Skip to main content
Praxikon
Free check
Article 26 of 11323%
Nederlands

Article 26: Obligations of deployers of high-risk AI systems

Article 26 sets out what an organisation must do when it uses a high-risk AI system under its own authority: the deployer. In short: use the system in accordance with the instructions for use, have competent people exercise oversight, control the input data you manage, monitor operation, keep the logs for at least six months and inform workers before putting the system into service. Where you see a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority and suspend use. The duties apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.

, AI and privacy legal adviserobligations checked against the source on
Check your own case for free

Praxikon tracks Article 26 (Obligations of deployers of high-risk AI systems) under the EU AI Act, citing the source for every statement.

EU Official:
UpcomingAnnex III from 2 Dec 2027; Annex I from 2 Aug 2028
Title III: High-Risk AI Systems

Application dates

  • : Obligations for high-risk systems listed in Annex III
  • : Obligations for high-risk systems linked to Annex I

Official text

||

Source: EUR-Lex, Regulation (EU) 2024/1689. Text reproduced verbatim.

Download AI Act (PDF) →

Decision tree

What are your obligations as deployer of high-risk AI?

Article 26 applies to whoever uses a high-risk system under their own authority. For Annex III systems from 2 December 2027, for Annex I systems from 2 August 2028.

Question 1 · Art. 26(1) · art. 6

Do you use, under your own authority, an AI system that is high risk under Article 6?

Full diagram
  1. 1

    Do you use, under your own authority, an AI system that is high risk under Article 6?

    Art. 26(1) · art. 6

    • Yes → Question 2
    • No, or I do not know → Outcome A
  2. 2

    Do you put the system under your own name or trademark, make a substantial modification to it, or use it for a purpose other than the one the provider intended?

    Art. 25(1)

    • Yes → Outcome B
    • No → Question 3
  3. 3

    Have you identified a serious incident, meaning an incident or malfunctioning that directly or indirectly leads to death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment?

    Art. 26(5) · Art. 3(49)

    • Yes → Outcome C
    • No → Question 4
  4. 4

    Do you have reason to consider that use in accordance with the instructions may result in the system presenting a risk to the health, safety or fundamental rights of persons?

    Art. 26(5) · Art. 79(1)

    • Yes → Outcome D
    • No → Question 5
  5. 5

    Are you a public authority, or a Union institution, body, office or agency, or do you act on behalf of one of them?

    Art. 26(8) · Art. 49(3)

    • Yes → Outcome E
    • No → Question 6
  6. 6

    Are you a financial institution subject to requirements regarding internal governance, arrangements or processes under Union financial services law?

    Art. 26(5), second subparagraph · Art. 26(6), second subparagraph

    • Yes → Outcome F
    • No → Outcome G

Outcome A · Check further

First establish whether the system is high risk

Article 26 only applies to high-risk systems. Check the system against Article 6 and Annex III, or ask the provider for its classification. For other AI systems Article 4 and, depending on the function, Article 50 apply.

art. 6 · art. 4 · art. 50

Outcome B · Check further

You may become the provider: check Article 25

With your own name or trademark, a substantial modification or a changed intended purpose you may become the provider of the high-risk system yourself, with the heavier obligations of Article 16.

Art. 25(1) · art. 16

Outcome C · Applies

Report the serious incident immediately

Immediately inform first the provider, then the importer or distributor and the market surveillance authority. If you cannot reach the provider, the reporting procedure of Article 73 applies to you. If there is a risk within the meaning of Article 79(1), also suspend the use. The other obligations of Article 26 continue to apply as well.

Art. 26(5) · art. 73 · Art. 79(1)

Outcome D · Applies

Suspend the use and report without undue delay

Inform the provider or distributor and the market surveillance authority without undue delay, and suspend the use of the system. Suspension is not a choice but an obligation. The other obligations of Article 26 continue to apply as well.

Art. 26(5) · Art. 79(1)

Outcome E · Applies

Core obligations, plus registration and FRIA

Use the system in accordance with the instructions for use (paragraph 1); assign human oversight to people with the necessary competence, training, authority and support (paragraph 2); ensure input data is relevant and sufficiently representative to the extent you control it (paragraph 4); monitor the operation (paragraph 5); keep the automatically generated logs under your control for at least six months, unless other law provides otherwise (paragraph 6); and cooperate with the authorities (paragraph 12). In addition, for an Annex III system other than point 2 (critical infrastructure), you register yourself and the use in the EU database before putting into service or use (Article 49(3)). You do not use a system that is not registered in the EU database, and you inform the provider or distributor (paragraph 8). A public authority is as a rule also a body governed by public law within the meaning of Article 27: you then also carry out a FRIA for an Annex III system, except for critical infrastructure. For high-risk systems placed on the market or put into service before the date of application and intended to be used by public authorities, providers and deployers must comply by 2 August 2030 (Article 111(2)).

