Docs

Appearance

Roles and responsibilities ​

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI) gives obligations to operators by their role. This page gives the scope of the EU AI Act, the definitions of the roles, and AI literacy. It also gives the obligations of providers, authorized representatives, importers, distributors and deployers of high-risk AI systems, and the right to explanation in Article 86. For the Digital Omnibus on AI, see Digital Omnibus on AI.

Article 2 — scope ​

Article 2(1) of the EU AI Act gives the persons to which the EU AI Act applies:

  • Providers (point (a)). The EU AI Act applies to providers that place on the market or put into service AI systems in the Union. It also applies to providers that place on the market general-purpose AI models in the Union. These providers can be established or located in the Union or in a third country.
  • Deployers in the Union (point (b)). The EU AI Act applies to deployers of AI systems that “have their place of establishment or are located within the Union”.
  • Providers and deployers in a third country (point (c)). The EU AI Act applies to them only where the output that the AI system makes is used in the Union.
  • Importers and distributors of AI systems (point (d)).
  • Product manufacturers (point (e)) that place on the market or put into service an AI system together with their product and “under their own name or trademark”.
  • Authorized representatives of providers that are not established in the Union (point (f)).
  • Affected persons that are located in the Union (point (g)).

Article 2(2) — Annex I Section B systems ​

Article 2(2) of the EU AI Act limits the provisions that apply to some high-risk AI systems:

For AI systems classified as high-risk AI systems in accordance with Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 shall apply. Articles 57, 58 and 59 shall apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

Thus, the obligations and the right on this page do not apply to these systems. Articles 4, 4a, 5 and 50 also do not apply to them. For Article 6(1) and Annex I, see Article 6.

Article 2 — exclusions and limits ​

Article 2 of the EU AI Act also contains these exclusions and limits:

  • Military and defense purposes (Article 2(3)). The EU AI Act “does not apply to areas outside the scope of Union law”. It does not change “the competences of the Member States concerning national security”. It does not apply to AI systems “where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes”. It also does not apply to AI systems that are not placed on the market or put into service in the Union, where the output is used in the Union only for these purposes. For the two exclusions, the type of entity that does the activities is not important.
  • International cooperation (Article 2(4)). The EU AI Act does not apply to public authorities in a third country or to international organizations that use AI systems “in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the Union or with one or more Member States”. This exclusion applies only if the third country or the international organization gives “adequate safeguards with respect to the protection of fundamental rights and freedoms of individuals”.
  • Intermediary services (Article 2(5)). The EU AI Act does not change the liability rules for providers of intermediary services in Chapter II of Regulation (EU) 2022/2065.
  • Scientific research and development (Article 2(6)). The EU AI Act does not apply to AI systems or AI models, and their output, “specifically developed and put into service for the sole purpose of scientific research and development”.
  • Research before the market (Article 2(8)). The EU AI Act does not apply to “any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service”. These activities must obey applicable Union law. This exclusion does not apply to testing in real-world conditions.
  • Consumer protection and product safety (Article 2(9)). The EU AI Act is “without prejudice to the rules laid down by other Union legal acts related to consumer protection and product safety”.
  • Personal non-professional activity (Article 2(10)). The EU AI Act does not apply to obligations of deployers who are natural persons that use AI systems “in the course of a purely personal non-professional activity”.
  • Workers (Article 2(11)). The Union and the Member States can keep or introduce laws that are more favorable to workers on the use of AI systems by employers. They can also encourage or let the parties use collective agreements that are more favorable to workers.
  • Free and open-source licenses (Article 2(12)). The EU AI Act does not apply to “AI systems released under free and open-source licences”. This exclusion does not apply if these AI systems are placed on the market or put into service as high-risk AI systems, or as an AI system that falls in Article 5 or 50. This exclusion is for AI systems. For general-purpose AI models, Articles 53(2) and 54(6) give different rules (see Article 53).

Article 2(7) — data protection ​

Article 2(7) of the EU AI Act gives two rules on data protection. The first rule is: “Union law on the protection of personal data, privacy and the confidentiality of communications applies to personal data processed in connection with the rights and obligations laid down in this Regulation.” The second rule is: “Without prejudice to Articles 4a and 59 of this Regulation, this Regulation shall not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680.” To compare the two instruments, see EU AI Act and GDPR.

