Certified: The IAPP AIGP Audio Course

In this episode, we are taking a step back from individual controls and looking at the people and organizations the law actually expects to act. That matters because the European Union (E U) Artificial Intelligence Act (A I Act) does not treat everyone in the value chain the same way, even when they touch the very same Artificial Intelligence (A I) system. The law uses a broad label called operator, but inside that umbrella it separates providers, deployers, importers, and distributors, and then attaches different duties, different moments of responsibility, and different enforcement exposure to each of them. For a new learner, this is one of the best places to slow down and get precise, because many real misunderstandings begin when people assume the builder and the user have the same legal job, or when they confuse the company that brings a system into the Union with the company that merely resells it. Once you hear how the roles divide up, the enforcement and penalty structure starts to feel much more logical instead of random.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

The easiest way to begin is with the basic definitions, because the law is using these words very intentionally. A provider is the person or organization that develops an A I system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer is the person or organization using an A I system under its authority, which means this is the role closest to actual day-to-day use in a real setting. An importer is a person or organization located in the Union that places on the market an A I system bearing the name or trademark of a person or organization established in a third country, while a distributor is a supply-chain actor other than the provider or importer that makes an A I system available on the Union market. The law then groups these and related actors under the broader term operator, which is important because enforcement and penalties are often written to apply to operators even though the underlying duties differ by role.

The provider carries the heaviest front-end burden, especially for high-risk A I systems, because the provider is the actor expected to prove that the system was built and prepared for lawful use before it enters real circulation. Article 16 requires providers to ensure compliance with the high-risk requirements, put a quality management system in place, keep documentation, keep logs when under their control, run the relevant conformity assessment, draw up the E U declaration of conformity, affix the C E marking, meet registration obligations, take corrective actions when needed, demonstrate conformity to authorities upon reasoned request, and ensure accessibility compliance where applicable. A beginner should hear this as the law saying that the provider must create the evidence trail and the compliance architecture rather than assuming someone else will sort it out later. If you imagine a high-risk hiring tool, medical support tool, or education scoring system, the provider is the actor that has to show the system was prepared responsibly before it reaches actual users. That is why provider duties are broader, deeper, and more documentation-heavy than the duties of the downstream roles.

Provider responsibility also continues after launch, which is another reason this role stands apart from the others. Providers of high-risk systems must establish and document a post-market monitoring system that actively and systematically collects, documents, and analyzes relevant data on performance and ongoing compliance over the lifetime of the system, and the post-market monitoring plan must form part of the technical documentation. When a serious incident occurs, providers must report it to the relevant market surveillance authority, generally within 15 days after establishing a causal link or a reasonable likelihood of one, with faster deadlines for widespread infringements and deaths, and then investigate the incident, assess the risk, and take corrective action. Article 20 also says that when providers consider or have reason to consider that a high-risk system is not in conformity, they must immediately take corrective action, withdraw it, disable it, or recall it as appropriate, and inform distributors, deployers, importers, and authorities. That means the provider is not just the builder at the beginning of the story. The provider is also the main compliance steward when things go wrong after the system is already in use.

Importers play a different role, and a useful beginner picture is to think of them as entry-point gatekeepers for high-risk systems coming from outside the Union. Before placing such a system on the market, importers must verify that the provider completed the conformity assessment, drew up the technical documentation, attached the required C E marking, included the E U declaration of conformity and instructions for use, and appointed an authorized representative where required. If the importer has sufficient reason to think the system is not compliant, is falsified, or comes with falsified documentation, the importer must not place it on the market, and if the system also presents a risk, the importer must inform the provider, the authorized representative, and market surveillance authorities. Importers must also put their contact details on the system, packaging, or accompanying documentation, preserve key records for ten years after placement on the market or putting into service, provide documentation to authorities upon reasoned request, and cooperate with authorities in actions taken to reduce or mitigate risk. This makes importers far more than logistics firms. In legal terms, they are control points that stand between a third-country provider and the Union market.

