Module 4: AI Regulation · BoK IV.C
The four regulated roles
Regulation distributes duties across the supply chain: a Provider builds the system, an Importer brings it in, a Distributor passes it on, and a Deployer puts it to work - but a deployer can become a provider by making a substantial modification to a high-risk system.
Regulation distributes duties across the supply chain. Definitions first, then who carries what.
Mnemonic - Producers Import, Distributors Deploy
The market chain → Provider builds it · Importer brings it in · Distributor passes it on · Deployer puts it to work.
| Role | Definition & responsibilities | Example |
|---|---|---|
| 🛠️ Provider | Develops and makes AI systems available on the market, directly or via a third party (sometimes called 'developers'). Most extensive obligations - they control design, testing and risk mitigation, with duties spanning the entire life cycle including post-market monitoring and transparency. | Tech company building an AI diagnostic tool; in South Korea a developer of high-impact AI must establish risk management and documentation before launch |
| 🏢 Deployer | The entity or professional user applying an AI system for a specific purpose. Responsible for safe, ethical use - transparency, fairness, human oversight, data protection, risk monitoring. | Hospital using the diagnostic tool to assist doctors; in Colorado (SB 24-205) a bank using AI for loan approvals must run an algorithmic impact assessment before deployment |
| 🛃 Importer | Brings an AI system into the domestic market from a third country → must verify compliance with local law before it reaches the market. Under the EU AI Act, importers must be located or established in the EU. | US company selling an AI financial tool in the EU needs a designated EU importer confirming compliance pre-deployment |
| 📦 Distributor | Any entity, other than the provider or importer, making AI available on the market → ensures conformity and proper handling in the supply chain before systems reach end users. | South Korean vendor reselling overseas AI is a distributor under the AI Basic Act → confirms high-impact compliance pre-market |
Exam flash - roles are not cleanly separated
A deployer can become a provider by making a substantial modification to a high-risk system, or by modifying a non-high-risk system in a way that makes it high risk. That switch brings the provider's full obligation set with it.
Key terms - quick answers
What is “Provider”?
Entity that develops and makes an AI system available on the market; carries the most extensive, whole-life-cycle obligations.
What is “Deployer”?
Entity or professional user applying an AI system for a specific purpose; responsible for safe, ethical use and monitoring.
What is “Importer”?
Entity bringing an AI system into the domestic market from a third country; under the EU Act must be established in the EU.
What is “Distributor”?
Any entity other than the provider or importer that makes AI available on the market through the supply chain.