Deployer Obligations Checklist (Article 26, EU AI Act)

Drew & AI Comply HQ™ Team · June 7, 2026

A deployer obligations checklist is the short list for companies that USE high-risk AI rather than build it. Article 26 of the EU AI Act is your article: you bought the hiring screener or the credit model, and the law now expects you to run it responsibly. Eight rows, far lighter than the provider's twelve, but with real operational teeth.

The 8-point deployer checklist

#	Obligation	Where it lives
1	Use the system according to the provider's instructions for use	Art. 26(1)
2	Assign human oversight to people with competence, training, and authority	Art. 26(2)
3	Ensure input data under your control is relevant and sufficiently representative	Art. 26(4)
4	Monitor operation and tell the provider or authority when something looks wrong	Art. 26(5)
5	Keep the automatically generated logs at least six months	Art. 26(6)
6	Tell workers and their representatives before using it on them at work	Art. 26(7)
7	Inform people subject to its decisions, where the Act requires	Art. 26(11)
8	Run a fundamental rights impact assessment first, if Article 27 covers you	Art. 27

Row 8 applies to public bodies, private entities providing public services, and deployers of certain credit-scoring and insurance-pricing systems. If that is you, the FRIA comes before first use, not after. Where your GDPR data protection impact assessment already covers part of it, Article 27(4) lets you cross-reference or reuse those sections.

The two rows that bite operationally

Log retention (row 5) needs someone to actually own storage and deletion windows. And worker notification (row 6) has a date attached to a meeting, not a document: works councils want to hear about the system before it goes live. Both rows produce evidence that AI Comply HQ generates and tracks for you, alongside the oversight-assignment record from row 2.

Wait, are you sure you're only a deployer?

Rebrand a vendor's system under your own name, or substantially modify it, and you can become the provider, with the 12-row provider checklist instead. The free risk check asks the role questions and tells you which list is yours.

FAQ

When do deployer duties start?

For Annex III systems, December 2, 2027, the same date as the provider-side rules. Both dates were August 2, 2026 until the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved them in July 2026. For AI in products like medical devices (Annex I, Section A), your duties start on August 2, 2028. Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)). Your Article 50 disclosure duties did not move. They have applied since August 2, 2026. They cover emotion recognition, biometric categorisation, and deepfakes you create with AI.

The provider says the system is compliant. Are we done?

No. Their conformity covers their duties. Rows 1 through 8 above stay yours.

Check which obligations hit you, free

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.