# Deployer obligations — Art 26 and Art 27

Basis: Regulation (EU) 2024/1689 Arts 26 and 27, as amended by Regulation (EU) 2026/1744 Art 1(13). Applicable from **2 December 2027** (Annex III high-risk) and **2 August 2028** (Annex I high-risk). Deployer transparency duties under Art 50(3) and (4) apply already, from 2 August 2026 — see `transparency-art50.md`.

`deployer` means a natural or legal person, public authority, agency or other body **using an AI system under its authority**, except in the course of a personal non-professional activity (Art 3(4)). Buying a high-risk system does not transfer the provider's obligations; it creates a separate, smaller set.

Penalty exposure: EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher, for breach of Art 26 (Art 99(4)(e)). For SMEs and SMCs, whichever is lower (Art 99(6), (6a)).

## Art 26 — the duties

| Para | Duty | Practical shape |
|---|---|---|
| 26(1) | Take appropriate technical and organisational measures to ensure use **in accordance with the instructions for use** | The instructions for use are a compliance document, not a manual. Deviating from them is a breach and can flip you into provider under Art 25(1)(c) if it changes the intended purpose |
| 26(2) | Assign human oversight to natural persons with the necessary **competence, training and authority**, as well as the necessary support | Name individuals or roles; record training; give them actual authority to stop the system. See the oversight note template in `artefacts-disclosures.md` |
| 26(3) | Without prejudice to (1) and (2), and to the deployer's freedom to organise its own resources | The deployer chooses how to implement the oversight measures the provider indicated |
| 26(4) | To the extent the deployer controls the input data, ensure it is **relevant and sufficiently representative** in view of the intended purpose | Applies to configuration data, retrieval corpora, prompt context, uploaded datasets |
| 26(5) | Monitor operation on the basis of the instructions for use; inform the provider under Art 72. Where use in accordance with the instructions may result in a risk within Art 79(1): inform the provider or distributor **and** the relevant market surveillance authority without undue delay, **and suspend use**. On a serious incident: inform first the provider, then the importer or distributor and the market surveillance authorities. If the provider cannot be reached, Art 73 applies mutatis mutandis | Build the escalation path before go-live. Financial institutions subject to Union financial services internal governance rules meet the monitoring duty by complying with those rules |
| 26(6) | Keep the logs automatically generated by the system, to the extent under the deployer's control, for a period appropriate to the intended purpose, **at least six months**, unless Union or national law — in particular data protection law — provides otherwise | Six months is a floor, not a target. GDPR storage limitation can require shorter for some fields; sectoral law can require longer. See the log-retention spec in `artefacts-disclosures.md` |
| 26(7) | Before putting into service or using a high-risk system **at the workplace**, employers inform **workers' representatives and the affected workers** that they will be subject to it | Timing is before use, not at rollout. Works-council procedures under national law run in parallel; Art 2(11) preserves more worker-protective national rules |
| 26(8) | Public authorities and Union bodies comply with the registration obligations in Art 49. If the system is not registered in the EU database, they **shall not use it** and shall inform the provider or distributor | A hard stop for public-sector deployment |
| 26(9) | Use the Art 13 information to carry out the **DPIA** under GDPR Art 35 or Art 27 of Directive (EU) 2016/680 | The provider's instructions feed the DPIA; the DPIA does not replace anything under the AI Act |
| 26(11) | Without prejudice to Art 50, deployers of Annex III high-risk systems that **make or assist in making decisions related to natural persons** shall inform those persons that they are subject to the use of the system | A separate notice from the Art 50(1) chatbot disclosure and from the GDPR Art 13/14 information |
| 26(12) | Cooperate with competent authorities | |

Art 26(10) covers post-remote biometric identification for law enforcement: ex ante judicial or administrative authorisation, or within 48 hours; deletion of data if refused; no untargeted use; documentation in the police file; annual reports to market surveillance and data protection authorities.