Application dates ​

For the EU AI Act application dates in Article 113 and transitional rules in Article 111, see Dates.

Article 3 — definitions ​

Article 3 of the EU AI Act gives the definitions of the actors and the systems. One organization can have more than one role for the same AI system. For example, an organization that “develops an AI system” can supply it “for own use in the Union for its intended purpose”, which is putting into service (Article 3(11)). If the organization does this “under its own name or trademark” and then uses the system, it can be the provider and the deployer (Article 3(3) and (4)).

Article 3(1) — AI system ​

Article 3(1) gives this definition:

‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;

The Commission Guidelines on the definition of an AI system, Communication “C(2025) 5053 final” of 29 July 2025, are not binding (paragraph (7)). They divide the definition into seven elements (paragraph (9)). In these Guidelines, “each system must be assessed based on its specific characteristics” (paragraph (6)). Also, “No automatic determination or exhaustive lists of systems that either fall within or outside the definition of an AI system are possible” (paragraph (62)). For the elements and the examples, see Commission guidance on the AI system definition.

Article 3(12) — intended purpose ​

Article 3(12) gives a different definition for the intended purpose of an AI system:

‘intended purpose’ means the use for which an AI system is intended by the provider, including the specific context and conditions of use, as specified in the information supplied by the provider in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation;

Article 3(3) — provider ​

‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

The provider places on the market the AI system or the general-purpose AI model, or puts into service the AI system, “under its own name or trademark”. Payment is not a condition. Putting into service applies only to AI systems. It includes the supply of an AI system “for own use in the Union for its intended purpose” (Article 3(11)). Article 25 gives the conditions in which a different operator becomes the provider of a high-risk AI system (see Article 25).

Article 3(4) — deployer ​

‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;

A person that uses an AI system “in the course of a personal non-professional activity” is not a deployer. A deployer can use an AI system that it made itself. The deployer role is a role in the EU AI Act. This role does not, by itself, give the role of the organization in Union data-protection law. That law continues to apply (Article 2(7)).

Article 3(5) — authorized representative ​

‘authorised representative’ means a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation;

For the different mandate rules, see Article 22 for high-risk AI systems and Article 54 for general-purpose AI models.

Article 3(6) — importer ​

‘importer’ means a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country;

Article 3(7) — distributor ​

‘distributor’ means a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market;

Article 3(10) gives this definition of making available on the market: “the supply of an AI system or a general-purpose AI model for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge”.

Article 3(8) — operator ​

‘operator’ means a provider, product manufacturer, deployer, authorised representative, importer or distributor;

Operator is the collective term for these six roles. It is not a different word for deployer. Article 3 does not give a definition of product manufacturer. Article 2(1), point (e), and Article 25(3) give the rules for product manufacturers.

Article 3(68) — downstream provider ​

‘downstream provider’ means a provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether the AI model is provided by themselves and vertically integrated or provided by another entity based on contractual relations.

Article 3(63) gives the definition of general-purpose AI models, and Chapter V gives their rules. These rules are different from the rules for AI systems. One entity can be the provider of a general-purpose AI model and also the provider of an AI system that integrates that model. See Article 3(63).

Article 4 — AI literacy ​

Article 4 of the EU AI Act, as replaced by Regulation (EU) 2026/1744, gives an obligation to providers and deployers of AI systems. This obligation is not only for high-risk AI systems. Article 4(1) gives the obligation:

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

Article 4(2) tells the Commission and the Member States to “support and facilitate the efforts of providers and deployers of AI systems, in particular SMEs”. For that purpose, the Commission must publish practical examples of compliance on the single information platform in Article 62(3), point (b). Article 4(3) tells the Board to adopt recommendations that help the Commission and the Member States to promote AI literacy.

Article 4 applies to providers and deployers in the scope of Article 2. Article 4 does not apply to Article 6(1) high-risk AI systems related to products in Annex I, Section B (Article 2(2)). Article 4 is in Chapter I, which applies from 2 February 2025 (Article 113, point (a)).

