Skip to main content

EU AI Act Article 13: Transparency and Instructions for Use

Article 13 requires providers to give deployers instructions for use. This guide lists what they must contain and what deployers do with them.

Providers of high-risk AI systems must give deployers instructions for use and a transparent system (Article 13).

This applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) to systems placed on the EU market or put into service. Deployers are the organisations using the system. Transparency must let them interpret outputs (Article 13(1)). The instructions must name the provider, state tested accuracy and known risks, and describe human oversight (Article 13(3)). Fines reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: check them against Article 13(3).

The instructions for use must contain at least this information

Article 13(3) lists the minimum content in points (a) to (f). The cards below group those points. The instructions must be concise, complete, correct and clear, in an appropriate digital format or otherwise (Article 13(2)).

Provider identity and contact details

State the name and contact details of the provider and, where it has one, its authorised representative (Article 13(3)(a)).

Intended purpose and tested performance

State the intended purpose. State the level of accuracy, robustness and cybersecurity the system was tested and validated against and which can be expected, with its metrics. Add the circumstances that can affect that level (Article 13(3)(b)(i) and (ii)).

Known risks and foreseeable misuse

Describe known or foreseeable circumstances, including reasonably foreseeable misuse, that may lead to risks to health, safety or fundamental rights (Article 13(3)(b)(iii)).

Explanation, groups and data

Where applicable or appropriate, describe how the system explains its output, its performance for specific persons or groups, the input data specifications and the training, validation and testing data used (Article 13(3)(b)(iv) to (vii)).

Changes the provider pre-determined

List the changes to the system and its performance that you pre-determined at the initial conformity assessment (the check that a system meets the Act before launch), if any (Article 13(3)(c)).

Human oversight measures

Describe the human oversight measures under Article 14, including the technical measures that help deployers interpret outputs (Article 13(3)(d)).

Resources, lifetime, maintenance and logs

State the computing and hardware resources needed, the expected lifetime, and the maintenance, including its frequency and software updates (Article 13(3)(e)). Where relevant, describe the mechanisms that let deployers collect, store and interpret logs under Article 12 (Article 13(3)(f)).

Four ways to keep instructions accurate

Article 13 sets the content, not the process. These four practices keep the instructions complete and current.

Draft from existing documents

Take system facts from model cards, datasheets and evaluation reports, and keep the instructions in version control next to the code.

Track limitations and changes

Record every known limitation and failure mode in a changelog. Update the instructions whenever the system changes.

Report performance per group

Where appropriate, state the system’s performance for the specific persons or groups it is intended to be used on (Article 13(3)(b)(v)).

Explain how to read outputs

Tell deployers how to interpret outputs, for example with confidence scores or explanations where the system provides them, and which human oversight measures apply (Article 13(3)(b)(vii) and (d)).

Deployers use the instructions to meet their own duties

Deployers must take appropriate technical and organisational measures to use the system in line with its instructions for use (Article 26(1)). They also use the Article 13 information for their data protection impact assessment where one is required (Article 26(9)). A deployer can follow only what the instructions say.

Article 13 applies to high-risk AI systems only

A system is high-risk if it falls into an Annex III area, unless an Article 6(3) exemption applies. A system that profiles natural persons is always high-risk. A system is also high-risk if it is, or is a safety component of, an Annex I product needing third-party conformity assessment (Article 6). Providers are covered when they place a system on the EU market or put it into service in the EU, wherever they are established (Article 2(1)(a)). Providers and deployers in a third country are also covered when the system’s output is used in the EU (Article 2(1)(c)). High-risk systems tied to products under the Annex I Section B laws are outside Article 13 (Article 2(2)). For Annex I Section A products, some requirements may be limited (Article 2(13)). This concerns Articles 9 to 15 and 17 to 25, where sector law gives equivalent or higher protection. Delegated acts due by 2 August 2027 will specify which. The Act excludes military, defence and national security uses, systems developed solely for scientific research, and research and testing before market placement (Article 2(3), (6) and (8)). Systems already on the market or in service before the application date are covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

Common questions: format, open source, model cards and fines

What format must instructions for use take?

The Act sets no file format. Article 13(2) requires an appropriate digital format or another suitable form, with concise, complete, correct and clear information that deployers can access and understand. A PDF, a web page or documentation shipped with the software can meet this if it is complete and clear.

Does Article 13 apply to open-source AI?

Only if the system is placed on the market or put into service as a high-risk AI system (Article 2(12)). Then the provider must supply instructions for use even though the code is public.

How does Article 13 differ from Article 11 technical documentation?

Article 11 technical documentation is drawn up before market placement to show authorities and notified bodies (independent assessment bodies) that the system complies (Article 11(1)). Article 13 instructions go to deployers, so they can use the system correctly.

What if the deployer ignores the instructions?

The provider must supply accurate instructions (Article 13), and the deployer must use the system in line with them (Article 26(1)). A deployer that does not breaks its own duty and can be fined up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)).

Is a model card enough as instructions for use?

Only if it covers every point of Article 13(3), including provider contact details, human oversight measures and maintenance. Compare your model card with the cards above and add what is missing.

What are the fines, and is the cap lower for SMEs?

Fines for providers (Article 16) and deployers (Article 26) reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, including start-ups, and small mid-caps, the cap is the lower of the two amounts (Article 99(6) and (6a)). Member States lay down the penalty rules (Article 99(1)).

Read next: technical documentation, human oversight and deployer duties

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.