Contents
Why the question of role comes first
The AI Act reasons not by sector but by role. The same facts (a voicebot, a call analytics tool) give rise to different obligations depending on whether you are a provider, deployer, distributor or importer. Getting the role wrong leads either to overlooking obligations or to taking on obligations that belong to someone else.
For a service provider established in Morocco, the question arises as soon as the AI Act applies, that is, when it places a system on the European market or when its system's output is used in the Union (Article 2(1)). The basics are set out in our guide to the AI Act and Moroccan BPOs; this page goes into the detail of classification.
The definitions that matter
| Concept | Article | Decisive criterion | Question to ask |
|---|---|---|---|
| Provider | 3(3) | Develops or has developed, and places on the market or puts into service under its own name or trademark | Does the system bear our name? Did we design it? |
| Deployer | 3(4) | Uses the system under its own authority, in a professional capacity | Do we decide on its use and configuration? |
| Distributor | 3(7) | Makes the system available without being the provider or importer | Are we reselling a third party's tool without modifying it? |
| Substantial modification | 3(23) | A change not foreseen by the provider that affects compliance or the intended purpose | Have we retrained, repurposed or diverted the tool? |
Two practical remarks. First, "developing" includes having a system developed: a centre that commissions an agency to build its voicebot and then deploys it under its own brand is the provider. Second, the role is assessed system by system: the same centre can be the provider of one tool and the deployer of another.
Five typical contact-centre situations
| Situation | Role of the Moroccan centre | Role of the European client | Role of the software vendor |
|---|---|---|---|
| The centre uses the chatbot supplied and configured by its client | Operates on the client's behalf; the client is in principle the deployer | Deployer | Provider |
| The centre buys a voice analytics licence and uses it for several clients | Deployer | Recipient of the output | Provider |
| The centre builds a voicebot on a third-party language model and offers it under its own brand | Provider of the system, and deployer if it operates it | Customer of the service | Provider of the model |
| The centre resells a vendor's tool as is to its clients | Distributor (Article 3(7)), or even provider under Article 25 for a high-risk system; the importer, if there is one, is necessarily an entity established in the Union (Article 3(6)), not the Moroccan centre | Deployer | Provider |
| The centre retrains a CV-screening tool to recruit agents | Deployer, and possibly provider if the modification is substantial (high risk, Annex III point 4(a)) | Not applicable | Original provider |
These classifications are indicative. The line between "operating on the client's behalf" and "using under its own authority" depends on who actually decides the configuration, the scripts and the purposes. The contract must reflect reality, not the other way round.
When a deployer becomes a provider: Article 25
For high-risk systems, Article 25(1) provides that a distributor, importer, deployer or other third party is considered a provider, with all the corresponding obligations, in three cases:
- it puts its name or trademark on a high-risk system already placed on the market;
- it makes a substantial modification to it and the system remains high risk;
- it changes the intended purpose of a system that was not high risk in such a way that it becomes high risk.
Example: a centre buys a general-purpose conversation analytics tool and uses it to assess and rank its agents for bonus purposes. It changes the intended purpose to an Annex III use (point 4(b), performance assessment). It then risks being treated as the provider of that high-risk system.
The original provider must cooperate with the new provider (Article 25(2)), and the provider of a high-risk system must conclude a written agreement with suppliers of integrated tools, components or services (Article 25(4)).
What each role must do, and when
| Obligation | Provider | Deployer | Applicable since / from |
|---|---|---|---|
| AI literacy measures for staff (Article 4, an obligation to take measures since the Omnibus) | Yes | Yes | 2 February 2025 |
| Not using prohibited practices (Article 5) | Yes | Yes | 2 February 2025 |
| Disclosing that people are interacting with AI (Article 50(1)) | Yes | Check the configuration | 2 August 2026 |
| Marking synthetic content (Article 50(2)) | Yes (generative AI) | No | 2 August 2026, with a deadline of 2 December 2026 for systems already on the market |
| Informing people in the case of emotion recognition (Article 50(3)) | No | Yes | 2 August 2026 |
| High-risk requirements (Article 16 et seq.) | Yes | No | 2 December 2027 (Annex III) |
| Use in line with instructions, human oversight, six-month logs, informing employees (Article 26) | No | Yes | 2 December 2027 (Annex III) |
Fines follow roles: up to €15 million or 3% of worldwide turnover for breaches of operators' obligations, notably Articles 16, 26 and 50, and up to €35 million or 7% for prohibited practices. For SMEs, the lower of the two amounts applies.
What to write into the contract
The contract between the centre, its client and its software vendors is the main tool for clarification. Clauses to check or propose:
- Inventory of the AI systems used in delivering the service, with each party's role for each one.
- Configuration: who drafts and approves the disclosure messages of the chatbot and voicebot.
- Ban on changing a tool's intended purpose without written agreement, to avoid Article 25.
- Ban on prohibited uses, including analysis of agents' emotions.
- Documentation the vendor undertakes to supply: instructions for use, known limitations, information useful for the impact assessment.
- Incident reporting and cooperation in the event of an inspection.
- Training of agents and supervisors on the tool.
These clauses supplement, without replacing, those covering personal data: a centre that is a deployer under the AI Act is often also a processor under the GDPR, and the two classifications must remain consistent. They also help in answering European clients' compliance questionnaires.
A six-step method
- Draw up an inventory of all AI systems: developed in-house, bought, imposed by clients.
- For each, record who designed it, under what name it is presented and who decides its configuration.
- Determine whether its output is used in the European Union.
- Assign a role per system (provider, deployer, distributor) and check the Article 25 triggers.
- Derive the list of obligations and their dates from the table above.
- Bring contracts into line and review the classification for every new tool or new use, following an AI system life cycle approach.
Further reading
- 7 min read
- 7 min read
- 7 min read
- 4 min read
- 5 min read
Frequently asked questions
What is the difference between a provider and a deployer under the AI Act?
The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). The deployer uses an AI system under its own authority in a professional context (Article 3(4)). The heaviest obligations fall on the provider.
Is a Moroccan call centre that uses a software vendor's chatbot a provider?
In principle, no: it is the deployer, and the vendor is the provider. The position changes if it markets the tool under its own brand (Article 3(3)) or, for a high-risk system, if it puts its name on it, substantially modifies it or changes its intended purpose (Article 25).
Can you be both provider and deployer?
Yes. A centre that develops its own voicebot and uses it to serve its clients' customers is the provider of the system and the deployer of its use. It then carries both sets of obligations.
Does the AI Act apply to a service provider established outside the Union?
Yes, where the output produced by the AI system is used in the Union (Article 2(1)(c)). Providers placing a system on the European market are covered wherever they are established.
When must roles be clarified?
Now, for transparency, which has applied since 2 August 2026, and for AI literacy, which has applied since 2 February 2025. For Annex III high-risk systems, the requirements apply from 2 December 2027.
General information, not legal advice.
Report an errorReferences (6)
- European Commission, AI Act Service Desk: Article 2, scope. (opens in a new tab)
- European Commission, AI Act Service Desk: Article 3, definitions. (opens in a new tab)
- European Commission, AI Act Service Desk: Article 25, responsibilities along the AI value chain. (opens in a new tab)
- European Commission, AI Act Service Desk: Article 26, obligations of deployers. (opens in a new tab)
- European Commission, AI Act Service Desk: Article 99, penalties. (opens in a new tab)
- Regulation (EU) 2026/1744 ("Digital Omnibus on AI"), in force since 27 July 2026. (opens in a new tab)