European Union
EU AI Act Article 26: What Deployers of High-Risk AI Systems Must Do
Most companies using high-risk AI didn't build it, which makes Article 26 the part of the Act they will actually be held to. Here are the twelve duties, who they apply to, and where the exceptions are.
Timing note: The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the application date for standalone Annex III high-risk systems from August 2, 2026 to December 2, 2027, and for high-risk systems embedded in Annex I products to August 2, 2028. See our implementation timeline for what applies today.
Most of the EU AI Act's high-risk rules are written for the company that builds the system. Article 26 is the one written for everyone else: the bank, hospital, retailer or employer that buys or licenses a high-risk system and puts it to work. It is short, but it is where a deployer's real exposure sits, and it is easy to underestimate because the provider carries the heavy paperwork.
The twelve duties, grouped by what they ask of you
Use the system the way it was designed to be used (paragraphs 1 and 3). A deployer must take appropriate technical and organisational measures to use the system in line with the provider's instructions for use. Those duties sit on top of any other EU or national law, and the deployer stays free to organise its own resources to implement the provider's human oversight measures.
Put a competent person in charge (paragraph 2). Human oversight must be assigned to natural persons who have the necessary competence, training and authority, as well as the support they need. A name on a form is not enough; Article 14 explains what the system must let that person do.
Control your input data (paragraph 4). To the extent the deployer controls the input data, it must ensure the data is relevant and sufficiently representative for the system's intended purpose.
Monitor, and report problems (paragraph 5). The deployer monitors the system's operation against the instructions for use and, where relevant, informs the provider. If it has reason to believe use may present a risk, it must inform the provider (or distributor or importer) without undue delay and suspend use, and tell the relevant market surveillance authority. For a serious incident, it informs the provider first, then the importer or distributor and the authorities, immediately.
Keep logs (paragraph 6). Automatically generated logs that are under the deployer's control must be kept for at least six months, unless other EU or national law, particularly data protection law, requires otherwise. See Article 12 for what the system itself must record.
Tell the people affected (paragraphs 7 and 11). Before putting a high-risk system into service or using it at the workplace, employers must inform workers' representatives and the affected workers that they will be subject to it. Separately, deployers of Annex III systems that make or help make decisions about natural persons must inform those persons that the system is being used.
Public-sector duties (paragraph 8). Public authorities and EU bodies that deploy high-risk systems must comply with the registration obligations in Article 49. If a system is not registered in the EU database, they must not use it and must tell the provider, distributor or importer.
Data protection impact assessment (paragraph 9). Where applicable, deployers must use the information the provider gives them under Article 13 to carry out a GDPR Article 35 data protection impact assessment.
Remote biometric identification after the fact (paragraph 10). Targeted searches for suspects or convicts require prior authorisation from a judicial or administrative authority, with narrow exceptions and a 48-hour outer limit on authorisation requests, and strict limits on use, documentation and annual reporting. This paragraph only matters to law enforcement users.
Cooperate with authorities (paragraph 12). Deployers must cooperate with competent authorities on any action they take in relation to the system.
The exceptions that matter
Financial institutions that are already subject to EU internal-governance rules get two accommodations: compliance with those rules counts as meeting the monitoring duty, and they keep logs as part of the documentation required under financial services law. Law enforcement users are excluded from reporting sensitive operational data from criminal investigations in incident and biometric reports.
What Article 26 does not cover
Article 26 is the baseline, not the whole picture for a deployer. Three adjacent obligations are easy to miss:
- Fundamental rights impact assessment. Some deployers must also complete one before first use. See Article 27.
- Transparency duties under Article 50, which apply on their own timeline.
- Provider status under Article 25. Rebranding a high-risk system, substantially modifying it, or changing its purpose so that it becomes high-risk shifts the provider's obligations onto you.
A practical starting point
Before December 2027, a deployer can do most of the groundwork now: inventory which systems are high-risk and which role you hold for each, name an accountable overseer for each with documented training, confirm with each vendor that you will receive instructions for use, and decide where logs will live and who owns them. The high-risk classification guide helps with the first step. We have summarized the obligations from the official text; where your situation touches a financial-services or law-enforcement exception, read the regulation itself before relying on it.
See every upcoming date on our AI compliance deadlines calendar.
Frequently asked questions
- Who is a deployer under the EU AI Act?
- A deployer is a natural or legal person, public authority, agency or other body that uses an AI system under its own authority, except for purely personal, non-professional use. A bank using a third-party credit-scoring model, or an employer using a CV-ranking tool, is a deployer. The company that built the system is the provider.
- When does Article 26 apply?
- For deployers of standalone high-risk systems listed in Annex III (employment, credit, education, biometrics and similar), from December 2, 2027, after the Digital Omnibus on AI moved the original August 2, 2026 date. For high-risk systems that are safety components of products covered by Annex I, it is August 2, 2028.
- How long must a deployer keep high-risk AI logs?
- At least six months, to the extent the logs are under the deployer's control, unless other EU or national law, particularly data protection law, requires a different period. Financial institutions keep the logs as part of the documentation they already maintain under financial services law.
- Do deployers have to tell people that a high-risk AI system is being used?
- Yes, in two ways. Employers must inform workers' representatives and affected workers before using a high-risk system at the workplace. And deployers of Annex III systems that make or help make decisions about natural persons must inform those people that the system is being used.
- Can a deployer become a provider?
- Yes. Under Article 25, a deployer that puts its own name or trademark on a high-risk system, makes a substantial modification to it, or changes its intended purpose so that it becomes high-risk takes on the provider's obligations. Check this before assuming Article 26 is the only set of duties that applies to you.
Sources & references
Suggested next reading
regulations eu