What a deployer of a high-risk AI system owes under Article 26 of the AI Act: the twelve paragraphs in order, the Article 27 impact assessment, when you become the provider, and the records an ISO 42001 system keeps

A deployer, in the AI Act's word, is any natural or legal person, public authority, agency or other body using an AI system under its authority, except where the use is personal and non-professional (Article 3(4)). That is most companies: the HR team that licenses a screening tool, the lender that buys a scoring model, the utility that runs a vendor's control software. For a high-risk system their duties are collected in Article 26 of Regulation (EU) 2024/1689, twelve paragraphs that Regulation (EU) 2026/1744, the Digital Omnibus on AI, left as adopted while it moved the date they apply from: 2 December 2027 for systems high-risk under Annex III, 2 August 2028 for the safety components of Annex I products (Article 113 as amended). This article reads the twelve paragraphs in order, then the impact assessment of Article 27, the three ways a deployer turns into the provider, the affected person's right to an explanation, the fine ceiling, and the ISO/IEC 42001 record behind each, from the two Regulations on CELLAR on 12 September 2026. It is not legal advice.

Whether you are a deployer at all

Article 26 applies to deployers of high-risk AI systems, so the first question is whether the system is high-risk: a safety component of an Annex I product that needs a third-party conformity assessment, or a system intended for one of the uses listed in Annex III, unless one of the Article 6(3) conditions takes it out. The free determination walks the questions with the Annex III list verbatim. If the system is not high-risk, Article 26 does not apply; Article 4 on AI literacy and Article 50 on transparency still do.

The second question is whether you are the deployer or have become the provider, which Article 25 answers and a later section covers. Until then, assume you use a system a provider placed on the market under its own name, and that the provider's instructions for use under Article 13 came with it.

The twelve paragraphs of Article 26

26(1), use as instructed. Take appropriate technical and organisational measures to ensure the system is used in accordance with the instructions for use accompanying it. The instructions are the provider's Article 13 document: the intended purpose, the level of accuracy and robustness, the known circumstances that lead to risk, the human oversight measures, the expected lifetime and the maintenance. Everything else in Article 26 refers back to them.

26(2), human oversight to competent people. Assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. This is the paragraph that gives Article 4, AI literacy, its teeth for a deployer: the people who oversee a high-risk system are named, and what they had to know is a record.

26(3), your own organisation. The two duties above are without prejudice to other obligations under Union or national law and to the deployer's freedom to organise its own resources and activities for implementing the oversight measures the provider indicated. How you staff the oversight is yours to decide; that you staff it is not.

26(4), input data. To the extent you control the input data, ensure it is relevant and sufficiently representative in view of the intended purpose. A screening tool fed only the applications that reached a particular inbox is a deployer's problem, not the provider's.

26(5), monitor, and stop when there is a risk. Monitor the operation on the basis of the instructions for use and, where relevant, inform the provider under Article 72. Where you have reason to consider that use in accordance with the instructions may result in the system presenting a risk within the meaning of Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay, and suspend the use. Where you identify a serious incident, immediately inform first the provider, then the importer or distributor and the market surveillance authorities; if the provider cannot be reached, Article 73 applies to you as it would to the provider. Financial institutions under Union financial services law meet the monitoring duty through their internal governance rules.

26(6), keep the logs. Keep the logs the system automatically generates, to the extent they are under your control, for a period appropriate to the intended purpose and of at least six months, unless Union or national law, in particular data protection law, provides otherwise. Financial institutions keep them as part of their financial-services documentation.

26(7), tell the workers first. Before putting a high-risk system into service or using it at the workplace, an employer informs workers' representatives and the affected workers that they will be subject to its use, following the Union and national rules on informing workers where they apply. This is a duty that runs before first use, not after.

26(8), public bodies register. Deployers that are public authorities or Union institutions, bodies, offices or agencies comply with the registration obligations of Article 49; if the system they envisage using is not in the EU database of Article 71, they do not use it and inform the provider or distributor.

26(9), the DPIA. Where applicable, use the information the provider gave under Article 13 to carry out the data protection impact assessment under Article 35 of the GDPR or Article 27 of Directive (EU) 2016/680. The instructions for use are an input to a document most deployers already write.

26(10), post-remote biometric identification. A paragraph for law enforcement: an ex ante or 48-hour authorisation by a judicial or binding administrative authority for each use in a targeted search, no untargeted use, no adverse decision on the output alone, a police file for each use, and annual reports to the market surveillance and data protection authorities.

