Art.26

Article 26 — Obligations of Deployers of High-Risk AI Systems

SME Key SME Relevant ~3 min read · 653 words

Article 26 is the single most important article for the majority of businesses operating in the EU. Most companies are not building high-risk AI — they are buying and using it. This article defines what every deployer of a high-risk AI system must do: from implementing oversight measures to informing workers, monitoring performance, and notifying authorities of incidents.

! High compliance impact for SMEs

WHAT THE ARTICLE IS ABOUT

The compliance obligations of businesses that use high-risk AI

Article 26 is the deployer counterpart to Article 16’s provider obligations. It establishes a comprehensive set of duties for any organisation that deploys a high-risk AI system in a professional context — whether that means an HR team using an AI screening tool, a bank using a credit scoring model, or a public authority using a risk assessment system. If you use high-risk AI, this article governs what you must do.

WHAT IT SAYS

Twelve obligations across oversight, monitoring, disclosure and cooperation

Deployers must implement the human oversight measures specified by the provider in the instructions for use — and assign qualified, competent individuals to carry out that oversight
Deployers must use high-risk AI systems in accordance with the instructions for use provided under Article 13
Deployers must monitor the operation of the high-risk AI system and inform providers where they have reason to believe the system presents a risk
Where a serious incident is identified, deployers must immediately inform the provider, then the importer or distributor, and then the relevant market surveillance authority
Deployers must keep the automatically generated logs for at least six months
Deployers must carry out a data protection impact assessment where required by GDPR, using the information provided in the instructions for use
Where deployers control input data, they must ensure it is relevant and sufficiently representative for the intended purpose
Deployers who are employers must inform workers and their representatives before deploying a high-risk AI system in the workplace
Public authority deployers must comply with registration obligations and verify the system is registered in the EU database before use
Deployers must inform affected individuals that they are subject to the use of a high-risk AI system where decisions are made about them
Deployers must cooperate with competent authorities in any regulatory action taken
Deployers must suspend use of a system they believe presents a risk and notify the relevant parties without undue delay

WHO IS AFFECTED

Every business using high-risk AI in a professional context

HR departments using AI for recruitment, screening or performance assessment
Banks and lenders using AI for credit scoring or fraud detection
Healthcare providers using AI diagnostic or treatment tools
Educational institutions using AI for student assessment
Public authorities using AI for benefits, social services or law enforcement
Any business in any sector using a third-party AI system that falls within Annex III

WHAT IT MEANS FOR SMES

The deployer checklist every SME using third-party AI needs

Read and retain the provider’s instructions for use — your compliance starts there; everything else builds on what the provider has specified
Designate a named individual responsible for human oversight of each high-risk AI system you deploy — this must be a real role with real competence, not just a job title
Set up log retention for at least six months from the date of each system operation — check whether your vendor’s system retains logs on their side or whether you must do it
If you use AI to make or support decisions about employees, customers or service users, you must inform those individuals — build this disclosure into your standard processes
If you are an employer deploying AI in the workplace, inform your workers and their representatives before deployment — this is a legal obligation, not optional communication
Your GDPR data protection impact assessment must incorporate information from the AI system’s instructions for use — coordinate your AI compliance and data protection teams
Suspend use immediately if you identify a risk and notify the provider first, then authorities — have a documented procedure for this before you need it

Article 6 — High-risk classification (determines whether Article 26 applies to your AI use case)
Article 13 — Transparency (the instructions for use that deployers must follow)
Article 14 — Human oversight (the oversight measures deployers must implement)
Article 25 — Value chain responsibilities (when deployers become providers through modification)
Article 27 — Fundamental rights impact assessment (the deployer-specific assessment obligation)

← Back to the Guide