Article 26: Deployer Obligations
Article 26 sets out what organisations using a high-risk AI system in the course of a professional activity must do: use it according to the instructions for use, assign competent human oversight, monitor its operation, retain logs, inform workers and affected people, and cooperate with market surveillance authorities. It also cross-references the deployer's possible role shift to provider under Article 25 and the FRIA duty under Article 27.
- 02 Dec 2027 Applies to deployers of Annex III high-risk systems
- 02 Aug 2028 Applies to deployers of Annex I embedded high-risk systems
- Use the system in accordance with the instructions for use and take corresponding technical/organisational measures.
- Assign human oversight to natural persons with the necessary competence, training, and authority.
- Ensure relevance and representativeness of input data insofar as under the deployer's control.
- Monitor operation based on the instructions for use; if risk arises, inform the provider/distributor and the market surveillance authority without delay, and suspend use.
- Retain automatically generated logs for at least six months, insofar as under the deployer's control.
- Inform workers' representatives and affected persons before deployment, and inform affected individuals about decisions taken about them.
- Cooperate with market surveillance authorities on request.
- Internal usage policy
- Human-oversight training and role-assignment records
- Log archive (minimum six months)
Deployer duties under Article 26 are sometimes assumed to be light-touch compared to provider duties, but human oversight assignment, log retention, and notification obligations are substantive and independently enforceable, not just paperwork.
What regulators published on Art. 26
- Loading from the public feed…
- Regulation (EU) 2024/1689 on EUR-Lex
- Look for Article 26
- Deadline changes and the acts behind them
Get told when Art. 26 moves.
Deadlines under this regulation have already shifted once in 2026. A signed webhook, a REST API and an MCP server carry the same record this page is built from, so your systems learn about the next change without anyone re-reading the text. Free during the beta.
Get free accessInformational content only. Not legal advice and not a substitute for qualified counsel. Dates reflect Regulation (EU) 2026/1744 as of 04 Aug 2026.