26(11), tell the people. Deployers of Annex III systems that make decisions, or assist in making decisions, related to natural persons inform those persons that they are subject to the use of the high-risk system, without prejudice to the transparency duties of Article 50. For law enforcement, Article 13 of Directive (EU) 2016/680 applies instead.

26(12), cooperate. Cooperate with the competent authorities in any action they take in relation to the system to implement the Regulation.

Article 27, the fundamental rights impact assessment

Three kinds of deployer carry a further duty before first use of an Annex III system, area 2 (critical infrastructure) excepted: bodies governed by public law, private entities providing public services, and deployers of the creditworthiness and credit-scoring systems of point 5(b) and the life and health insurance systems of point 5(c). Article 27(1) lists six elements the assessment consists of: a description of the deployer's processes in which the system will be used in line with its intended purpose; the period and frequency of use; the categories of natural persons and groups likely to be affected; the specific risks of harm to them, taking the provider's Article 13 information into account; a description of how the human oversight measures are implemented; and the measures to be taken if the risks materialise, including internal governance and complaint mechanisms.

The assessment applies to the first use, may rely on a previous assessment in similar cases, and is updated when any element changes (Article 27(2)). Its results are notified to the market surveillance authority on the AI Office's template (Article 27(3) and (5)). Article 27(4) as amended on 27 July 2026 lets the deployer cross-reference the relevant sections of its data protection impact assessment, or include parts of it, rather than write the overlap twice; the original text only said the two assessments complement each other.

When a deployer becomes the provider

Article 25(1) names three circumstances in which a distributor, importer, deployer or other third party is considered the provider of a high-risk system, with the Article 16 obligations that go with it: it puts its name or trademark on a high-risk system already on the market, without prejudice to contractual arrangements that allocate the obligations otherwise; it makes a substantial modification to a high-risk system such that it remains high-risk; or it modifies the intended purpose of a system that was not high-risk, a general-purpose AI system included, so that it becomes high-risk under Article 6. Fine-tuning a licensed model for a use in Annex III is the third case. When it happens, the initial provider is no longer the provider of that system (Article 25(2)) and, as amended, must cooperate with the new one: technical documentation sufficient to assess compliance with Article 16, known limitations and failure modes, and targeted technical access for testing and validation, unless the initial provider clearly specified that its system is not to be changed into a high-risk one.

Short of that line, Article 25(4) as amended asks the provider of a high-risk system and any third party that supplies components, tools, services or models used in it to specify by written agreement the information, capabilities, technical access and assistance the provider needs to comply. A deployer that supplies data or infrastructure to its provider is such a third party; the agreement is where that is written down. The AI Act mapping covers the provider's side, Article 17 and Articles 9 to 15.

Article 86, the right to an explanation

Any affected person subject to a decision the deployer takes on the basis of the output of an Annex III system (area 2 excepted) that produces legal effects or similarly significantly affects them, in a way they consider adverse to their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role of the system in the decision-making procedure and the main elements of the decision taken (Article 86(1)). It applies only where Union law does not already provide the right (Article 86(3)), and it is addressed to the deployer, not the provider: the explanation has to be producible from what the deployer kept.

The ceiling

Non-compliance with the obligations of deployers under Article 26 is in the list of Article 99(4): administrative fines of up to 15 000 000 euros or, for an undertaking, 3% of total worldwide annual turnover for the preceding financial year, whichever is higher, and for SMEs, and since the amendment for small mid-caps, whichever is lower (Article 99(6) and (6a)). Article 27 and Article 86 are not in that list; under Article 99(1) as amended, member states lay down the penalties for any other infringement.

The record, paragraph by paragraph

Every paragraph of Article 26 ends in something a deployer keeps, and ISO/IEC 42001 is a management system standard whose Annex A already names the control that keeps it. The table is StandardOS's reading, checkable against the two texts; the Regulation names no standard and confers no presumption of conformity on an ISO certificate for deployers.

Four paragraphs are not in the table: 26(3) preserves your freedom to organise; 26(8), the public bodies' registration under Article 49, is its own record in the EU database; 26(10) is a law-enforcement file; and 26(12) is cooperation when an authority acts.

What to do before the date

Write the register of AI systems in use with the provider and the intended purpose of each, and mark which are high-risk with the determination that says why. For each high-risk one, file the provider's instructions for use, name the overseers and what they were trained on, set the log retention, and put the worker information and the natural-person notice on the calendar before first use. If you are a public body, a public-service provider or a credit or insurance deployer, draft the Article 27 assessment now against its six elements and align it with the DPIA. Then read Article 25 against every modification you have made to a licensed system: the day a fine-tuned model becomes high-risk is the day you owe Article 16, not Article 26.