The vendor is the provider responsible for conformity: Under the EU AI Act, how are the roles and their core

The developing/marketing vendor is the provider with conformity duties, and the operating hospital is the deployer responsible for correct use and oversight.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. The hospital is the provider and the vendor is the deployer, so the hospital must complete the conformity assessment while the vendor simply follows the instructions for use.

   Plausible but reversed: the party that develops and places the system on the market is the provider, so the vendor, not the hospital, bears the conformity-assessment duty.
2. Both the hospital and the outside vendor are importers, so each must only verify the CE marking and keep records, and neither party carries any of the provider's conformity-assessment responsibilities here.

   Almost plausible because importer checks are real, but neither party here is an importer, and the vendor still holds provider conformity duties.
3. The vendor is the provider responsible for conformity assessment and documentation, while the hospital is the deployer responsible for using the system per instructions and ensuring human oversight. ✓

   Correct: the vendor develops and markets the system (provider duties), and the hospital operates it under its authority (deployer duties such as use per instructions and oversight).
4. Because the model is unchanged, no role attaches to either party, so the hospital and vendor share undifferentiated obligations and the deployer concept does not apply to this deployment.

   Plausible-sounding but roles still attach even when a model is unchanged; the hospital remains a deployer with its own distinct obligations.

How to remember it

The developing/marketing vendor is the provider with conformity duties, and the operating hospital is the deployer responsible for correct use and oversight.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• It uses tiered maximums scaled to the violation's: How does the EU AI Act structure its administrative fines →
• They set out values-based principles such as inclusive: Which statement accurately describes the OECD AI →
• MAP, because the function establishes context and frames: Which core function are these activities most →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →