The regulation distinguishes the provider, which develops an AI system or places it on the market under its own name, from the deployer, which uses it under its own authority. Obligations differ by role, and an organization can hold both, for example by substantially modifying a system.
Example
A company that uses a CV-screening tool bought from a vendor is a deployer; the vendor is the provider.