Article 16 — provider obligations on high-risk AI systems ​

Article 16 of the EU AI Act gives the obligations of providers of high-risk AI systems. Article 16 applies only to high-risk AI systems (see Article 6). It does not apply to Annex I Section B systems (Article 2(2)).

Providers of high-risk AI systems shall:

(a) ensure that their high-risk AI systems are compliant with the requirements set out in Section 2;

(b) indicate on the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, as applicable, their name, registered trade name or registered trade mark, the address at which they can be contacted;

(c) have a quality management system in place which complies with Article 17;

(d) keep the documentation referred to in Article 18;

(e) when under their control, keep the logs automatically generated by their high-risk AI systems as referred to in Article 19;

(f) ensure that the high-risk AI system undergoes the relevant conformity assessment procedure as referred to in Article 43, prior to its being placed on the market or put into service;

(g) draw up an EU declaration of conformity in accordance with Article 47;

(h) affix the CE marking to the high-risk AI system or, where that is not possible, on its packaging or its accompanying documentation, to indicate conformity with this Regulation, in accordance with Article 48;

(i) comply with the registration obligations referred to in Article 49(1);

(j) take the necessary corrective actions and provide information as required in Article 20;

(k) upon a reasoned request of a national competent authority, demonstrate the conformity of the high-risk AI system with the requirements set out in Section 2;

(l) ensure that the high-risk AI system complies with accessibility requirements in accordance with Directives (EU) 2016/2102 and (EU) 2019/882.

Most points of Article 16 refer to other Articles. Points (b), (k) and (l) give obligations in Article 16 itself. These pages give the other Articles:

The sections that follow give Articles 18, 19 and 21.

Article 18 — documentation keeping ​

Article 18(1) of the EU AI Act tells the provider to keep these documents “at the disposal of the national competent authorities”. The period ends 10 years after the high-risk AI system was placed on the market or put into service. The documents are:

  • The technical documentation in Article 11.
  • The documentation about the quality management system in Article 17.
  • The documentation about the changes that notified bodies approved, where applicable.
  • The decisions and other documents that the notified bodies issued, where applicable.
  • The EU declaration of conformity in Article 47.

Article 18(2) tells each Member State to set the conditions in which these documents stay available to the national competent authorities for that period. These conditions are for a provider or its authorized representative established on the territory of the Member State that “goes bankrupt or ceases its activity prior to the end of that period”.

Article 18(3) applies to providers that are “financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law”. These providers keep the technical documentation as part of the documentation that they keep in accordance with that law.

Article 19 — logs ​

Article 19(1) of the EU AI Act tells providers to keep the Article 12(1) logs that their high-risk AI systems automatically record. This obligation applies if the logs are “under their control”. Applicable Union or national law also applies. Providers keep the logs for a period “appropriate to the intended purpose of the high-risk AI system, of at least six months”. A different period applies where applicable Union or national law gives one, “in particular in Union law on the protection of personal data”.

Article 19(2) applies to the same financial institutions as Article 18(3). These providers keep the logs as part of the documentation that they keep in accordance with the applicable financial services law.

Article 21 — cooperation with competent authorities ​

Article 21 of the EU AI Act gives these obligations to providers of high-risk AI systems:

  • Information (Article 21(1)). If a competent authority makes a reasoned request, the provider gives that authority all the information and documentation necessary to show the conformity of the high-risk AI system with the Section 2 requirements. The provider uses a language that the authority can easily understand. This language is one of the official languages of the institutions of the Union that the Member State concerned identifies.
  • Logs (Article 21(2)). If a competent authority makes a reasoned request, the provider also gives that authority access to the automatically recorded logs in Article 12(1), as applicable, if the logs are “under their control”.
  • Confidentiality (Article 21(3)). The competent authority uses the information that it gets in Article 21 in accordance with the confidentiality obligations in Article 78.

Article 22 — authorized representatives for non-EU providers of high-risk AI systems ​

Article 22(1) of the EU AI Act gives an obligation to providers established in third countries. Before they make their high-risk AI systems available on the Union market, they must appoint, by written mandate, an authorized representative that is established in the Union. Article 22(2) tells the provider to “enable its authorised representative to perform the tasks specified in the mandate”.

