Article 26: Deployer Obligations for High-Risk AI
The deployer duties of EU AI Act Article 26: who counts as a deployer, when the duties apply, how they differ from Article 27 and the fines under Article 99(4).
Deployers of high-risk AI systems must follow the instructions for use, assign human oversight, monitor operation and keep logs (Article 26).
A deployer is any person or body that uses an AI system under its authority (Article 3(4)). The duties also reach deployers outside the EU if the output is used in the EU. They apply from 2 December 2027 (Annex III systems, e.g. hiring) or 2 August 2028 (Annex I systems). Fines reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: get the instructions for use from each provider.
Article 26 sets 11 duties for deployers
The cards below summarise Article 26. Paragraph 3 adds that these duties do not limit other deployer obligations under Union or national law.
Use the system as instructed
Take appropriate technical and organisational measures to use the system in line with its instructions for use (Article 26(1)).
Assign human oversight
Assign human oversight to natural persons who have the necessary competence, training and authority, and give them the support they need (Article 26(2)).
Check the input data
Where you control the input data, make sure it is relevant and sufficiently representative for the intended purpose of the system (Article 26(4)).
Monitor operation and report risks
Monitor operation on the basis of the instructions for use. If you have reason to think that use may present a risk (Article 79(1)), suspend use and inform the provider or distributor and the market surveillance authority without undue delay. After a serious incident, inform the provider first, then the importer or distributor and the market surveillance authorities, immediately. If you cannot reach the provider, Article 73 applies (Article 26(5)). This duty does not cover sensitive operational data of deployers that are law enforcement authorities. Financial institutions subject to internal governance rules under Union financial services law meet the monitoring duty by complying with those rules.
Keep the logs
Keep the logs the system generates automatically, as far as they are under your control, for a period that fits the intended purpose and for at least six months, unless other Union or national law says otherwise (Article 26(6)). Financial institutions keep them as part of their financial-services documentation.
Inform workers
Employers must inform workers’ representatives and the affected workers before they put a high-risk system into service or use it at the workplace (Article 26(7)).
Register the use (public authorities)
Public authorities and Union bodies must comply with the registration duties of Article 49. If a system they plan to use is not registered in the EU database, they must not use it and must inform the provider or distributor (Article 26(8)).
Use provider information for the DPIA
Where applicable, use the information the provider gives under Article 13 to carry out your data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680 (Article 26(9)).
Request authorisation for post-remote biometric identification
For a targeted search for a person suspected or convicted of a criminal offence, request authorisation from a judicial authority or a binding administrative authority before using a post-remote biometric identification system, or within 48 hours at the latest. The exception is the initial identification of a potential suspect based on objective and verifiable facts. Untargeted use is not allowed, each use is documented in the police file, and annual reports go to the authorities (Article 26(10)).
Inform affected persons
Deployers of Annex III systems that make or assist decisions about natural persons must inform those persons that they are subject to the use of the system. For law enforcement uses, Article 13 of Directive (EU) 2016/680 applies (Article 26(11)).
Cooperate with authorities
Cooperate with the competent authorities in any action they take in relation to the system to implement the Regulation (Article 26(12)).
The role follows the use: some deployers become providers
You are a deployer if you use an AI system under your authority, whoever built it (Article 3(4)). A company that builds a system and uses it itself is both provider and deployer, because putting into service includes use for own purposes (Article 3(11)).
A deployer becomes the provider, with the Article 16 duties, in three cases (Article 25(1)). It puts its name or trade mark on a high-risk system. It makes a substantial modification that leaves the system high-risk. Or it changes the intended purpose of a system so that it becomes high-risk. The initial provider does not have to cooperate with the new provider if it clearly specified that its AI system is not to be changed into a high-risk AI system (Article 25(2)).
Article 26 and Article 27 are separate duties
Article 26 applies to every deployer of a high-risk AI system. Article 27 adds a fundamental rights impact assessment for some deployers only: bodies governed by public law, private entities providing public services, and deployers of credit scoring or life and health insurance systems. Article 26 itself contains no such assessment.
Dates, limits and fines for deployers
Application dates
Article 26 applies from 2 December 2027 to Annex III systems and from 2 August 2028 to Annex I systems (Article 113). A high-risk system placed on the market before its date of application is covered only if its design changes significantly afterwards (Article 111(2)). In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).
Where Article 26 does not apply
Article 26 does not apply to systems related to Annex I Section B products (Article 2(2)), to natural persons who use AI systems in a purely personal non-professional activity (Article 2(10)), or to AI systems used exclusively for military, defence or national security purposes (Article 2(3)). For Annex I Section B products, Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems have been integrated in that Union harmonisation legislation.
Fines
A breach of the deployer obligations of Article 26 can be fined up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)(e)). For SMEs, including start-ups, and for small mid-caps the fine is capped at the lower of the two amounts (Article 99(6) and (6a)).
How Scanara supports deployers
Scanara runs a guided assessment of the Article 26 deployer duties, links it to a data protection impact assessment where personal data is processed, and records log-retention evidence. Where Article 27 applies, a second guided assessment structures the fundamental rights impact assessment. You decide what applies to you and carry out the duties.
Common questions about deployer duties
Does Article 26 apply to AI systems used only inside my company?
Yes. A deployer is defined by using a system under its authority, not by who built it (Article 3(4)). A company that builds a high-risk system and uses it itself is both provider and deployer, so Articles 16 and 26 both apply. Development and testing before the system is placed on the market or put into service are outside the Regulation (Article 2(8)), except testing in real-world conditions.
What must a deployer do after a serious incident?
A deployer that identifies a serious incident must immediately inform first the provider, then the importer or distributor and the market surveillance authorities (Article 26(5)). A serious incident is an incident or malfunctioning that directly or indirectly leads to death or serious harm to health, a serious and irreversible disruption of critical infrastructure, an infringement of obligations under Union law that protect fundamental rights, or serious harm to property or the environment (Article 3(49)). Suspending use is required where the deployer has reason to consider that use presents a risk within the meaning of Article 79(1).
Do SMEs get relief from deployer obligations?
No. Article 26 has no size-based exemption. SMEs, including start-ups, and small mid-caps face fines of up to the lower of the two amounts (Article 99(6) and (6a)). Financial institutions that follow Union internal governance rules keep the logs as part of the documentation they maintain under financial services law (Article 26(6)).
Read the detail behind each duty
Article 27: fundamental rights impact assessment
Covers which deployers must assess the impact on fundamental rights before first use.
Article 16: provider obligations
Covers the 12 duties of providers, so you know what to ask your provider for.
Article 14: human oversight
Covers how providers must design systems for human oversight, which your assigned staff carry out.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.