AI roles according to ISO 42001 and the EU AI Act

ISO 42001 and the EU AI Act both require organizations to define their AI role, yet their definitions differ. Understanding those differences early prevents wasted effort and helps companies build governance systems that actually fit their operations.

This article explains what those roles are, how they diverge, and how to choose correctly, so your compliance project starts on solid ground.

ISO 42001 roles: Six ways companies participate in the AI ecosystem

ISO 42001 introduces AI roles in Clause 4.1, Understanding the context of the organization. These roles describe how the company as a whole interacts with AI systems, not the job titles of individual employees. A single organization can hold several roles simultaneously, depending on how it develops, uses, or supports AI.

AI providers include both platform and product providers. Platform providers offer AI infrastructure built on their own models — OpenAI with ChatGPT or Anthropic with Claude are clear examples. Product providers embed AI into specific applications, such as Gmail’s AI-powered features or Advisera’s Experta tool for compliance professionals. These companies deliver AI capabilities directly to users.

AI producer is a broad category covering developers, designers, testers, evaluators, deployers, and governance professionals. It also includes consultants and assessors who shape how AI is built and managed. OpenAI again fits here as a developer of its own models, while an AI officer or external consultant working on ISO 42001 implementation would also qualify.

AI customer or user is a role that applies to any company that uses AI tools like ChatGPT, Claude, or Experta. Most organizations fall into this group, even if they also act as providers or partners. The distinction lies in whether they create or simply consume AI capabilities.

AI partners include system integrators, data suppliers, and auditors. These organizations support AI operations by providing data, integration services, or certification. A company purchasing training data or hiring an ISO 42001 auditor would be engaging with partners.

AI subject is a role that covers entities whose data is used to train AI models. For example, a business whose documents appear in a training dataset becomes an AI subject. This role highlights the importance of transparency and consent in data use.

Government authorities, such as the EU AI Office, act as regulators overseeing compliance. While not corporate roles, they complete the ecosystem by enforcing standards and legislation.

EU AI Act roles: Four legally binding classifications

The EU AI Act defines roles more narrowly because each one carries specific legal obligations. These roles determine who must comply with which articles of the Act and what documentation or risk controls are required.

The first role, AI provider, is similar to ISO 42001’s definition, but more precise. A provider is any company that places an AI system or general‑purpose model on the EU market under its own brand. OpenAI and Google are good examples — they release AI systems directly to users and therefore bear full regulatory responsibility.

The second role, AI deployer, is where confusion often arises. Under the EU AI Act, deployers are companies that use AI systems under their own authority. This aligns most closely with ISO 42001’s “AI customer” or “AI user,” even though ISO also mentions deployers under producers. In practice, the EU AI Act’s deployer is the organization applying AI in its operations, not developing it.

The third role, AI importer, refers to companies introducing AI systems into the EU market when those systems are branded by organizations outside the EU. For instance, Google’s European subsidiary placing Gemini on the EU market acts as an importer, since Gemini is developed in Google’s US-based headquarters. ISO 42001 does not define an equivalent role.

The fourth role, AI distributor, applies to businesses that place AI systems on the market but are neither providers nor importers. A reseller of an EU‑developed AI tool would fall into this category.

The EU AI Act also uses the term AI operator as an umbrella for any company holding one of these roles. It is not a separate classification, but a collective term for entities subject to the Act.

Below is a table that shows how AI roles overlap between ISO 42001 and the EU AI Act.

Why defining your role correctly matters

Your declared role determines everything that follows — risk assessments, documentation, technical controls, and even liability. ISO 42001 and the EU AI Act both build their compliance frameworks around this foundation. Misclassifying your role can lead to missing mandatory controls, applying the wrong risk criteria, or failing to meet legal obligations.

For example, a company that customizes or integrates an AI model may think it’s only a user, but it’s actually functioning as a producer or provider. A business embedding AI into its own product becomes a provider under both frameworks. Each of these missteps can create compliance gaps that are expensive to fix later.

Defining your role early ensures that your governance system, documentation, and risk management align with the right standards from the start. It also clarifies accountability — who owns the AI system, who operates it, and who bears responsibility for its outcomes.

To learn more about AI roles, sign up for this free ISO 42001 Lead Implementer Course that will teach you how to organize AI governance according to your specific AI role.