Article 22(3) tells the authorized representative to do the tasks in the mandate. The authorized representative must give a copy of the mandate to the market surveillance authorities “upon request”. The copy is in one of the official languages of the institutions of the Union that the competent authority identifies. The mandate must let the authorized representative do these tasks:

  • Check (point (a)). Check that the provider wrote the EU declaration of conformity in Article 47 and the technical documentation in Article 11. Also check that the provider did an “appropriate conformity assessment procedure”.
  • Documents (point (b)). Keep documents “at the disposal of the competent authorities and national authorities or bodies referred to in Article 74(10)”. The period is 10 years after the high-risk AI system was placed on the market or put into service. The documents are the contact details of the provider that appointed the authorized representative and a copy of the EU declaration of conformity. They also include the technical documentation and, if applicable, the certificate that the notified body issued.
  • Information (point (c)). If a competent authority makes a reasoned request, give that authority all the information and documentation necessary to show the conformity of the high-risk AI system with the Section 2 requirements. This includes the documents in point (b). It also includes access to the logs in Article 12(1), if the logs are “under the control of the provider”.
  • Cooperation (point (d)). If the competent authorities make a reasoned request, cooperate with them “in any action the latter take in relation to the high-risk AI system, in particular to reduce and mitigate the risks posed by the high-risk AI system”.
  • Registration (point (e)). Where applicable, comply with the registration obligations in Article 49(1). If the provider does the registration itself, make sure that the information in Annex VIII, Section A, point 3 is correct.

The mandate must also let the competent authorities address the authorized representative, “in addition to or instead of the provider”, on all issues about compliance with the EU AI Act.

Article 22(4) gives a different obligation. The authorized representative must terminate the mandate if it “considers or has reason to consider the provider to be acting contrary to its obligations pursuant to this Regulation”. The authorized representative must then immediately tell the “relevant market surveillance authority” about the termination and the reasons. Where applicable, it must also tell the “relevant notified body”.

A provider established in a third country can have a high-risk AI system and a general-purpose AI model. Article 22 and Article 54 each tell the provider to appoint an authorized representative by written mandate, where that Article applies to the provider. Each mandate has its own tasks. For the model mandate and its exception, see Article 54.

Article 23 — importer obligations ​

Article 23(1) of the EU AI Act gives the checks that an importer must do before placing on the market:

Before placing a high-risk AI system on the market, importers shall ensure that the system is in conformity with this Regulation by verifying that:

(a) the relevant conformity assessment procedure referred to in Article 43 has been carried out by the provider of the high-risk AI system;

(b) the provider has drawn up the technical documentation in accordance with Article 11 and Annex IV;

(c) the system bears the required CE marking and is accompanied by the EU declaration of conformity referred to in Article 47 and instructions for use;

(d) the provider has appointed an authorised representative in accordance with Article 22(1).

For these subjects, see Article 43, Article 47 and Article 48. Article 23 also gives these obligations to importers:

  • Non-conformity (Article 23(2)). An importer can have “sufficient reason to consider” that a high-risk AI system is not in conformity with the EU AI Act, or is falsified, or comes with falsified documentation. Then “it shall not place the system on the market until it has been brought into conformity”. If the system presents a risk “within the meaning of Article 79(1)”, the importer must tell the provider of the system, the authorized representative and the market surveillance authorities.
  • Name and address (Article 23(3)). The importer must show its name, registered trade name or registered trade mark, and the address at which it can be contacted. It must show them on the high-risk AI system and on its packaging or its accompanying documentation, where applicable.
  • Storage conditions (Article 23(4)). The importer must make sure that, “while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements set out in Section 2”.
  • Documents (Article 23(5)). The importer keeps a copy of the instructions for use and of the EU declaration of conformity. Where applicable, it also keeps a copy of the certificate that the notified body issued. The importer keeps these copies for 10 years after the high-risk AI system was placed on the market or put into service.
  • Information (Article 23(6)). If a competent authority makes a reasoned request, the importer gives that authority all the necessary information and documentation to show the conformity of the high-risk AI system with the Section 2 requirements. This includes the documents in Article 23(5). The importer uses a language that the authorities can easily understand. It also makes sure that the technical documentation can be made available to those authorities.
  • Cooperation (Article 23(7)). The importer cooperates with “the relevant competent authorities in any action those authorities take in relation to a high-risk AI system placed on the market by the importers, in particular to reduce and mitigate the risks posed by it”.

