EU AI Act: Obligations for Deployers of High-Risk AI Systems (Article 26)

You Don't Have to Build AI to Have AI Act Obligations

Most EU AI Act commentary focuses on AI developers — the companies that train models and build systems. But the regulation imposes a parallel set of obligations on a second category: deployers.

A deployer is any natural or legal person, public authority, agency, or body that uses an AI system under its own authority in a professional context. If you purchase, license, or integrate a third-party AI system and use it to make or inform decisions — about job applicants, customers, patients, or citizens — you are a deployer.

For high-risk AI systems, Article 26 sets out 12 distinct obligations for deployers. These apply regardless of how compliant your supplier is. They apply from 2 August 2026 (postponed to 2 December 2027 under the AI Omnibus agreement).

Who Is a Deployer?

The AI Act defines a deployer as any entity using an AI system "under its own authority in a professional context" — other than the provider of that system.

Practical examples:

A bank using a third-party AI credit scoring tool to process loan applications → deployer
An HR team using an AI-powered ATS to screen job candidates → deployer
A hospital using an AI diagnostic support system → deployer
A public authority using an AI system to process benefit claims → deployer
A company using an AI performance monitoring tool to evaluate employees → deployer

Important distinction from providers: If you integrate a third-party AI model into a product you then sell to others, you are a provider of the resulting system — not just a deployer. Article 25 addresses this "provider-becomes-provider" dynamic along the value chain.

The 12 Obligations of Article 26

Obligation 1 — Follow the Instructions for Use (Article 26(1))

Deployers must use high-risk AI systems "in accordance with the instructions for use" provided by the provider under Article 13. This is not a passive obligation. If the provider's instructions specify limitations on intended use, geographic scope, or population types, you must respect them.

Using a system outside its intended purpose — even if technically possible — can shift liability to the deployer and potentially reclassify the deployer as a provider for that modified use.

Obligation 2 — Assign Competent Human Oversight Personnel (Article 26(1) and 26(2))

Deployers must assign oversight of the system to natural persons who have the necessary competence, training, and authority to:

Understand the system's capabilities and limitations
Monitor its operation
Intervene and override the system when necessary

This is not simply a requirement to have a human "in the loop" — it requires that the human has the actual authority and practical ability to override the system. A process where AI outputs are rubber-stamped without genuine review does not satisfy Article 26.

Obligation 3 — Ensure Input Data Quality (Article 26(4))

Where deployers have control over the input data fed into the high-risk AI system, they must ensure that data is "relevant and sufficiently representative" for the intended purpose.

This obligation overlaps significantly with GDPR data quality requirements (Article 5(1)(d) GDPR). For deployers processing personal data through AI systems, both frameworks apply simultaneously.

Obligation 4 — Monitor Operation and Report Risks (Article 26(5))

Deployers must monitor the operation of the high-risk AI system on the basis of the instructions for use. If they identify a risk to health, safety, or fundamental rights, or a serious incident occurs, they must:

Inform the provider without undue delay
If the system has been suspended, inform the relevant market surveillance authority

This creates an ongoing monitoring obligation — not just a deployment-time check. Deployers need processes to detect when AI outputs are drifting, producing unexpected results, or causing harm.

Obligation 5 — Retain Automatically Generated Logs (Article 26(6))

Deployers must retain the logs automatically generated by the high-risk AI system for a minimum of six months, unless applicable law (including GDPR) requires a different retention period.

These logs serve two purposes: post-market monitoring by the deployer, and investigation by competent authorities in the event of an incident or audit.

Practical implication: Deployers must verify that the AI system they are using actually generates logs, that those logs are accessible to the deployer (not only to the provider), and that they have a documented log retention process.

Obligation 6 — Inform Workers Before AI Deployment (Article 26(7))

Before deploying a high-risk AI system that directly affects workers — whether for monitoring, performance evaluation, task allocation, or similar purposes — deployers must inform:

The workers or employees concerned
Workers' representatives (unions, works councils) where applicable

This notification must occur beforehand — before the system is put into operation, not concurrent with deployment. It is a substantive obligation, not merely a formality.

Obligation 7 — Do Not Deploy Unregistered Systems (Article 26(8))

Public authorities deploying Annex III high-risk AI systems must verify that the system is registered in the EU database for high-risk AI systems before deploying it. If it is not registered, they must inform the provider and refrain from using the system.

Private deployers do not have this same verification obligation — but public authorities deploying AI systems that turn out to be unregistered face direct liability.

Obligation 8 — Use Provider Information for Data Protection Assessments (Article 26(9))

Where a high-risk AI system processes personal data, deployers must use the information provided by the AI provider (under Article 13) to satisfy their data protection impact assessment obligations under:

Article 35 of the GDPR (Data Protection Impact Assessment — DPIA)
Article 27 of Law Enforcement Directive 2016/680

In practice: the provider's technical documentation and instructions for use should serve as a key input to your DPIA. If the provider has not provided sufficient information, request it — you need it to meet both your GDPR and AI Act obligations.

Obligation 9 — Notify Affected Individuals (Article 26(11))

Deployers must inform the natural persons who are subject to the use of a high-risk AI system that they are interacting with or being assessed by such a system. This applies before or at the time of use.

This notification obligation applies on top of any GDPR transparency requirements. For AI systems that make decisions affecting individuals — credit, hiring, benefits — a clear, accessible disclosure is mandatory.

Obligation 10 — Cooperate With Competent Authorities (Article 26(12))

Deployers must cooperate with national competent authorities and the AI Office in the implementation and enforcement of the AI Act. This includes providing information, access to systems, and documentation upon request.

