concern only leadership: it also defines the tasks of other staff involved in managing the AI system.

AI literacy is required to the extent possible and takes into account the knowledge, experience and training already present among staff.

08

Next step

Before adopting a new AI system, map the corporate roles involved and assign a clear framework of responsibility: this is the basis for every subsequent check.