Article 24 — distributor obligations ​

Article 24(1) of the EU AI Act gives the checks that a distributor must do before making available on the market:

Before making a high-risk AI system available on the market, distributors shall verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer of that system, as applicable, have complied with their respective obligations as laid down in Article 16, points (b) and (c) and Article 23(3).

Article 24 also gives these obligations to distributors:

  • Before supply (Article 24(2)). This obligation applies if a distributor “considers or has reason to consider, on the basis of the information in its possession,” that a high-risk AI system is not in conformity with the Section 2 requirements. Then the distributor must not make the system available on the market until the system is in conformity. If the system presents a risk “within the meaning of Article 79(1)”, the distributor must tell the provider or the importer of the system, as applicable.
  • Storage conditions (Article 24(3)). The distributor must make sure that, “while a high-risk AI system is under their responsibility, storage or transport conditions, where applicable, do not jeopardise the compliance of the system with the requirements set out in Section 2”.
  • After supply (Article 24(4)). This obligation applies to a high-risk AI system that the distributor made available on the market. It applies if the distributor “considers or has reason to consider”, from the information it has, that the system does not conform to the Section 2 requirements. The distributor must do the corrective actions necessary “to bring that system into conformity with those requirements, to withdraw it or recall it”. As an alternative, it must make sure that “the provider, the importer or any relevant operator, as appropriate,” does those corrective actions.
  • Risk after supply (Article 24(4)). If that system presents a risk “within the meaning of Article 79(1)”, the distributor must immediately tell the provider or the importer of the system and “the authorities competent for the high-risk AI system concerned”. It must give details, “in particular, of the non-compliance and of any corrective actions taken”.
  • Information (Article 24(5)). If a competent authority makes a reasoned request, the distributor gives that authority all the information and documentation about its actions in Article 24(1) to (4). This information and documentation is what is necessary to show the conformity of the system with the Section 2 requirements.
  • Cooperation (Article 24(6)). The distributor cooperates with “the relevant competent authorities in any action those authorities take in relation to a high-risk AI system made available on the market by the distributors, in particular to reduce or mitigate the risk posed by it”.

A distributor that does not obey Article 24 does not become a provider because of that non-compliance. Article 25(1) gives the conditions in which a distributor becomes the provider.

Article 25 — changes in provider responsibility ​

Article 25(1) of the EU AI Act gives the conditions in which a different operator becomes the provider of a high-risk AI system:

Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances:

(a) they put their name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated;

(b) they make a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service in such a way that it remains a high-risk AI system pursuant to Article 6;

(c) they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a high-risk AI system in accordance with Article 6.

Substantial modification ​

For the substantial-modification test, reassessment and the exception for pre-determined learning changes, see Article 3(23) and Article 43(4).

A change of the context of use can also change the intended purpose (Article 3(12)), which Article 25(1), point (c), includes.

The EU AI Act does not tell operators to keep a record of why a change is not a substantial modification. For the steps that Modulos recommends when a system, its intended purpose, or a role changes, see Review changes.

Article 25(2) — the initial provider ​

Article 25(2) of the EU AI Act applies when one of the conditions in Article 25(1) occurs. Then “the provider that initially placed the AI system on the market or put it into service” is no longer a provider of “that specific AI system”.

That initial provider must “closely cooperate with new providers”. It must make available the necessary information. It must also give “the reasonably expected technical access and other assistance that are required for the fulfilment of the obligations set out in this Regulation, in particular with regard to compliance with the conformity assessment of high-risk AI systems”. Where applicable for these purposes, this obligation includes, “in particular”, these items:

  • Technical documentation sufficient to examine compliance with the requirements in Article 16.
  • Information to the new providers about known limitations and failure modes.
  • Targeted technical access for the new providers, for example for testing and validation.

Article 25(2) does not apply where the initial provider “has clearly specified that its AI system is not to be changed into a high-risk AI system”. Then the initial provider has no obligation to cooperate with the new providers or to give them the documentation. Article 25(5) provides that Article 25(2) and (3) are “without prejudice to the need to observe and protect intellectual property rights, confidential business information and trade secrets in accordance with Union and national law”.

