AI Act roles per edition ​
Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet.
References are to Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI).
Definitions ​
- Provider (Art. 3(3)): develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
- Deployer (Art. 3(4)): uses an AI system under its authority, except for personal non-professional activity.
- Free and open-source exclusion (Art. 2(12)): the AI Act does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or fall under Art. 5 or Art. 50.
Roles ​
| Edition | Provider | Deployer | Notes |
|---|---|---|---|
| Self-hosted (Apache-2.0) | Quavon UG (haftungsbeschränkt), which places CodeLotse on the market under its name | The customer operating it | The open-source exclusion of Art. 2(12) does not remove Art. 50 duties, and would not apply to assignment if that is high-risk. Working assumption: Quavon UG (haftungsbeschränkt) acts as provider for all features |
| Enterprise (hosted by Quavon) | Quavon UG (haftungsbeschränkt) | The customer | Quavon UG (haftungsbeschränkt) also operates the system for the customer; that does not make it the deployer, because the use is under the customer's authority |
| Customer fork or substantial modification | The customer can become the provider (Art. 25(1)), for example by changing the intended purpose of assignment or adding excluded inputs | The customer | The instructions for use must state the intended purpose, prohibited uses and excluded inputs |
The model providers (see subprocessors.md) are providers of general-purpose AI models (Chapter V). CodeLotse integrates those models into its own AI system; Quavon UG (haftungsbeschränkt) is a downstream provider in the sense of Art. 3(68).
Duties by feature ​
| Feature | Classification (working assumption) | Provider duties (Quavon UG (haftungsbeschränkt)) | Deployer duties (customer) |
|---|---|---|---|
| Review, triage, replies, chat, fix PRs, acceptance checks | AI system with limited risk; not Annex III | Art. 50(1), (2) (art50-transparency.md); Art. 4 for own staff | Art. 4 AI literacy (art4-ai-literacy.md); Art. 50(4) not expected to apply |
| Assignment suggestions | Open: possibly high-risk under Annex III point 4(b) (annex-iii-assignment.md) | If high-risk, from 2 December 2027: Arts. 9–17, 43, 47–49, 72, 73 | If high-risk: Art. 26 (including informing workers' representatives and affected workers before putting into service), Art. 86 |
| Team analytics | Aggregated statistics with fixed formulas; probably not an AI system under Art. 3(1) | None specific under the AI Act | GDPR and BetrVG apply (dpia-analytics.md) |
Questions for counsel ​
- Confirm that Quavon UG (haftungsbeschränkt) is the provider for the self-hosted Apache-2.0 edition and the hosted edition (assessment Q5).
- Confirm that team analytics is not an AI system.
- When does a customer configuration (custom rules, model choice, weights) amount to a substantial modification under Art. 25?