Art. 26(1) to (12) · Art. 26(8) · Art. 26(10) · Art. 49(3) · Art. 27(1) · Art. 111(2)

Outcome F · Applies

Core obligations, partly through your financial governance

Use the system in accordance with the instructions for use (paragraph 1); assign human oversight to people with the necessary competence, training, authority and support (paragraph 2); ensure input data is relevant and sufficiently representative to the extent you control it (paragraph 4); monitor the operation (paragraph 5); keep the automatically generated logs under your control for at least six months, unless other law provides otherwise (paragraph 6); and cooperate with the authorities (paragraph 12). For you the monitoring obligation is deemed fulfilled by complying with the governance rules of financial services law, and you keep the logs as part of the documentation under that law. If you use the system to evaluate the creditworthiness of natural persons (not: fraud detection) or for risk assessment and pricing in life and health insurance, a FRIA also applies (Article 27, Annex III point 5(b) and (c)).

Art. 26(5), second subparagraph · Art. 26(6), second subparagraph · Art. 27(1)

Outcome G · Applies

The core obligations of Article 26 apply

Use the system in accordance with the instructions for use (paragraph 1); assign human oversight to people with the necessary competence, training, authority and support (paragraph 2); ensure input data is relevant and sufficiently representative to the extent you control it (paragraph 4); monitor the operation (paragraph 5); keep the automatically generated logs under your control for at least six months, unless other law provides otherwise (paragraph 6); and cooperate with the authorities (paragraph 12). A system placed on the market or put into service before the date of application only falls under the regulation after a significant change in design from that date (Article 111(2)). If you provide public services as a private entity, a FRIA also applies for an Annex III system (Article 27), except for critical infrastructure. The same applies to any deployer using the system for the creditworthiness of natural persons (not: fraud detection) or for risk assessment and pricing in life and health insurance (Annex III point 5(b) and (c)).

Art. 26(1) to (12) · Art. 111(2) · Art. 27(1)

A decision tree simplifies. If you are unsure at a question, read the provision or have it assessed. Checked against the legal text on 1 October 2026.

Official guidance on this article

3

What does this mean for you?

Provider+
Article 26 addresses deployers, but they can only meet their duties with your information. Under Article 13, supply instructions for use covering the system's capabilities, limitations, oversight measures and logging. Set up a channel for reports on risks and serious incidents (Article 26(5) and Article 72).
Deployer+
If you use a high-risk AI system under your own authority, these duties apply by paragraph. Paragraph 1: use the system in accordance with the instructions for use and take technical and organisational measures to do so. Paragraph 2: assign human oversight to people with the necessary competence, training and authority, and give them the necessary support. Paragraph 4: ensure input data is relevant and sufficiently representative for the intended purpose, to the extent you control it. Paragraph 5: monitor operation; where you have reason to consider that use may present a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay and suspend use. Paragraph 6: keep the automatically generated logs under your control for at least six months, unless other Union or national law provides otherwise. Paragraph 7: as an employer, inform workers' representatives and the affected workers before putting the system into service at the workplace. A contract with the vendor does not remove these duties: Article 26 is addressed to the deployer itself.
SME / Startup+
Article 26 contains no general SME exemption. Good vendor management helps but does not replace your own duties. Record who exercises oversight, how monitoring and escalation work, who may decide to suspend use, which logs are available and when workers or other affected persons are informed.
Public Sector+
In addition to Article 26, check the registration duty for public deployers in Article 49 and the FRIA in Article 27. If an intended high-risk system is not in the EU database, do not use it and inform the provider or distributor (Article 26(8)). If the system was already in use before the date these duties apply, they apply only once it is significantly changed; systems intended for use by public authorities must comply by 2 August 2030 at the latest (Article 111(2)).

Article 26 checklist

  • Paragraph 1: instructions for use received from the provider, and use within those limits ensured with technical and organisational measures
  • Paragraph 2: human oversight assigned to named people with the necessary competence, training, authority and support
  • Paragraph 3: duties under other Union and national law (GDPR, sector rules, employment law) mapped alongside Article 26
  • Paragraph 4: recorded who controls the input data and, where you do, relevance and representativeness for the intended purpose checked
  • Paragraph 5: monitoring set up on the basis of the instructions for use, with a reporting route to the provider (Article 72)
  • Paragraph 5: where there is a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay and suspend use
  • Paragraph 5: for a serious incident, immediately inform the provider first, then the importer or distributor and the market surveillance authorities
  • Paragraph 6: automatically generated logs under your control kept for at least six months and retrievable
  • Paragraph 7: as an employer, workers' representatives and affected workers informed before putting the system into service at the workplace
  • Paragraph 8: as a public authority, registration under Article 49 completed and checked that the system is in the EU database
  • Paragraph 9: the provider's Article 13 information used for the DPIA, where Article 35 GDPR requires one
  • Paragraph 10: for post-remote biometric identification by law enforcement, the authorisation route followed
  • Paragraph 11: natural persons informed when an Annex III system makes or assists decisions about them
  • Paragraph 12: contact point and procedure set for cooperation with the competent authorities
  • Outside Article 26: a FRIA only where Article 27 applies, and AI literacy measures under Article 4