Obligation 11 — Special Rules for Law Enforcement Biometrics (Article 26(10))

Law enforcement deployers using remote biometric identification systems in public spaces must obtain judicial or administrative authorisation before each use (where not exempted under Article 5 exceptions). They must maintain strict documentation and submit annual reports to their national supervisory authority and the AI Office.

Obligation 12 — Fundamental Rights Impact Assessment for Certain Deployers (Article 27)

This obligation applies specifically to:

Public bodies and private entities providing public services deploying any Annex III high-risk system
Any deployer using high-risk AI for creditworthiness assessment, life and health insurance risk pricing, or emergency call evaluation (Annex III §5(b) and §5(c))

Before deploying such systems, these deployers must conduct a Fundamental Rights Impact Assessment (FRIA) covering:

A description of the deployer's processes in which the system will be used
The time period and frequency of use
Categories of natural persons and groups likely to be affected
Specific risks of harm to those categories
Human oversight measures to be implemented
Mitigation measures if risks materialise

The completed FRIA must be notified to the relevant market surveillance authority using templates provided by the AI Office.

Provider vs. Deployer: Where the Line Falls

Action	Provider Obligation	Deployer Obligation
Build the AI system	✓ Full compliance framework	—
Conduct conformity assessment	✓ Required	—
Draw up EU Declaration of Conformity	✓ Required	—
Register in EU database	✓ Required	Public authorities must verify
Provide instructions for use	✓ Required (Art. 13)	Must follow them
Implement human oversight	✓ Design it into the system	✓ Assign competent personnel
Retain logs	—	✓ Min. 6 months
Notify workers	—	✓ Before deployment
Conduct FRIA	—	✓ For qualifying deployers
Monitor and report incidents	✓ Post-market surveillance	✓ Operational monitoring

The FRIA vs. the DPIA: What Is the Difference?

A common source of confusion for organisations already GDPR-compliant.

Dimension	DPIA (GDPR)	FRIA (AI Act)
Legal basis	GDPR Article 35	AI Act Article 27
Focus	Risks to personal data	Risks to fundamental rights broadly
Triggered by	High-risk processing of personal data	Qualifying Annex III AI systems
Who conducts it	Controller (data)	Deployer (AI)
Covers	Data processing risks	AI decision risks — including non-data rights
Notification	To DPA (in some cases)	To market surveillance authority

For most high-risk AI systems that also process personal data, both assessments are required. The AI Act explicitly states that provider-supplied documentation should feed into the deployer's DPIA — the two processes are meant to be coordinated, not duplicated.

Compliance Checklist for Deployers

Before deploying a high-risk AI system:

Confirm the system is high-risk under Annex III
Obtain and review the provider's instructions for use (Article 13)
Identify and train human oversight personnel with authority to override
Verify the system generates accessible logs
Implement a log retention process (minimum 6 months)
Notify affected workers and representatives before deployment
For public authorities: confirm the system is registered in the EU database
Conduct a DPIA if personal data is processed
If a qualifying deployer: conduct and notify the FRIA before deployment
Establish ongoing monitoring and incident reporting process

How DilAIg Helps Deployers

DilAIg's 50-question audit covers both the provider and deployer dimensions. For deployers, the audit identifies:

Whether the systems you are using are high-risk under Annex III
Which Article 26 obligations apply to your specific context
Whether you are a qualifying deployer under Article 27 (FRIA requirement)

For qualifying deployers, DilAIg generates the FRIA as a professional draft structured to Article 27 and the AI Office's templates — ready for legal review and authority notification.

Start your free AI Act audit →

See the documents DilAIg generates →

FAQ: Deployer Obligations Under Article 26

I use AI provided by a vendor. Am I a deployer?

Yes, if you use it in a professional context under your own authority. Your vendor's AI Act compliance does not eliminate your deployer obligations under Article 26.

Does Article 26 apply to minimal-risk AI tools?

No. Article 26 obligations apply specifically to high-risk AI systems as defined by Article 6 and Annex III. Using a basic productivity AI tool does not trigger these obligations.

How do I know if I am a qualifying deployer for the FRIA?

You are required to conduct a FRIA if you are a public body or private entity providing public services deploying any Annex III system, or if you are any deployer using AI for creditworthiness assessment, life/health insurance pricing, or emergency dispatch. Private sector deployers in other Annex III domains are not required to conduct a FRIA — but may choose to document one as a risk management measure.

What happens if my AI provider does not give me adequate instructions?

Request them explicitly — you need them to meet your obligations under Article 26(1) and (9). If the provider cannot or will not supply adequate documentation, consider whether the system is appropriate to deploy. If a serious incident occurs and you lack documentation, you will face difficulty demonstrating compliance.

When must the worker notification happen?

Before deployment — prior to the system being put into operation for the first time in a context that affects workers. It is not sufficient to notify workers after the system is already running.

Key Takeaways

Deployers of high-risk AI systems have 12 distinct obligations under Article 26, applying from 2 August 2026 (postponed to 2 December 2027 under the AI Omnibus agreement)
Core obligations: follow instructions for use, assign competent human oversight, retain logs ≥ 6 months, notify workers before deployment, monitor and report incidents
FRIA (Article 27) is required for public bodies, entities providing public services, and deployers of credit, insurance, or emergency AI systems
The FRIA and DPIA are distinct assessments — both may be required for the same system
Provider compliance does not eliminate deployer obligations — both sides of the chain have independent duties
DilAIg's audit identifies your deployer obligations article by article and generates the FRIA draft