We bought a high-risk system: our AI Act Article 26 duties
The organisation bought or licensed a high-risk AI system and uses it in its own decisions. Under Regulation (EU) 2024/1689 an organisation that uses a high-risk AI system under its own authority is a deployer under Art. 3(4), and the deployer's duties sit in Art. 26 and, for public bodies and certain private deployers, Art. 27, from the Annex III application date Deferred. Regulation (EU) 2026/1744 moved that date and left the content of both articles unchanged. This page gives the sequence, the evidence each step leaves, and the consequence of inaction.
Where this starts
The contract is signed, the provider's instructions for use state that the system is high-risk under Annex III, and the operational duties now sit with the organisation that uses it. The role follows Art. 3(4): a deployer uses an AI system under its own authority, and the provider under Art. 3(3) keeps the design duties of Chapter III Section 2. Three events under Art. 25(1) move a deployer into the provider role: putting its own name or trademark on the system, a substantial modification, or a change of intended purpose. Until one of them occurs, the deployer's reference document is the instructions for use that Art. 13(3) requires the provider to supply, including the oversight measures the provider identified for the deployer under Art. 14(3)(b). The obligation tracker lists the deployer set with its dates from data; the deployer hub holds the wider evidence list.
The obligation record for Art. 26 sorts the article into testable elements, documents and process elements. Testable: the deployed configuration, input types and use cases against the intended purpose under Art. 26(1); stop, override and suspension from an assigned account under Art. 26(2), (3) and (5); the retention configuration and the reconstruction of a sampled decision from the logs under the deployer's control under Art. 26(6). Documents: the oversight assignment record, the retention policy, the worker information record under Art. 26(7) and the notice to natural persons under Art. 26(11). Process: monitoring on the basis of the instructions for use, the route from an observed risk to suspension and notification under Art. 26(5), and cooperation with competent authorities under Art. 26(12). The Act sets no performance threshold for any of these elements. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity exists for a deployer. The oversight measure categories in use come from prEN 18229-3Draft, a JTC 21 draft with no public text; the expected log events and retention requirements come from prEN 18229-1Enquiry, a JTC 21 draft under enquiry. Each acceptance criterion is the deployer's own and is recorded at the criterion step of PR-14-OVR v1.0 and PR-12-LOG v1.0.
Art. 27 is narrower than Art. 26. Art. 27(1) places the assessment on three kinds of deployer of an Art. 6(2) system: a body governed by public law, a private entity providing public services, and a deployer of a creditworthiness or insurance pricing system under Annex III point 5(b) or (c); systems intended for the area of Annex III point 2 are excepted. A deployer outside those categories carries Art. 26 alone. A deployer inside them performs the assessment before first use, holds the six elements of Art. 27(1)(a) to (f), notifies the market surveillance authority under Art. 27(3), and under Art. 27(4), a paragraph Regulation (EU) 2026/1744 amended, may cross-reference the sections of a data protection impact assessment that already meet an element. The record structure follows ISO/IEC 42005:2025Published, a published standard that sets no acceptance value. The application date of Art. 27 is an unsettled point.
The sequence
The work runs in the order below: the role first, then the Art. 26 elements from the instructions for use outward, then the notices, then the Art. 27 assessment where it applies.
Confirm the deployer role and check each Art. 25(1) trigger before any use.
Record Role determination record with the Art. 25 trigger record
[Regulation (EU) 2024/1689, Art. 3(4) and Art. 25(1); PR-CLS steps 8 to 10]
Compare the deployed configuration, input types and use cases with the intended purpose in the instructions for use.
Record Instructions-for-use conformance record (PR-14-OVR output)
[Regulation (EU) 2024/1689, Art. 26(1) and Art. 13(3); PR-14-OVR step 9]
Record the assigned persons with competence, training and authority, and list the provider's deployer-side oversight measures.
Record Human oversight assignment record (Art. 26(2)) and oversight measure inventory
[Regulation (EU) 2024/1689, Art. 26(2) and Art. 14(3)(b); PR-14-OVR steps 3, 4 and 8]
Override, reverse and stop the system from an assigned account, and run the suspension procedure.
Record Override, reversal and stop verification report and suspension case record (PR-14-OVR output)
[Regulation (EU) 2024/1689, Art. 26(2), 26(3), 26(5) and Art. 14(4)(d) and (e); PR-14-OVR steps 21 to 26]
Record the retention policy for the logs under the deployer's control and read the configured period per store.
Record Log retention policy and retention configuration evidence (Art. 26(6))
[Regulation (EU) 2024/1689, Art. 26(6); PR-12-LOG steps 9, 24, 25 and 35]
Reconstruct a sampled decision from the deployer's log export alone and compare it with the output store.
Record Decision reconstruction record (PR-12-LOG output)
[Regulation (EU) 2024/1689, Art. 26(6) and Art. 12(2); PR-12-LOG steps 21 and 30 to 32]
Inform workers' representatives and affected workers before use, and prepare the notice to the natural persons subject to the system.
