Declaration

Your role under the law

A law hands out duties by role. The EU AI Act asks one thing of the company that builds an AI system and another of the company that uses it; the GDPR asks one thing of the company that decides what happens to personal data and another of the company that processes it for someone else. One organization often holds several roles at once.

Activities say what your software does; roles say who your organization is to the law. Which role you hold is your answer to give: LexLint never reads it from code.

Legal information, not legal advice.

The roles, and the duty lines that bind the ones you pick

Under the EU AI Act: the AI system's chain

Under the GDPR: the personal data

Who runs it, or buys it

Public body
Supplier to a public body
Financial entity
Supplier to a financial entity

These answers route a duty to a public body, a financial entity or their supplier rather than to a role, so they add nothing to the count beside.

Under the EU AI Act

Provider

You develop an AI system or general-purpose AI model, or have one developed, and put it on the EU market or into service under your own name or trademark, paid or free.

AI Act 3(3)

180 duty lines in 38 provisions

Provisions with the most lines for this role

Other laws' words for it

developer (United States): Colorado's word for the party that builds an AI system or substantially modifies one.

In a declaration's profile: roles: {ai_system: [provider]} eu-aiact:AIProvider

Deployer

You use an AI system under your own authority, other than in a personal, non-professional activity.

AI Act 3(4)

52 duty lines in 18 provisions

Provisions with the most lines for this role

Other laws' words for it

deployer (United States): Colorado uses the same word for the party that uses a high-risk AI system.

In a declaration's profile: roles: {ai_system: [deployer]} eu-aiact:AIDeployer

Importer

You are located or established in the EU and place on its market an AI system bearing the name or trademark of someone established outside it.

AI Act 3(6)

9 duty lines in 1 provision

Provisions with the most lines for this role

AI Act, Article 23 (obligations of importers of high-risk AI systems)

In a declaration's profile: roles: {ai_system: [importer]} eu-aiact:AIImporter

Distributor

You make an AI system available on the EU market as part of its supply chain, without being its provider or importer.

AI Act 3(7)

8 duty lines in 1 provision

Provisions with the most lines for this role

AI Act, Article 24 (obligations of distributors of high-risk AI systems)

In a declaration's profile: roles: {ai_system: [distributor]} eu-aiact:AIDistributor

Product manufacturer

You put a product on the EU market under your own name with an AI system inside it as a safety component, which makes you that system's provider.

AI Act 25(3)

2 duty lines in 2 provisions

Provisions with the most lines for this role

In a declaration's profile: roles: {ai_system: [product_manufacturer]} eu-aiact:AIProductManufacturer

Authorized representative

You are located or established in the EU and hold a written mandate from a provider outside it to carry out its obligations under the Act on its behalf.

AI Act 3(5)

9 duty lines in 2 provisions

Provisions with the most lines for this role

In a declaration's profile: roles: {ai_system: [authorised_representative]} eu-aiact:AuthorisedRepresentative

Under the GDPR

Controller

You decide, alone or jointly with others, why and how personal data is processed.

GDPR 4(7)

12 duty lines in 6 provisions

Provisions with the most lines for this role

Other laws' words for it

business (United States): California's word under the CCPA; most other state privacy acts say controller.

In a declaration's profile: roles: {personal_data: [controller]} dpv:DataController

Processor

You process personal data on behalf of a controller.

GDPR 4(8)

6 duty lines in 3 provisions

Provisions with the most lines for this role

Other laws' words for it

service provider (United States): California's word under the CCPA; most other state privacy acts say processor.

In a declaration's profile: roles: {personal_data: [processor]} dpv:DataProcessor

Who runs it: public bodies

Public body

A public body runs this software.

In a declaration's profile: public_sector: [body]

Supplier to a public body

You sell this software to public bodies or run it for them.

In a declaration's profile: public_sector: [supplier]

Who runs it: financial institutions

Financial entity

A bank, insurer or other regulated financial entity runs this software.

In a declaration's profile: regulated_sector: {financial: body}

Supplier to a financial entity

You supply this software to a bank, insurer or other regulated financial entity.

In a declaration's profile: regulated_sector: {financial: supplier}

One organization, several roles

A role belongs to what your organization does with a system or with data, so one company often holds several. Three illustrations, each with the value it might declare:

A company that offers a model through an API

It builds the model and puts it out under its own name, decides what happens to its own customers' account data, and processes what customers send it on their behalf.

roles: ai_system: [provider] personal_data: [controller, processor]

A software company with an AI feature that keeps its customers' data

It provides the feature, processes its customers' records for them, and uses an AI tool of its own in its hiring.

roles: ai_system: [provider, deployer] personal_data: [controller, processor]

A city that uses a vendor's chatbot

It uses the chatbot under its own authority and decides what happens to residents' messages; the vendor is its supplier.

public_sector: [body] roles: ai_system: [deployer] personal_data: [controller]

What a role changes in a run

Activities decide which laws reach your app; roles decide which of those laws' duty lines are your organization's. A line tagged for a role you do not hold is listed as owed by a party this app is not, and a line that binds any operator stays yours whatever you answer.

profile: roles: ai_system: [provider] personal_data: [processor]

The MCP server asks in a form when your client can show one, and the skill asks in conversation; either way the answer is the developer's, never read from the code. A law left unanswered moves nothing, and the run says how many lines an answer would have moved. None of these: every duty line tagged for this law's roles is shown as owed by another party.

Who you are by sector

Some statutes bind an organization for what it is rather than for what its code does, so these are declared as activities. Each links its page in the activity registry:

A note on "operator"

The EU AI Act calls all six of its roles operators. LexLint's handbook uses OPERATOR for a narrower party, whoever runs the software, and the activity registry tags the sector facts above as roles.