EU AI Act: Part 5 - Operators in the AI Value Chain & their Obligations for High-risk AI Systems and GPAI Models

The AI value chain consists of several crucial roles, each with specific responsibilities to guarantee the safe and efficient deployment of AI systems. The EU AI Act identifies and defines different operators in the AI value chain and stipulates obligations for these actors based on their responsibilities to ensure that AI systems are safe, compliant, and effective, adhering to regulatory requirements and standards.

Operators in the AI Value Chain

• Provider: a person or entity that develops or has an AI system developed and offers it on the market under their own name or trademark, whether for payment or free
• Authorised Representative: a person or entity in the Union with a written mandate from a provider to perform obligations and procedures on its behalf
• Deployer: a person or entity using an AI system under its authority, except for personal non-professional use
• Importer: a person or entity in the Union that markets an AI system from a third country
• Distributor: a person or entity in the supply chain, other than the provider or importer, that makes an AI system available in the Union market
• Manufacturer: a person or entity that places an AI system on the market or puts it into service with their product under their own name or trademark

Obligations of Operators in the AI Value Chain

The EU AI Act stipulates obligations for operators based on whether the AI system is single-purpose or general-purpose, the risk levels, the operators' locations, and their roles.

The eBook below highlights a detailed summary of crucial obligations.

Obligation highlights

Providers of high-risk AI systems must fulfil specific high-risk system requirements in addition to administrative and incident reporting obligations outlined in the EU AI Act. These system-specific requirements include, but are not limited to,

• Risk management Systems
• Data and Data Governance
• Technical documentation
• Transparency
• Provision of information to deployers
• Human oversight, Accuracy, Robustness and Cyber security

Similarly, Deployers of high-risk AI systems have specific compliance obligations in addition to administrative and reporting requirements, including but not limited to

• Perform Fundamental rights impact assessment and Comply with Data Protection Impact Assessment
• Assign human oversight with competent, training and authority personnel
• Ensure input data is relevant and representative for the intended purpose
• Monitor operations and report incidents to the provider first, the importer or distributor and then the relevant authorities
• Deployers, who are employers, should inform workers about the use of high-risk systems
• Inform the natural person if high-risk AI systems are used in decision-making

The EU AI Act emphasises the significance of human oversight and data requirements in its obligations for Providers and Deployers.

You will also find details of obligations related to Providers and Authorised representatives of GPAI systems in the eBook.

Non-compliance of the operators in the AI value chain for both Single purpose and GPAI systems carry significant penalties as outlined in the eBook.

Reference:

EU AI Act

EU AI Office

Relevant articles:

EU AI Act: Part 1 - A Brief Overview

EU AI Act: Part 2 - How are AI systems defined?

EU AI Act: Part 3 - Risk-based Classification & Compliance of AI System

EU AI Act: Part 4 - Governance, Implementation & Enforcement

Disclaimer: This article is intended solely for educational purposes and should not be taken as legal advice