RoleScope

EU AI Act Obligation Workload Calculator

Your role decides the workload. Provider obligations dwarf deployer obligations.

Systems where you are the provider

Systems where you are only the deployer

Obligations per provider system

Obligations per deployer system

Hours per obligation

Blended hourly rate ($)

Weeks until the deadline

FTEs available

Total obligations

Role drives the workload far more than system count. Building or rebranding a system makes you its provider and carries the heavy obligations; merely using someone else's makes you a deployer, with a much shorter list. Role is a legal determination — confirm it with counsel.

Effort required: 1,080 hr
Cost: $108,000
Deadline check: Fits (90 hr spare)

What you entered

Systems where you are the provider: 3Systems where you are only the deployer: 12Obligations per provider system: 14Obligations per deployer system: 4Hours per obligation: 12Blended hourly rate ($): 100Weeks until the deadline: 26FTEs available: 1.5

1
Obligations you hold as provider
3 systems × 14= 42 obligations
2
Obligations you hold as deployer
12 systems × 4= 48 obligations
3
Total effort
90 × 12 hr= 1,080 hr (provider share 47%)
4
Capacity before the deadline
26 wk × 1.5 FTE × 30 hr= 1,170 hr
5
Fits the deadline?
1,170 hr available vs 1,080 hr needed= Yes — $108,000 total

Result

Total obligations: 90

90 obligations take about 1,080 hr and $108,000. Provider-role systems account for 47% of that despite being 3 of 15 systems. With 1.5 FTE over 26 weeks you have 1,170 hr — it fits. This sizes work, not compliance — role and obligation applicability need legal review.

EU AI Act compliance effort by role and system count

Providers carry far more obligations than deployers. Rows assume 9 obligations per provider system, 4 per deployer system, 12 hours each at $120 an hour, with each FTE giving 30 usable hours a week.

Provider systems	Deployer systems	Weeks left	FTE	Obligations	Hours	Cost	Capacity	Fits?
1	3	26	1	21	252	$30,240	780 hr	Yes
2	5	26	1	38	456	$54,720	780 hr	Yes
5	10	26	2	85	1,020	$122,400	1,560 hr	Yes
5	10	12	2	85	1,020	$122,400	720 hr	No
10	20	52	3	170	2,040	$244,800	4,680 hr	Yes

Rows three and four are identical work on different deadlines, and only the deadline decides whether it is achievable. If you build or substantially modify a system you are its provider, and putting your own name on a third-party model can make you one, which is the classification most organisations get wrong. This is a planning estimate, not legal advice.

An EU AI Act obligation calculator sizes the work in front of you based on the role you hold for each AI system, which is the variable that actually determines the burden. Most tools on this topic are risk-tier quizzes that return a label and stop. A label is not a plan. What a team needs to know is how many obligations fall to them, how many hours that represents, and whether it can be finished before the date that matters.

The Act distinguishes between providers and deployers. A provider develops an AI system, or places one on the market under its own name or trademark, and carries the substantial obligations: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, and conformity assessment. A deployer merely uses a system someone else provides, and carries a much shorter list centred on using it as intended, maintaining human oversight, and monitoring operation. The calculator multiplies systems in each role by the obligations that role carries, converts to hours and cost, then compares against the capacity your team actually has before the deadline.

The result usually reveals a concentration worth acting on. A portfolio dominated by third-party tools you merely deploy is a manageable programme; a handful of systems you built or rebranded can account for the majority of the total workload despite being a minority of the portfolio. The calculator reports that provider share explicitly, because it tells you where to focus and it frames a build-versus-buy decision in regulatory terms: taking a system in-house, or putting your own brand on someone else's, changes your role and multiplies your obligations.

The critical caution is that role is a legal determination, not a self-assessment. Rebranding a third-party system, materially modifying it, or putting it to a purpose its provider did not intend can make you its provider under the Act even though you did not build it. Obligation counts also depend on the risk classification of each system and on guidance that continues to develop. This calculator sizes work and tests it against a deadline; it does not classify systems, assign roles, or determine compliance, and it is not legal advice. Use it to argue for resourcing, then have counsel confirm the roles and obligations it was given.

Provider or deployer is the whole question

A provider builds a system or puts its own name on one, and carries risk management, data governance, technical documentation, logging, oversight and conformity assessment. A deployer merely uses someone else's and carries a far shorter list. The same portfolio produces wildly different workloads depending on how the roles fall.

Rebranding can silently make you a provider

Putting your own trademark on a third-party system, materially modifying it, or using it for a purpose its provider never intended can shift you into the provider role for that system. It is a legal determination rather than a choice, and it is the most common way an organisation acquires obligations it never planned for.

Frequently asked questions

3 systems as provider and 12 as deployer, at 14 and 4 obligations each - what is the workload?

That is 42 provider obligations plus 48 deployer obligations, 90 in total. At 12 hours each that is 1,080 hours, about $108,000 at a $100 blended rate. Provider work is 47% of the total from just 3 of 15 systems, which is where the effort concentrates.

What is the difference between a provider and a deployer?

A provider develops an AI system or places it on the market under its own name, and carries the heavy obligations. A deployer uses a system provided by someone else, with a much shorter list focused on intended use, human oversight and monitoring. The distinction is legal, not descriptive.

Can I become a provider without building anything?

Yes. Placing a system on the market under your own name or trademark, making a substantial modification, or putting it to a purpose the original provider did not intend can all shift the role to you. This is the most common source of unplanned obligations, and it is worth checking with counsel before rebranding anything.

Does this tell me if my system is high-risk?

No, and that is deliberate. Risk classification depends on the use case, sector and Annex criteria, and it is a legal determination. This calculator takes your obligation counts as inputs and sizes the resulting work against your deadline, rather than pretending a short quiz can classify a system.