White-labelled AI tools: is your agency the provider under the AI Act?

Posted on Oct 27 • Originally published at mdodeja.github.io

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice. The original is at https://mdodeja.github.io/eu-ai-act-article-50-guide/guides/white-label-ai-tools-provider-article-50.html.

Short answer. Possibly. The AI Act's provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. An agency that sells a vendor's chatbot as "AgencyBot" fits that wording more closely than one that installs the vendor's branded widget for a client. If you are the provider, the Article 50(1) duty to design the chatbot so people know it is an AI is yours, even though the vendor wrote the code. Get the vendor to give you the means to meet it, in writing.

Three definitions in Article 3 of the AI Act do the work:

Two phrases matter for white-label deals. "Has an AI system developed" means you do not have to write the code yourself. "Under its own name or trademark" means the brand on the product counts. A reseller that puts its own name on someone else's system can therefore land in the provider role.

The roles are not exclusive. The client is usually a deployer whatever you are, and one company can be both provider and deployer of the same system.

The Act does not say how much of a system you need to shape before you "have it developed". Changing a logo and a system prompt on a SaaS platform is a long way from commissioning a custom build, and the text does not draw the line between them. Article 25, which makes distributors, importers and deployers into providers when they put their name on a system, applies only to high-risk AI systems, so it does not settle the question for an ordinary customer-service chatbot.

The Commission's guidelines on Article 50 are the place to check for its reading of these roles. Until there is guidance or case law that says otherwise, the safer working assumption for a branded reseller is that it may be the provider, and to design for that.

For a chatbot or other AI system that interacts directly with people, Article 50(1) puts the duty on the provider: the system has to be designed and developed so that the people using it are informed they are interacting with an AI system, unless that is obvious from the context. Article 50(5) adds that the information must be clear and distinguishable, given at the latest at the first interaction, and accessible.

If your agency is the provider, that means:

The deployer duties in Article 50(3) and (4) (emotion recognition and biometric categorisation, deep fakes, public-interest text) stay with whoever uses the system: the client, or you if you run it for them under your authority. The guide on whether Article 50 applies to client chatbots covers the deployer side.

If you might be the provider, you are answering for code someone else controls. Ask the vendor for:

And with each client, write down who is provider and who is deployer for the system you are supplying, and who answers if an authority asks.

The compliance log in the Article 50 kit for agencies has a column for recording your role on each system. Everything on this page works without it.