AI provider, AI producer or AI user: the roles that shape an ISO/IEC 42001 implementation

The first question I ask in any discussion about an AI management system is not “which AI systems do you have?”, it is: “What is your role in relation to each of them?” The answer shapes everything that follows — the scope of the AIMS, the risks that matter, which Annex A controls apply, and what an auditor will expect to see. 

And yet most organizations starting with ISO/IEC 42001 have never asked themselves the question in these terms.

The vocabulary for answering it exists, in a standard that deserves to be better known: ISO/IEC 22989, the terminology standard for artificial intelligence, which ISO/IEC 42001 uses as its normative reference for concepts and definitions. Clause 5.19 of ISO/IEC 22989 describes the stakeholder roles in the AI ecosystem — a detailed taxonomy that includes providers, producers, customers, users, partners such as system integrators, data providers, AI auditors and evaluators, and AI subjects, the people and organizations affected by AI systems.

For an organization implementing an AIMS, I find that three of these roles do nearly all the practical work: AI provider, AI producer, and AI user. Let’s take them one by one, with examples, and then look at why the distinction matters more than it seems.

AI producer: you design, develop, test or deploy AI

An AI producer is an organization that designs, develops, tests and deploys products or services that use one or more AI systems. This is the role of the organizations building the technology:

• a software company developing a fraud-detection model for banks;
• a team training or fine-tuning a machine learning model on the company’s own data;
• a start-up building a medical triage application on top of an existing large language model.

Note the last example, because it surprises people: you do not need to train a model from scratch to be a producer. An organization that takes someone else’s model and builds, adapts, tests and deploys its own AI system around it is performing producer activities. ISO/IEC 22989 breaks the producer role into finer parts — model designers, model implementers, verifiers — but for AIMS purposes, the headline question is simply: do we create or materially shape AI systems?

AI provider: you make AI available to others

An AI provider is an organization that provides products or services using one or more AI systems. The standard distinguishes two variants: the AI platform provider, which offers the infrastructure and services that enable others to build AI products — think of the large cloud platforms offering model APIs and machine learning services — and the AI product or service provider, which offers something directly usable:

• a vendor selling an AI-powered CV screening tool to HR departments;
• a company offering a chatbot-as-a-service that other businesses embed in their websites;
• a translation service whose engine is a neural network, sold by subscription.

The provider is the organization the customer points to and says: they supply our AI. Commercial responsibility toward the customer sits here, which is why, for many certified AIMS, this role carries the heaviest weight of transparency and communication obligations.

AI user: you use AI in your operations

An AI user is an organization that uses AI products or services. This is, by a wide margin, the most common role:

• a bank using a vendor’s credit-scoring system in its lending decisions;
• a hospital using diagnostic support software;
• a logistics company using route-optimization tools;
• any organization whose employees use generative AI tools in their daily work.

Organizations in this role sometimes assume ISO/IEC 42001 is not for them — “we don’t build AI, we just use it.” The standard explicitly covers organizations that use AI-based products or services. If AI influences your decisions, your services or your people, you have AI risks to manage, and the user role is where the management system focuses: selecting and evaluating AI suppliers, defining acceptable use, overseeing the results, handling the impacts on customers and employees.

Roles attach to AI systems, not to organizations

Here is the practical subtlety. An organization does not have one role; it has a role per AI system. A company that uses a cloud platform’s models (user, toward the platform), builds its own application on top of them (producer, for that system), and sells the application to clients (provider, toward those clients) holds all three roles at once — each with different obligations, toward different parties.

This is why the role question comes first in an AIMS implementation. It determines:

• the scope and context (clause 4) — you cannot describe your organization’s context without stating what you do in the AI value chain;
• which Annex A controls apply, and how — development life cycle controls bite hard on producers, supplier and third-party controls on users, transparency and information-for-interested-parties controls on providers;
• the AI system impact assessment — the impacts you assess, and on whom, depend on where you stand relative to the system;
• what an auditor examines — and, from my experience on the auditing side, where the most common gap appears: an organization that scopes itself as a “user” while quietly fine-tuning models or building applications is performing producer activities without the corresponding controls. That mismatch between declared role and actual activity is precisely the kind of finding a competent AIMS auditor is trained to surface.

One more reason the vocabulary is worth learning: it maps, imperfectly but usefully, onto the language regulators now use. The EU AI Act’s “provider” and “deployer” categories cover similar ground — the deployer being, roughly, the organization ISO/IEC 22989 calls an AI user. An organization that has honestly answered the role question for its AIMS has done most of the thinking the regulatory classification requires.

Frequently asked questions

Do we need to read ISO/IEC 22989 to implement ISO/IEC 42001?
It helps more than almost any other supporting document. ISO/IEC 42001 takes its terms and definitions from ISO/IEC 22989, so the concepts — including the ecosystem roles — come from there. You can implement an AIMS without reading it, but the role analysis will be sharper with it.

Can an organization be a producer, provider and user at the same time?
Yes, and many are — for different AI systems, or even for the same system viewed from different relationships. The AIMS should reflect each role the organization actually holds, with the corresponding controls.

We only use AI tools from vendors. Is ISO/IEC 42001 relevant for us?
Yes. The standard applies to organizations that develop, provide or use AI products and services. For a pure AI user, the management system focuses on supplier evaluation, acceptable use, oversight of outcomes and the impacts on people affected — which is where most real-world AI incidents happen

Want to know more about AIMS and ISO/IEC 42001? Check out our AIMS course and our Responsible AI training.

And if you want to prove your knowledge of the subject, our ISO/IEC 42001 AIMS Practitioner and AIMS Auditor certifications, as well as the Responsible AI Specialist certification, are smart options.