White-labelled AI tools: is your agency the provider under the AI Act?
The definitions that decide it
Three definitions in Article 3 of the AI Act do the work:
- Provider (Article 3(3)): a person or body "that develops an AI system ... or that has an AI system ... developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge".
- Deployer (Article 3(4)): a person or body using an AI system under its authority, except for personal non-professional use.
- Distributor (Article 3(7)): someone in the supply chain, other than the provider or importer, who makes an AI system available on the EU market.
Two phrases matter for white-label deals. "Has an AI system developed" means you do not have to write the code yourself. "Under its own name or trademark" means the brand on the product counts. A reseller that puts its own name on someone else's system can therefore land in the provider role.
Common agency set-ups
| Set-up | Likely role | Why |
|---|---|---|
| You install the vendor's widget, with the vendor's name on it, on a client's site | Deployer (with the client), not provider | The vendor's name is on it; the vendor is the provider |
| You sell "YourAgency Assistant", built on a white-label chatbot platform, to several clients | Possibly the provider | You have a system developed and supply it under your own name |
| You build a custom bot on an LLM API and hand it to one client under the client's brand | You or the client may be the provider | You developed it; the client may be the one putting it into service under its name. Decide it in the contract |
| You only resell the vendor's product, unchanged and under the vendor's name | Distributor | You make it available but don't put your name on it |
| The client uses the bot on its own site, whoever built it | Deployer | Using an AI system under its own authority |
The roles are not exclusive. The client is usually a deployer whatever you are, and one company can be both provider and deployer of the same system.
Where the line is unclear
The Act does not say how much of a system you need to shape before you "have it developed". Changing a logo and a system prompt on a SaaS platform is a long way from commissioning a custom build, and the text does not draw the line between them. Article 25, which makes distributors, importers and deployers into providers when they put their name on a system, applies only to high-risk AI systems, so it does not settle the question for an ordinary customer-service chatbot.
The Commission's guidelines on Article 50 are the place to check for its reading of these roles. Until there is guidance or case law that says otherwise, the safer working assumption for a branded reseller is that it may be the provider, and to design for that.
What being the provider means under Article 50
For a chatbot or other AI system that interacts directly with people, Article 50(1) puts the duty on the provider: the system has to be designed and developed so that the people using it are informed they are interacting with an AI system, unless that is obvious from the context. Article 50(5) adds that the information must be clear and distinguishable, given at the latest at the first interaction, and accessible.
If your agency is the provider, that means:
- The disclosure has to be part of the product you supply, not something you leave each client to add.
- If the white-label platform has no setting for a disclosure message, you need another way to show one before or at the first message (a fixed greeting, a banner in the widget), or a different platform.
- For tools that generate images, audio, video or text, the Article 50(2) machine-readable marking duty is also the provider's. You will usually depend on the vendor's model or platform to embed the marking. Check that it does.
The deployer duties in Article 50(3) and (4) (emotion recognition and biometric categorisation, deep fakes, public-interest text) stay with whoever uses the system: the client, or you if you run it for them under your authority. The guide on whether Article 50 applies to client chatbots covers the deployer side.
What to put in the vendor contract
If you might be the provider, you are answering for code someone else controls. Ask the vendor for:
- a confirmed setting, on every plan you resell, to show an AI disclosure before or at the first message, and a commitment not to remove it
- confirmation of what machine-readable marking the platform or model applies to generated content, and that exports keep it
- notice of changes that affect disclosure or marking, with enough lead time to fix client set-ups
- the documentation you would need to answer a market surveillance authority about how the system informs users
- a clear statement of who is provider, so the contract matches how you sell the product
And with each client, write down who is provider and who is deployer for the system you are supplying, and who answers if an authority asks.
A quick decision check
- [ ] Whose name or trademark do end users see on the chatbot or tool?
- [ ] Did you develop it, or have it developed, rather than only install a vendor's product?
- [ ] If both answers point to you, plan as the provider.
- [ ] Disclosure built into the product at or before the first message.
- [ ] Vendor contract covers the disclosure setting, marking and change notice.
- [ ] Client contract records the roles.
The compliance log in the Article 50 kit for agencies has a column for recording your role on each system. Everything on this page works without it.
Sources
- Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 3(3), (4), (7), (9) and (11), Article 25, and Article 50.
- Article 3 definitions and Article 25 at artificialintelligenceact.eu.
- Article 50 text at artificialintelligenceact.eu.
- European Commission: AI Act policy pages, for the Article 50 guidelines.