Deployer vs Provider
Vendor is provider. You (the customer deploying the AI) are deployer. Each has distinct obligations. Deployers have substantial obligations even on vendor-built AI.
Deployer Obligations
Use the system per vendor instructions. Monitor for issues. Keep logs. Ensure human oversight configured. Inform users of AI interaction. Handle data subject rights. Report serious incidents to authorities.
Documentation
Your specific deployment configuration. Who is the oversight lead. What human review processes exist. Retention of logs. Incident response playbook. Auditors will ask.
Practical Timeline
Inventory your AI systems now. Map to Annex III. Engage compliance/legal. Update documentation. Train staff. August 2 deadline isn’t negotiable. Starting late means compressed timeline and higher risk.