Skip to main content
Praxikon
Comparisons

Comparison

Article 26 versus Article 27: using and assessing

The difference

Article 26 applies to every deployer of a high-risk AI system and sets out how they have to deploy, monitor and oversee it. Article 27 applies only to a subset of that group and asks, on top of that, for an assessment of the consequences for fundamental rights, before the system is put into use.

The official source remains authoritative. This is general interpretation and not legal advice about your situation.

The fields side by side

Every row comes from the objects themselves. Where a field is empty, it says so; we do not fill in an assumption where the source is silent.

Status

Article 26, use
Upcoming
Article 27, FRIA
Upcoming

Applies from

Article 26, use
2 December 2027
Article 27, FRIA
2 December 2027

Who carries the duty

Article 26, use
Deployer, Body governed by public law
Article 27, FRIA
Credit or insurance deployer, Body governed by public law, Private provider of public services

Who is affected

Article 26, use
Not recorded
Article 27, FRIA
Not recorded

Who supervises

Article 26, use
Market surveillance authority
Article 27, FRIA
Not recorded

When this applies

Article 26, use
Applies as soon as you use a high-risk AI system under your own authority (Article 3(4)), whether you built it yourself or procured it. For the standalone Annex III route (Article 6(2)) the date is 2 December 2027; for the embedded Annex I route (Article 6(1)) the date is 2 August 2028.
Article 27, FRIA
The system is high-risk under Article 6(2) and Annex III, excluding Annex III point 2. The deployer is a body governed by public law, a private provider of public services or uses a relevant system in Annex III point 5(b) or 5(c).

Exceptions

Article 26, use
Article 2(10) excludes natural persons using an AI system in the course of a purely personal, non-professional activity. For deployers that are financial institutions subject to internal governance requirements under Union financial services law, the monitoring obligation in paragraph 5 is deemed fulfilled by complying with those rules, and the logs under paragraph 6 are maintained as part of the documentation kept under that law.
Article 27, FRIA
In the situation covered by Article 46(1), an exemption from notification may apply. This does not generally remove the assessment itself.

First actions

Article 26, use
Assign human oversight and give those people a mandate
Article 27, FRIA
Perform a FRIA before deployment

Evidence that belongs with it

Article 26, use
Deployment dossier: logs, worker information and information to affected persons
Article 27, FRIA
FRIA report and notification

Control

Article 26, use
Suspension and incident notification control
Article 27, FRIA
Pre-deployment FRIA go/no-go

Version and review status

Article 26, use
v1.0.0, placed against the official source
Article 27, FRIA
v1.0.0, placed against the official source
Article 26: obligations of deployers of high-risk AI systemsArticle 27: FRIA

Official sources and locators

Per side, the provisions the statements above rest on.

Article 26, use

Article 27, FRIA

  • EU Artificial Intelligence Act 2024/1689

    Locator: Article 27(1)-(5)

    Open official source

  • Digital Omnibus on AI 2026/1744

    Locator: Amended application schedule and Article 27 DPIA cross-reference

    Open official source

  • EU Artificial Intelligence Act 2024/1689

    Locator: Article 27(1)

    Open official source

  • Digital Omnibus on AI 2026/1744

    Locator: Article 27 amendment on DPIA inclusion or cross-reference

    Open official source

Referring to these two objects

Each side has its own stable identifier, version and hash. Take them separately; you cite a comparison by citing the two objects.

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Article 26: obligations of deployers of high-risk AI systems",
praxikon:eu:ai-act:obligation:article-26-deployer-obligations@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0 (schema 1.4.0),
effective_at 2026-08-08T00:00:00.000Z, known_at 2026-08-08T00:00:00.000Z,
sha256 0269a6f883187fb177f26dc8563b035927e5d2ae021e35254c98fce04d637f0c,
https://www.praxikon.com/en/verplichtingen/article-26-deployer-obligations
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-26-deployer-obligations&effective_at=2026-08-08&known_at=2026-08-08&lang=en, accessed 2026-08-24)

Short form

praxikon:eu:ai-act:obligation:article-26-deployer-obligations@1.0.0 (sha256 0269a6f8)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-26-deployer-obligations-1-0-0,
  author       = {{Praxikon}},
  title        = {Article 26: obligations of deployers of high-risk AI systems},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-26-deployer-obligations},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.1.0, schema 1.4.0},
  note         = {effective_at 2026-08-08T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 0269a6f883187fb177f26dc8563b035927e5d2ae021e35254c98fce04d637f0c},
  url          = {https://www.praxikon.com/en/verplichtingen/article-26-deployer-obligations},
  urldate      = {2026-08-24},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-26-deployer-obligations@1.0.0",
    "type": "dataset",
    "title": "Article 26: obligations of deployers of high-risk AI systems",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-26-deployer-obligations",
    "URL": "https://www.praxikon.com/en/verplichtingen/article-26-deployer-obligations",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          8,
          8
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          8,
          24
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0; schema 1.4.0; effective_at 2026-08-08T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 0269a6f883187fb177f26dc8563b035927e5d2ae021e35254c98fce04d637f0c; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-26-deployer-obligations&effective_at=2026-08-08&known_at=2026-08-08&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Article 27: FRIA",
praxikon:eu:ai-act:obligation:article-27-fria@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0 (schema 1.4.0),
effective_at 2026-07-27T00:00:00.000Z, known_at 2026-08-08T00:00:00.000Z,
sha256 498c93501f9972d34831aea9c643908d910568bd188c1f76ddb2786c3836b98e,
https://www.praxikon.com/en/verplichtingen/article-27-fria
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-27-fria&effective_at=2026-07-27&known_at=2026-08-08&lang=en, accessed 2026-08-24)

Short form

praxikon:eu:ai-act:obligation:article-27-fria@1.0.0 (sha256 498c9350)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-27-fria-1-0-0,
  author       = {{Praxikon}},
  title        = {Article 27: FRIA},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-27-fria},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.1.0, schema 1.4.0},
  note         = {effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 498c93501f9972d34831aea9c643908d910568bd188c1f76ddb2786c3836b98e},
  url          = {https://www.praxikon.com/en/verplichtingen/article-27-fria},
  urldate      = {2026-08-24},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-27-fria@1.0.0",
    "type": "dataset",
    "title": "Article 27: FRIA",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-27-fria",
    "URL": "https://www.praxikon.com/en/verplichtingen/article-27-fria",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          8,
          8
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          8,
          24
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0; schema 1.4.0; effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 498c93501f9972d34831aea9c643908d910568bd188c1f76ddb2786c3836b98e; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-27-fria&effective_at=2026-07-27&known_at=2026-08-08&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

Execution

Run the assessment and keep the file together

An assessment of fundamental rights consequences touches the DPIA, the register and human oversight, and in practice those four drift apart. Praxikon does not carry that out; Embed AI runs the assessment with your team and delivers the evidence file.

See the Embed AI approach

Other comparisons

Unsure about your role itself rather than the duties that come with it? Work out whether you are a provider or a deployer