EU AI Act Article 26 — Deployer Obligations

What Article 26 actually requires

Article 26 of Regulation (EU) 2024/1689 lists the obligations on deployers of high-risk AI systems — the entities that use AI systems under their authority within the Union.

The principal obligations

• 26(1) — Take appropriate technical and organisational measures to ensure use of the system in accordance with the Article 13 instructions for use.
• 26(2) — Assign human oversight to natural persons who have the necessary competence, training, authority and support to perform the Article 14 tasks.
• 26(3) — These obligations are without prejudice to other deployer obligations under Union or national law and do not affect the deployer's discretion over how to organise its resources, provided the human-oversight measures referred to in Article 14 are met.
• 26(4) — To the extent the deployer exercises control over input data, ensure that input data is relevant and sufficiently representative in view of the intended purpose.
• 26(5) — Monitor the operation of the high-risk AI system based on the IFU and, where relevant, inform providers in accordance with Article 72; if there is reason to consider that use may pose a risk under Article 79(1), inform the provider, the importer or distributor and the relevant market surveillance authority without undue delay and suspend the use of the system. If a serious incident has been identified, the deployer also informs first the provider and then the relevant authorities under Article 73.
• 26(6) — Keep the Article 12 automatic logs, to the extent such logs are under deployer control, for a period appropriate to the intended purpose of at least six months unless otherwise provided.
• 26(7) — Workplace deployer obligation: before putting into service or use a high-risk AI system at the workplace, deployers who are employers shall inform workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system, in accordance with national rules and practices.
• 26(8) — Deployers that are public authorities or Union institutions shall comply with the Article 49 registration obligations. If the high-risk system is not registered, the deployer must not use it and shall inform the provider or the distributor.
• 26(9) — Where applicable, use the information provided under Article 13 to comply with the deployer's obligation to carry out a DPIA under Article 35 GDPR or Article 27 of Directive (EU) 2016/680.
• 26(10) — In specific Annex III §1 biometric law-enforcement contexts, deployers must request authorisations under additional conditions (real-time RBI etc.).
• 26(11) — Without prejudice to Article 50, deployers of high-risk systems referred to in Annex III making decisions or assisting in decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system, where applicable.
• 26(12) — Deployers shall cooperate with relevant competent authorities in any action those authorities take in relation to the high-risk AI system.

Who is covered

Every entity using a high-risk AI system under its authority within the Union — banks, hospitals, ministries, schools, employers, insurers, law-enforcement agencies. Deployer status is independent of whether you bought the system commercially or built it in-house.

What to do

• Map your obligation under Article 26 against your operational reality. Where you are not yet compliant, set a 90-day plan with named owners.
• For workplace deployments under Article 26(7): consult workers' representatives before put-into-service.
• For public-sector deployers: register in the EU Database under Article 49 + 26(8).
• For Article 27 covered deployers: perform the FRIA in addition to Article 26.

Inline crosswalk

• ISO/IEC 42001:2023 Annex A.6.2.8 — Operation and monitoring of AI systems.
• ISO/IEC 42001:2023 Annex A.9.2 — Human oversight.
• NIST AI RMF MANAGE 4.1 — Post-deployment monitoring plans implemented.
• NIST AI RMF GOVERN 3.2 — Roles and responsibilities for human-AI configurations.

Penalties

Article 99(4)(c) — up to €15 million or 3% of worldwide annual turnover.

---

Disclaimer. Reference; not legal advice. Verify with counsel. Reg text from Regulation (EU) 2024/1689.