Article 25(3) — product manufacturers ​

Article 25(3) of the EU AI Act applies to high-risk AI systems that are safety components of products. These products are in the Union harmonization legislation in Annex I, Section A. The product manufacturer is the provider of the high-risk AI system, and has the obligations of Article 16, in one of these conditions:

  • The high-risk AI system is placed on the market together with the product “under the name or trademark of the product manufacturer”.
  • The high-risk AI system is put into service “under the name or trademark of the product manufacturer” after the product was placed on the market.

Article 25(4) — written agreements ​

Article 25(4) of the EU AI Act gives an obligation to two parties. The first party is the provider of a high-risk AI system. The second party is each third party that supplies “an AI system, AI model, tools, services, components, or processes that are used or integrated in a high-risk AI system”. By written agreement, the two parties must specify “the necessary information, capabilities, technical access and other assistance based on the generally acknowledged state of the art”. The agreement must let the provider of the high-risk AI system fully comply with the obligations of the EU AI Act.

This obligation does not apply to “third parties making accessible to the public tools, services, processes, or components, other than general-purpose AI models, under a free and open-source licence”. Thus, this exception is not for general-purpose AI models. The AI Office “may develop and recommend voluntary model terms” for contracts between providers of high-risk AI systems and the third parties that supply tools, services, components or processes.

Regulation (EU) 2026/1744 added the obligations in Article 25(2) and (4) to Article 99(4), which sets administrative fines. For the fines, see Penalties and enforcement.

Article 26 — deployer obligations on high-risk AI systems ​

Article 26 of the EU AI Act gives the obligations of deployers of high-risk AI systems. Article 26 does not apply to Annex I Section B systems (Article 2(2)). Article 26(1) gives the first obligation:

Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.

Article 26 also gives these obligations to deployers:

  • Human oversight (Article 26(2)). The deployer must “assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support”. For the oversight measures of the provider, see Articles 8–15.
  • Other obligations (Article 26(3)). Article 26(1) and (2) do not change other deployer obligations in Union or national law. They also do not change the freedom of the deployer to organize its resources and activities for the human oversight measures that the provider identifies.
  • Input data (Article 26(4)). The deployer must make sure that input data is “relevant and sufficiently representative in view of the intended purpose of the high-risk AI system”. This obligation applies “to the extent the deployer exercises control over the input data”, and it is “Without prejudice to paragraphs 1 and 2”.
  • Monitoring, risks and serious incidents (Article 26(5)). For deployer monitoring, risk notification, suspension of use and serious-incident notification, see Deployer monitoring.
  • Logs (Article 26(6)). For deployer log-retention duties and their conditions, see Deployer monitoring.
  • Workers (Article 26(7)). A deployer who is an employer must tell the workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system. It must tell them before it puts into service or uses the system at the workplace. Where applicable, the deployer gives this information in accordance with the rules and procedures of Union and national law and practice on information of workers and their representatives.
  • Public authorities and registration (Article 26(8)). Deployers that are public authorities, or Union institutions, bodies, offices or agencies, must comply with the registration obligations in Article 49. These deployers can find that “the high-risk AI system that they envisage using has not been registered in the EU database referred to in Article 71”. Then they must not use that system, and they must tell the provider or the distributor. For registration, see Article 49.
  • Data protection impact assessment (Article 26(9)). Where applicable, the deployer uses the information that the provider gives in accordance with Article 13. The deployer uses this information to comply with its obligation to do a data protection impact assessment in Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.
  • Post-remote biometric identification (Article 26(10)). See Article 26(10).
  • Information to natural persons (Article 26(11)). Some deployers of high-risk AI systems in Annex III must tell natural persons that they are subject to the use of the high-risk AI system. These are the deployers that “make decisions or assist in making decisions related to natural persons”. This obligation is “Without prejudice to Article 50”. For high-risk AI systems used for law enforcement purposes, Article 13 of Directive (EU) 2016/680 applies.
  • Cooperation (Article 26(12)). The deployer cooperates with “the relevant competent authorities in any action those authorities take in relation to the high-risk AI system in order to implement this Regulation”.

For the deployers subject to the fundamental rights impact assessment duty and its conditions, see Article 27.