Related recitals

Recital 93Primary

Whilst risks related to AI systems can result from the way such systems are designed, risks can as well stem from how such AI systems are used. Deployers of high-risk AI system therefore play a critic…

Recital 94Primary

Any processing of biometric data involved in the use of AI systems for biometric identification for the purpose of law enforcement needs to comply with Article 10 of Directive (EU) 2016/680, that allo…

9596

Related tools

Provider or deployer?FRIA GeneratorAI Readiness ScorePenalty Calculator

Related enforcement

  • •
    CNIL fines Amazon €32 million for AI employee monitoringCNIL · Dec 2023↗
  • •
    Hungarian bank fined for AI-based customer profilingNAIH · Aug 2021↗

Related blog posts

Cross-references

Articles

Art. 6Art. 9Art. 13Art. 14Art. 27Art. 72Art. 79

Recitals

8990919293949596

Annexes

Annex 3

Frequently asked questions

What must a deployer do under Article 26 of the AI Act?+
Article 26 requires the deployer of a high-risk AI system, among other things, to use the system in accordance with the instructions for use (paragraph 1), assign human oversight to competent, trained people with authority (paragraph 2), control input data to the extent it controls that data (paragraph 4), monitor operation and report risks and serious incidents (paragraph 5), keep logs for at least six months (paragraph 6) and inform workers before putting the system into service (paragraph 7). Paragraphs 8 to 12 cover registration by public authorities, the DPIA, post-remote biometric identification, information to affected persons and cooperation with authorities.
How long must deployers keep the logs of a high-risk AI system?+
For at least six months, or longer where appropriate to the intended purpose of the system, unless other Union or national law, in particular data protection law, provides otherwise (Article 26(6)). This covers logs the system generates automatically that are under your control. Financial institutions keep the logs as part of the documentation required under financial services law.
What should I do in case of a risk or a serious incident with high-risk AI?+
Where you have reason to consider that use in accordance with the instructions may result in a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay, and suspend use. Suspension is then a duty, not an option. Where you identify a serious incident, immediately inform first the provider and then the importer or distributor and the market surveillance authorities (Article 26(5)).
Do I need to inform workers before using high-risk AI at the workplace?+
Yes, if you are an employer. Before putting into service or using a high-risk AI system at the workplace, inform workers' representatives and the affected workers that they will be subject to its use (Article 26(7)). Where applicable, follow the rules and procedures of Union and national law on informing workers.
Do I need to conduct a FRIA as a deployer?+
Only where Article 27 applies to your organisation and the specific system. The duty covers bodies governed by public law and private entities providing public services, except for critical infrastructure systems (Annex III point 2), and deployers of systems for creditworthiness and for life and health insurance (Annex III point 5(b) and (c)). So not every deployer of high-risk AI must carry out a FRIA.
What is the difference between a provider and a deployer?+
The provider develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark (Article 3(3)). The deployer uses an AI system under its authority, except for personal non-professional use (Article 3(4)). The provider has the Article 16 duties, the deployer those of Article 26.
When does a deployer become a provider under the AI Act?+
Under Article 25(1) in three cases: you put your name or trademark on a high-risk system already on the market (point a), you make a substantial modification to a high-risk system that remains high-risk (point b), or you change the intended purpose of an AI system that was not high-risk, including a general-purpose AI system, so that it becomes a high-risk system (point c). The provider obligations of Article 16 then apply.
What should I as deployer do if my AI vendor goes bankrupt?+
Your own duties continue if the provider is unavailable. Assess whether the system can still be used, monitored and overseen according to the instructions and whether the required logs and reporting channels remain available. If you cannot reach the provider about a serious incident, Article 73 applies mutatis mutandis (Article 26(5)). Suspend use if safe and compliant operation can no longer be ensured.
Do I as deployer need to retain the input and output data of the AI system?+
Article 26 contains no general duty to retain all input and output data. Automatically generated logs under the deployer's control are retained for at least six months, unless other Union or national law provides a different period.

What Article 26 requires in practice

Connections

What connects to Article 26 AI Act

Themes where this returns

Where this meets the other law

The counterpart in the other law

GDPR interpretation that also applies here6 of 28