Blog · EU AI Act · Roles
ISO 42001 and the EU AI Act: which role are you?
12 May 2026 · 2 min read · By LeadAI
Two vocabularies matter when you plan an AI management system. ISO/IEC 42001 and its companion standard ISO/IEC 22989 describe how an organisation participates in the AI value chain. The EU AI Act (Regulation (EU) 2024/1689) describes which legal function an organisation performs. The words overlap, and that is where the confusion starts.
Two lists, not one
In the ISO vocabulary, the roles you will meet most often are provider, producer, customer and partner. In the EU AI Act, the operators include provider, deployer, importer, distributor, authorised representative and product manufacturer.
"Provider" appears in both. Do not assume the label carries identical consequences in each one. A role under a standard sets expectations for your management system. A role under a regulation sets legal obligations.
Classify the activity, not the company name
One organisation can hold several roles at once, and a role can change by product, market or contract. The useful question is not "what kind of company are we?" but "what do we actually do with this AI system?"
| What you do | Likely ISO role | Potential EU AI Act role |
|---|---|---|
| You build the system | Producer | Provider |
| You use a system supplied by someone else | Customer | Deployer |
| You sell or supply it | Provider | Provider, importer or distributor |
| You support delivery (consulting, integration, data services) | Partner | Depends on the activity |
Treat this table as a starting point only. Branding, substantial modification, where the system enters the EU market and what your contract says can all change your position. A deployer that rebrands a system or changes its intended purpose may take on provider obligations.
Why it matters for your AIMS
Your role decides what you are responsible for, and your certification scope decides where the management system applies. Neither can be safely guessed from a logo or a certificate headline. Getting the role wrong at the start means controls, risk assessments and contracts built on the wrong assumptions.
Record the roles you hold in your AI inventory, per system, and review them when products, markets or suppliers change.
Try it
LeadAI's Role & Scope Navigator walks through the activity questions and gives an initial indication of your likely ISO and EU AI Act roles. It is a decision aid, not legal advice. Confirm your classification with qualified legal and conformity-assessment professionals.
This article gives general information and is not legal advice.