Article 26(10) — post-remote biometric identification ​

Article 26(10) of the EU AI Act gives rules for deployers of high-risk AI systems for post-remote biometric identification:

  • Authorization. This duty is “Without prejudice to Directive (EU) 2016/680”. It applies “in the framework of an investigation for the targeted search of a person suspected or convicted of having committed a criminal offence”. The deployer must “request an authorisation, ex ante, or without undue delay and no later than 48 hours” for the use of the system. The authorization comes from a judicial authority or from “an administrative authority whose decision is binding and subject to judicial review”. This rule does not apply when the system is used for “the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence”.
  • Necessary use. This limit applies “in the framework of an investigation for the targeted search of a person suspected or convicted of having committed a criminal offence”. Each use “shall be limited to what is strictly necessary for the investigation of a specific criminal offence”.
  • Rejected authorization. If the authority rejects the authorization, the use linked to that authorization must stop immediately. Also, “the personal data linked to the use of the high-risk AI system for which the authorisation was requested shall be deleted”.
  • Targeted use. The system must not be used for law enforcement purposes “in an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine and present or genuine and foreseeable threat of a criminal offence, or the search for a specific missing person”.
  • Decisions. The law enforcement authorities must not make a decision that “produces an adverse legal effect on a person” based only on the output of the system.
  • Biometric data. Article 26(10) is “without prejudice to Article 9 of Regulation (EU) 2016/679 and Article 10 of Directive (EU) 2016/680 for the processing of biometric data”.
  • Documentation. For all purposes and all deployers, each use of the system is written in the “relevant police file”. Each use is made available “to the relevant market surveillance authority and the national data protection authority upon request”. Sensitive operational data related to law enforcement is not disclosed. This rule does not change the powers of supervisory authorities in Directive (EU) 2016/680.
  • Annual reports. Deployers send annual reports on their use of post-remote biometric identification systems to “the relevant market surveillance and national data protection authorities”. The reports do not disclose sensitive operational data related to law enforcement. One report can include more than one deployment.
  • National law. Member States are permitted to introduce, in accordance with Union law, more restrictive laws on the use of post-remote biometric identification systems.

Article 26(10) is different from the rules for real-time remote biometric identification in Article 5(1), point (h), and Article 5(2) to (7). See Article 5.

Article 86 — right to explanation ​

Article 86(1) of the EU AI Act gives a right to affected persons:

Any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2 thereof, and which produces legal effects or similarly significantly affects that person in a way that they consider to have an adverse impact on their health, safety or fundamental rights shall have the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken.

Article 86 has two limits:

  • Article 86(1) does not apply to the use of AI systems where exceptions from, or restrictions to, the obligation in Article 86(1) “follow from Union or national law in compliance with Union law” (Article 86(2)).
  • Article 86 applies only “to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law” (Article 86(3)).

The right to explanation is different from the information that deployers give in accordance with Article 26(11). Article 86 is in Chapter IX of the EU AI Act, which applies from 2 August 2026 (Article 113). Article 6(2) and Annex III classify the high-risk AI systems that Article 86(1) refers to. Article 6(2) is in Chapter III, Section 1, which applies to these systems from 2 December 2027 (Article 113, point (c)).

Modulos ​

Modulos has Frameworks for EU AI Act Requirements: OFF-1 for the Organization and MFF-1 for the AI System. For role-specific Requirements and recommended setup steps, see Operationalizing in Modulos.

Sources ​

  • EU AI Act: Articles 2, 3, 4, 16, 18 to 27, 43(4), 54, 86, 99(4), 111 and 113 of Regulation (EU) 2024/1689 of 13 June 2024 (consolidated version of 27 July 2026). EUR-Lex.
  • Digital Omnibus on AI: Amendments to EU AI Act Articles 2, 4, 25, 99, 111 and 113 in Regulation (EU) 2026/1744 of 8 July 2026 (Official Journal, 24 July 2026). EUR-Lex.
  • Commission Guidelines on the definition of an AI system: “Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act)”, Communication from the Commission “C(2025) 5053 final”, 29 July 2025. Paragraphs (6), (7), (9) and (62). Commission text.

Disclaimer

This page gives general information. It is not legal advice.