EU AI Act Compliance Matrix Provider Deployer Importer Distributor XLSX
Professional Excel worksheet with Start Here, Dashboard, role-by-article matrix, lookups, sources, and review notes.
Download XLSX worksheet →Role-by-article matrix Markdown
Plain Markdown matrix for internal notes and review.
Download Markdown →Matrix
This matrix is a practical map, not a legal determination. It helps a team decide which article cluster needs attention and which evidence starter to open next.
| Article | Topic | Provider relevance | Deployer relevance | Evidence starter | EU AI Compass link |
|---|---|---|---|---|---|
| Article 4 | AI literacy | Primary duty for provider staff and relevant persons | Primary duty for deployer staff and relevant persons | Awareness and role-based training records | AI literacy evidence log; AI literacy planner |
| Article 5 | Prohibited AI practices | Must not place or put prohibited systems into service | Must not use prohibited practices | Use-case screening and approval record | Prohibited practices reference; quick checker |
| Article 6 + Annex III | High-risk classification | Classify systems before placing on market or putting into service | Understand if a deployed use case falls into high-risk scope | Classification rationale and reviewer sign-off | Compliance checker; Annex III checklist |
| Articles 9-15 | High-risk system requirements | Primary provider-side requirements | Review provider instructions and evidence where using high-risk systems | Provider evidence pack; control mapping | Paid-tier candidate; related guides |
| Article 25 | Responsibility along AI value chain | Primary if placing system on market under name or modifying system | Can become provider if substantially modifying or relabelling a high-risk system | Change review and reclassification record | Accidental provider classifier |
| Article 26 | Deployer obligations | Provide instructions and evidence needed by deployers | Use systems according to instructions, assign oversight, monitor, keep logs where under control, and manage input data | Deployer checklist and operational assessment | Deployer obligations checklist; Article 26 scorer |
| Article 27 | FRIA | Support with technical and risk information where needed | Complete FRIA where Article 27 applies | FRIA worksheet and approval record | Local FRIA generator; FRIA + DPIA guide |
| Article 50 | Transparency obligations | May need to design notices and technical marking controls | May need to provide clear notices to natural persons depending on use case | Notice copy, labelling evidence, UI screenshot | Article 50 notice templates; transparency validator |
| Article 72 | Post-market monitoring | Primary provider-side obligation | Escalate issues and monitor use according to instructions where relevant | Monitoring plan, issue log, feedback loop | Provider-side paid-tier candidate |
| Article 73 | Serious incident reporting | Primary provider-side reporting obligation | Escalate potential serious incidents to provider and internal owners | Incident register and escalation evidence | Incident playbook; serious incident starter register |
How to read the matrix
Start with the role. If your organization uses a third-party AI system inside its own process, begin with deployer duties. If it builds, substantially modifies, relabels, places on the market, or puts a system into service under its own name, check provider-side duties carefully.
FAQ
Does one organization have only one role?
No. The same organization can be a deployer for one system and a provider for another. Do the role analysis per system and per use case.
Why include provider-side articles on a deployer-focused site?
Because deployers need to spot when modification, relabelling, or internal build decisions could pull them into provider responsibilities.
Related EU AI Compass assets
Source and review note
This page is an educational evidence starter. It is not legal advice and does not confirm compliance. Review the official text of Regulation (EU) 2024/1689 and obtain qualified legal review before relying on any template for a formal compliance decision.
- Regulation (EU) 2024/1689 on EUR-Lex
- Last reviewed against official source references: 27 April 2026.