Distributors sit further along the supply chain, and their obligations are narrower than the provider’s and somewhat lighter than the importer’s, but they are still very real. Before making a high-risk system available on the market, distributors must verify that the system bears the required C E marking, that it is accompanied by a copy of the E U declaration of conformity and instructions for use, and that the provider and importer have met certain basic identification duties. If a distributor has reason to think a system is not compliant, it must not make the system available until conformity is restored, and if the system presents a risk, the distributor must inform the provider or importer. While the system is under its responsibility, the distributor must also ensure storage and transport conditions do not jeopardize compliance, and if it later concludes that a system it already made available is not compliant, it must take corrective action itself or ensure the provider, importer, or another relevant operator does so. So the distributor is not expected to recreate the provider’s entire compliance file, but it is expected to notice visible problems, stop unsafe circulation, and become part of the correction chain rather than pretending it is only a passive reseller.

Deployers occupy the part of the chain most connected to real-world use, which is why their duties focus less on pre-market proof and more on responsible operation. Article 26 says deployers of high-risk A I systems must take appropriate technical and organizational measures to use the systems in accordance with the instructions for use, assign human oversight to people with the necessary competence, training, authority, and support, and ensure that input data is relevant and sufficiently representative where the deployer controls that data. Deployers must monitor the operation of the system based on the instructions for use, and if they have reason to consider that use in line with those instructions may still make the system present a risk, they must inform the provider or distributor and the relevant market surveillance authority without undue delay and suspend use of the system. Deployers must also keep automatically generated logs under their control for a period appropriate to the intended purpose and at least six months unless another law says otherwise. This role is about governing actual use, which is why the deployer is often the first actor to see the difference between the system on paper and the system in practice.

Some deployers also face extra duties that do not fall on everyone equally, which is another reason students should avoid treating the deployer role as a single simple category. Public authorities deploying high-risk systems must comply with registration duties and, if they find that a system they intend to use has not been registered in the E U database where required, they must not use it and must inform the provider or distributor. The same article also says deployers must notify workers’ representatives and the affected workers when a high-risk system is used in the workplace, which shows that real use can trigger governance duties toward people exposed to the system, not just toward regulators. In addition, Article 27 requires certain public bodies, private entities providing public services, and certain deployers in areas listed in Annex III to perform a fundamental-rights impact assessment before first use, describing the process of use, affected groups, likely harms, oversight arrangements, and mitigation measures, and then notify the market surveillance authority of the results. So the deployer role is not just press the button and use the tool. In many settings, it is the role where organizational accountability becomes visible to the people who may actually feel the system’s effects.

One of the most important comparison points is that these roles are not permanently fixed, because the law can move an actor from one bucket to another if that actor changes what it is doing. Article 25 says that a distributor, importer, deployer, or other third party becomes a provider of a high-risk A I system if it puts its own name or trademark on a system already placed on the market or put into service, makes a substantial modification to the system so it remains high-risk, or changes the intended purpose of a system in a way that causes it to become high-risk. Once that happens, the original provider is no longer treated as the provider of that specific system for purposes of the Regulation, though the original provider must closely cooperate with the new provider and make necessary information and reasonably expected technical access available for compliance work. This is a major exam concept because it shows that responsibility follows control and transformation, not just the label a company prefers to use. A deployer that materially changes a system may no longer be just a user in the eyes of the law.

The enforcement architecture makes more sense once those roles are clear. Each Member State must establish or designate at least one notifying authority and at least one market surveillance authority for the Regulation, and one market surveillance authority must serve as the single point of contact, while the Commission publishes the list. Member States also have to provide these national competent authorities with adequate technical, financial, and human resources and expertise, including knowledge of A I technologies, data, data protection, cybersecurity, fundamental rights, health and safety risks, standards, and legal requirements. Article 74 then connects A I enforcement to the broader Union market-surveillance framework and gives those authorities real investigative reach, including access to documentation and, where necessary and under specified conditions, access to training, validation, and testing data sets and even source code on a reasoned request. For a beginner, the practical lesson is that enforcement is not abstract. There is a designated institutional structure behind it, and that structure is expected to have the expertise and powers needed to inspect what operators have actually done.