Record Worker information record (Art. 26(7)) and notice to natural persons subject to the use of the high-risk AI system (Art. 26(11))
[Regulation (EU) 2024/1689, Art. 26(7) and Art. 26(11)]
Record whether the deployer falls within an Art. 27(1) category, with the counsel reference.
Record Scope record with the deployer category, the counsel reference and the Annex III point 2 exception check
[Regulation (EU) 2024/1689, Art. 27(1); PR-27-FRIA steps 2 and 3]
Where Art. 27 applies, assemble the six-element assessment before first use and prepare the notification.
Record Fundamental rights impact assessment record (PR-27-FRIA output) and market surveillance authority notification record (Art. 27(3))
[Regulation (EU) 2024/1689, Art. 27(1)(a) to (f), 27(3) and 27(4); PR-27-FRIA steps 12 to 40]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Instructions-for-use conformance record (PR-14-OVR output) | Art. 26(1): the deployed configuration, input types and use cases fall within the intended purpose and the conditions of use | PR-14-OVR v1.0 |
| Human oversight assignment record (Art. 26(2)) | Art. 26(2): the natural persons assigned to oversight, with competence, training and authority recorded | the deployer |
| Human oversight verification report (PR-14-OVR output) | Art. 26(2), 26(3) and 26(5) read with Art. 14(4)(d) and (e): override, reversal, stop and suspension take effect from an assigned account, while the same actions from an unassigned account have no effect | PR-14-OVR v1.0 |
| Log retention policy and retention configuration evidence (Art. 26(6)) | Art. 26(6): the configured period per log store against the policy and the period the paragraph sets, with the legal basis for any different period | PR-12-LOG v1.0 |
| Decision reconstruction record (PR-12-LOG output) | Art. 26(6) read with Art. 12(2): input, model version, configuration, output and timestamp of a sampled decision recovered from the retained logs alone | PR-12-LOG v1.0 |
| Worker information record (Art. 26(7)) | Art. 26(7): workers' representatives and affected workers informed before use at the workplace | the deployer |
| Notice to natural persons subject to the use of the high-risk AI system (Art. 26(11)) | Art. 26(11): the notice text delivered at the point where a decision is made or assisted | the deployer |
| Fundamental rights impact assessment record (PR-27-FRIA output) | Art. 27(1)(a) to (f) and 27(4): the six elements before first use, with the cross-reference map to the data protection impact assessment | PR-27-FRIA v1.0 |
Each artifact follows a specification with a synthetic sample on the deliverables page: the conformance record and the verification report follow the test report specification, the reconstruction record follows the same specification with the sample layout of PR-12-LOG v1.0, the assessment record follows the FRIA record specification and the fundamental rights impact assessment outline gives its section layout; the assignment record, the worker information record and the notice are the deployer's own documents, checked for the content the paragraph names.
If nothing is done
A deployer that uses the system outside the instructions for use, without assigned persons who can act, or without the logs under its control is outside the deployer obligations of Art. 26, and those obligations fall in the penalty tier of Art. 99(4)(e), with the amount in a given case set by the national authority under the Art. 99(7) criteria. Where the use presents a risk within the meaning of Art. 79(1), the market surveillance authority evaluates the system under Art. 79(2) and requires the relevant operator, which includes the deployer, to take corrective action, or to withdraw or recall the system, within a period the authority sets. The deployer's own duty under Art. 26(5) runs ahead of that procedure: on reason to consider that use in accordance with the instructions may present such a risk, the deployer informs the provider and the market surveillance authority without undue delay and suspends use, and under Art. 26(12) it cooperates with the authority in any action taken. The sequence above produces the records that answer an authority's request: the conformance record, the verification report, the retention evidence, the reconstruction record and, where Art. 27 applies, the assessment record notified under Art. 27(3).
Services, guides and tools for this situation
The logging and human-oversight verification service runs PR-14-OVR v1.0 and PR-12-LOG v1.0 on the deployment, within the limits stated on what we cannot do; the FRIA facilitation and evidence structuring service runs PR-27-FRIA v1.0 where Art. 27 applies, and the role determination itself is a classification question the deployer settles with counsel.
- Guides
- Tools
- ICP hubs
Questions
Do I need a fundamental rights impact assessment (FRIA)?
Art. 27(1) of Regulation (EU) 2024/1689 places the assessment on a deployer of a high-risk AI system under Art. 6(2) that is a body governed by public law, a private entity providing public services, or a deployer of a creditworthiness or insurance pricing system under Annex III point 5(b) or (c). Systems intended for the area of Annex III point 2 are excepted. A deployer outside the Art. 27(1) categories carries Art. 26 without Art. 27. The application date of Art. 27 is an unsettled point shown on this page.
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.