Article 26 requires deployers of high-risk AI systems to use the system in accordance with the provider's instructions for use, to assign human oversight to natural persons with the necessary competence, training and authority, to ensure input data are relevant and sufficiently representative where the deployer controls them, to monitor operation, to inform the provider and the authorities and suspend use where the system presents a risk, to inform the provider of serious incidents, to keep automatically generated logs, to inform workers and affected persons in the circumstances the article sets, and to comply with registration and fundamental rights impact assessment duties where they apply. The duties are operational: they concern how the system is actually used, by whom, with what data, and with what oversight, not only how it was procured.
What does use in accordance with instructions mean?
Article 26(1) requires deployers to take appropriate technical and organisational measures to ensure they use high-risk systems in accordance with the instructions for use supplied by the provider. Appropriate measures include training, procedures, configuration controls, and supervision that reflect the instructions, not merely filing the instructions. A deployer that uses a system for a purpose outside the instructions, or that disables an oversight or logging feature described in the instructions, is not using the system in accordance with them. The deployer should record the instructions version relied on, the measures taken to follow it, and any gap between the instructions and the actual deployment, and should raise gaps with the provider rather than working around them silently.
Who must be assigned to human oversight?
Article 26(2) requires deployers to assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Competence means the person understands the system, its limitations, and the decision being overseen. Training means the person has been trained on the system, the instructions, and the oversight task. Authority means the person can intervene, disregard, override or reverse the output, and can escalate where needed. Support means the person has the time, information and tools to oversee effectively. A named overseer without competence, training, authority or support does not satisfy the paragraph, even if the assignment is documented. The assignment should be recorded with the person's role, training, and authority, and reviewed when the system or the team changes.
For the broader regulatory framework, see deployer responsibilities.
What monitoring and risk duties apply during operation?
Article 26(5) requires deployers to monitor the operation of high-risk systems on the basis of the instructions for use, and, where relevant, to inform the provider. Where a deployer considers that the use of the system in accordance with the instructions may result in the system presenting a risk, it must inform the provider or distributor and the relevant market surveillance authority, and suspend the use of the system. Where the deployer identifies a serious incident, it must inform the provider first, and then the importer or distributor and the relevant market surveillance authority. Monitoring should therefore be an active duty with a defined owner, a review rhythm, and an escalation route, not a passive expectation that problems will be noticed.
What input data duties does a deployer hold?
Article 26(4) requires deployers to ensure, to the extent they exercise control over input data, that input data are relevant and sufficiently representative in view of the intended purpose of the system. A deployer that supplies its own data, selects the cases for assessment, or configures the data feeds controls the input data in the relevant sense, and must check relevance and representativeness before use and during operation. A deployer that only receives output, without control over inputs, should record that position and check the provider's input requirements instead. Input data checks should be documented, including the data sources, the representativeness assessment, and the action taken where data are incomplete or biased, because input quality directly affects output quality and fairness.
What information and registration duties apply?
Article 26(6) requires deployers to keep automatically generated logs for at least six months, unless Union or national law provides otherwise. Article 26(7) requires deployers to inform workers and their representatives, before putting into service or using a high-risk system at the workplace, that they will be subject to the use of the system, and to inform affected persons subject to a decision, in the circumstances the paragraph sets, about the use, the decision, and the right to an explanation under Article 86. Article 26(8) and Article 49 require deployers of certain high-risk systems, including public authorities and Annex III deployers in the situations the articles set, to register the use in the EU database. Each duty has its own trigger and should be checked separately, with the information, the audience, and the timing recorded.
Continue with deployer human oversight and monitoring.
What does this guide not decide?
This guide explains Article 26 in depth. It does not decide whether a particular deployment meets any paragraph, whether a fundamental rights impact assessment is required under Article 27, or whether a registration duty applies to a particular use. Those questions need the deployment facts, the instructions, the oversight design, the data, and the affected people, read against Articles 26, 27 and 49 in the consolidated text. Deployer duties are operational and fact sensitive, so consequential deployments should be confirmed with a competent authority or legal adviser, and with worker representatives and affected persons through the routes the applicable law provides, before first use.
Frequently asked questions
Does buying a system transfer deployer duties to the provider?
No. Deployer duties under Article 26 attach to the deployer that uses the system under its authority, separately from provider duties. Procurement terms can allocate information and cooperation, but they cannot transfer the statutory deployer duties.
Must a deployer suspend use if it suspects a risk?
Yes, where the deployer considers that use in accordance with the instructions may result in the system presenting a risk, Article 26(5) requires informing the provider or distributor and the market surveillance authority, and suspending use. The assessment should be recorded, with the risk, the evidence, and the action taken.
How long must a deployer keep logs?
At least six months under Article 26(6), unless Union or national law provides otherwise, for logs under the deployer's control. The period, the storage, and the access arrangements should be recorded, and reconciled with data protection retention rules.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