When an authority believes an A I system presents a risk, the law sets out a concrete path for escalation rather than leaving everything to informal negotiation. Article 79 says that where a market surveillance authority has sufficient reason to consider an A I system to present a risk to health, safety, or fundamental rights, it must evaluate the system’s compliance with the Regulation, giving particular attention to risks to vulnerable groups. If the authority finds non-compliance, it must require the relevant operator to take all appropriate corrective actions to bring the system into compliance, withdraw it from the market, or recall it within a prescribed period, in any event within the shorter of 15 working days or the period provided under relevant Union harmonization law. If the operator does not take adequate corrective action in time, the authority must take provisional measures to prohibit or restrict the system’s availability or use, withdraw it from the market, or recall it. This enforcement path is important because it shows that providers, deployers, importers, and distributors may face different primary duties, but they can all be drawn into the same corrective-action chain once a risky system is under scrutiny.

Enforcement is not limited to dramatic harm events, which is another point new learners often miss. Article 83 addresses formal non-compliance, meaning the authority can act even where the issue is a missing or improper C E marking, a missing E U declaration of conformity, a failure to register where required, the absence of an authorized representative, or unavailable technical documentation. In other words, paperwork failures and market-access failures matter because they prevent the legal traceability and accountability structure from functioning. The law also creates bottom-up enforcement signals. Article 85 allows any natural or legal person with grounds to think the Regulation has been infringed to submit a complaint to the relevant market surveillance authority, and Article 87 applies the Union whistleblower-protection framework to reporting infringements of the Regulation. This means enforcement is not only something that begins when an agency happens to notice a problem. It can also begin when an affected person, a business partner, an employee, or another observer brings a concern forward through formal channels.

Penalties then sit on top of that enforcement structure, and the most important beginner point is that the A I Act sets a tiered system rather than one single punishment for every violation. Article 99 says Member States must lay down effective, proportionate, and dissuasive rules on penalties and other enforcement measures, which can include warnings and non-monetary measures as well as fines. The highest tier applies to prohibited practices under Article 5 and can reach up to 35 million euros or, for an undertaking, up to 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. A second tier covers operator duties such as the obligations of providers under Article 16, importers under Article 23, distributors under Article 24, deployers under Article 26, and certain transparency duties, and that tier can reach up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. A third tier applies to supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities and can reach up to 7.5 million euros or 1 percent of worldwide annual turnover, whichever is higher.

The law also tells authorities how to think about those penalties, which helps explain why enforcement is supposed to be tough but not mindless. Article 99 says authorities should consider the nature, gravity, and duration of the infringement and its consequences, including the purpose of the A I system, the number of affected persons, and the level of damage. They should also consider whether other authorities already imposed fines for the same conduct, the size, annual turnover, and market share of the operator, the degree of cooperation, the manner in which the infringement became known, whether the conduct was intentional or negligent, and what actions were taken to mitigate harm. The same article also says penalties should take into account the interests and economic viability of smaller businesses and start-ups, which shows that proportionate enforcement does not mean casual enforcement, but it does mean context matters. For exam purposes, the memory aid is that penalties are role-linked and infringement-linked, but they are also adjusted by seriousness, scale, cooperation, and behavior after the problem is discovered. That is how the Act tries to balance deterrence with fairness.

By the end of this comparison, the pattern should feel much clearer. The provider is the actor that builds, proves, documents, monitors, and often leads remediation for high-risk systems. The importer is the gatekeeper for systems entering the Union from third-country providers, the distributor is the supply-chain checkpoint that must not keep unsafe or non-compliant systems moving, and the deployer is the actor responsible for lawful and disciplined use in the real world, sometimes with extra duties such as registration checks, workplace notice, and fundamental-rights impact assessment. Above them sit national competent and market surveillance authorities with the power to inspect, demand correction, restrict or withdraw systems, and trigger penalties, while complaints and whistleblower reports can feed the enforcement process from below. If you remember that comparison, the penalty structure stops looking like a random list of big numbers and starts looking like what it really is: a system designed to match responsibility to role, and to make sure every key point in the A I value chain has someone who can be held to account.