EU AI Act Article 26: Deployer Obligations for High-Risk AI

Who Is a Deployer?

A deployer is any natural or legal person using an AI system under its own authority in the course of a professional activity (individuals using AI for purely personal, non-professional reasons are excluded).

Deployer obligations sit alongside, not instead of, the provider's obligations. The provider builds and documents the system; the deployer is responsible for how it is actually used. If a deployer substantially modifies a high-risk system or puts its own name on it, it can also take on provider obligations under Article 25.

The Core Deployer Duties

Article 26 imposes a defined set of operational obligations on deployers of high-risk AI systems:

• Use per instructions — take appropriate technical and organisational measures to use the system in accordance with the provider's instructions for use
• Assign competent human oversight — entrust oversight to natural persons who have the necessary competence, training, authority and support to carry it out under Article 14
• Control input data — where the deployer controls the input data, ensure it is relevant and sufficiently representative in view of the system's intended purpose
• Monitor operation — monitor the system's operation against the instructions for use and inform the provider or distributor where a risk arises
• Keep automatically generated logs — retain the logs the system generates automatically, to the extent they are under the deployer's control, for at least six months (unless a longer period is set by other Union or national law)
• Inform workers and representatives — before putting a high-risk system into service in the workplace, inform affected workers and their representatives that they will be subject to it
• Data protection impact assessment — where relevant, use the information provided under Article 13 to carry out a data protection impact assessment under the GDPR
• Suspend and inform on serious risk — where the system presents a risk to health, safety or fundamental rights, or a serious incident occurs, suspend use, inform the provider, distributor and relevant authorities, and cooperate

The Six-Month Log Retention Floor

Deployers must keep the logs automatically generated by the high-risk AI system for a period appropriate to the intended purpose, and in any case for at least six months — unless a longer retention period is required by applicable Union or national law.

This applies to the logs that are under the deployer's control. It is the deployer-side counterpart to the provider's logging design under Articles 12 and 19: the provider builds the logging capability, and the deployer is responsible for actually retaining and being able to produce the resulting records. Sector rules (for example in finance or health) frequently set a longer floor, so treat six months as the minimum, not the target.

Public authorities acting as deployers have additional transparency and registration duties under Articles 26 and 49.