EU AI Act Art.26: Obligations of deployers of high-risk AI systems
Article 26 of the EU AI Act binds the deployer. It requires Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.26 |
| Binds | Deployer |
| Group | High-Risk Operator Obligations |
| Evidence items | 4 |
| Linked NIST AI RMF controls | 3 |
| Linked ISO/IEC 42001 controls | 8 |
| Last updated |
Who does Art.26 bind?
The article binds the deployer. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.26 require?
Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure input data is relevant and sufficiently representative; monitor operation and inform the provider of risks/incidents; retain automatically generated logs for at least 6 months (longer where required); inform workers/representatives where used in the workplace; carry out a DPIA where required under GDPR; and where a deployer is a public authority, register the system in the EU database.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.26 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.26?
| Category | Evidence to keep |
|---|---|
| Deployer obligations | Deployer monitoring records |
| Deployer obligations | Logs retained at least 6 months |
| Deployer obligations | DPIA where applicable |
| Deployer obligations | Workforce information for workplace deployment |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.26?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-MN-3.1 | AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented Deployers monitor operation of the third-party provider's system and inform the provider of risks and incidents. | high |
AIRMF-MP-3.4 | Processes for operator and practitioner proficiency with AI system performance and trustworthiness, and relevant technical standards and certifications, are defined, assessed and documented Deployers must assign oversight to persons with the necessary competence, training and authority. | high |
AIRMF-MS-2.10 | Privacy risk of the AI system as identified in the MAP function is examined and documented Deployers must carry out the data protection impact assessment where GDPR requires one. | high |
Which ISO/IEC 42001 controls line up with Art.26?
8 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.2.3 | Alignment with other organizational policies Deployer must run a GDPR data protection impact assessment where required. | medium |
A.3.2 | AI roles and responsibilities Deployer assigns human oversight to named, appropriately competent natural persons. | medium |
A.4.6 | Human resources Oversight must be assigned to persons with the necessary competence and support. | medium |
A.6.2.6 | AI system operation and monitoring Deployer must operate per instructions, monitor operation and inform the provider of risks. | high |
A.6.2.8 | AI system recording of event logs Deployer retains automatically generated logs under its control for at least six months. | medium |
A.9.2 | Processes for responsible use of AI systems Deployer duties are the responsible use process for a third party AI system. | high |
A.9.3 | Objectives for responsible use of AI system Deployer duties fix required use conduct rather than objectives guiding use. | medium |
A.9.4 | Intended use of the AI system Deployer must use the system in accordance with its instructions for use. | high |
What does the conformance kit add for Art.26?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.