## Art 27 — Fundamental rights impact assessment

### Who must do it

Art 27(1): prior to deploying a high-risk system referred to in **Art 6(2)** — that is, Annex III — with the exception of systems intended to be used in the area listed in **Annex III point 2** (critical infrastructure):

- deployers that are **bodies governed by public law**;
- deployers that are **private entities providing public services**;
- deployers of high-risk systems referred to in **Annex III points 5(b) and (c)** — creditworthiness evaluation or credit scoring, and risk assessment and pricing for life and health insurance.

That last category is the one commercial teams miss. A fintech scoring creditworthiness, or an insurer pricing life or health cover, owes a FRIA even though it is a purely private business.

Deployers of Annex I high-risk systems do not owe a FRIA. Neither do deployers of Annex III point 2 systems.

### What it contains — Art 27(1)(a) to (f)

(a) a description of the deployer's processes in which the system will be used in line with its intended purpose;
(b) a description of the period of time within which, and the frequency with which, each system is intended to be used;
(c) the categories of natural persons and groups likely to be affected in the specific context;
(d) the specific risks of harm likely to have an impact on those categories, taking into account the information given by the provider under Art 13;
(e) a description of the implementation of human oversight measures, according to the instructions for use;
(f) the measures to be taken if those risks materialise, including arrangements for internal governance and complaint mechanisms.

### Timing, reuse and notification

- Art 27(2): the obligation applies to the **first use**. In similar cases the deployer may rely on previously conducted FRIAs or on existing impact assessments carried out by the provider. If any element changes or goes out of date during use, the deployer updates it.
- Art 27(3): once performed, the deployer **notifies the market surveillance authority of the results**, submitting the filled-out template. Deployers may be exempt from notifying in the case referred to in Art 46(1) (derogation from conformity assessment for exceptional reasons of public security or protection of life and health).
- Art 27(4) as replaced by Reg (EU) 2026/1744 Art 1(13)(a): where an obligation under Art 27 is already met through the GDPR Art 35 DPIA or Art 27 of Directive (EU) 2016/680, the deployer **may include cross-references to the relevant sections of that DPIA or include relevant parts of it** in the FRIA. The pre-omnibus wording said the FRIA "shall complement" the DPIA; the amendment makes cross-referencing explicit. It still is not a substitution — the FRIA's own six elements must be present, whether by text or by reference.
- Art 27(5) as replaced by Reg (EU) 2026/1744 Art 1(13)(b): the AI Office develops a template for a questionnaire, including through an automated tool, which is to allow cross-references to the DPIA. Not yet published as at 2026-08-05. [[UNVERIFIED: whether the AI Office FRIA template has been released]]

### FRIA vs DPIA vs Art 26(11) notice

| Instrument | Trigger | Audience | Legal source |
|---|---|---|---|
| DPIA | High risk to rights and freedoms from personal data processing | Internal; supervisory authority on prior consultation | GDPR Art 35 |
| FRIA | Deployment of an Annex III high-risk system by a public body, a private provider of public services, or any deployer of Annex III 5(b)/(c) | Notified to the market surveillance authority | AI Act Art 27 |
| Art 26(11) notice | Annex III high-risk system making or assisting decisions about natural persons | The affected individuals | AI Act Art 26(11) |
| Art 50 disclosure | Interaction with an AI system, deepfakes, emotion recognition, biometric categorisation | The affected individuals | AI Act Art 50 |

Four different instruments, four different triggers. Producing one does not discharge the others.

## Checkpoints

- [ ] Deployer status confirmed per system, and tested against Art 25(1) for an accidental role flip
- [ ] Instructions for use obtained from the provider **before** deployment, and actually read
- [ ] Human oversight assigned to named roles, with competence, training and authority documented
- [ ] Input data under deployer control assessed for relevance and representativeness
- [ ] Monitoring, suspension and incident escalation path documented, with named recipients
- [ ] Log retention set to at least six months, reconciled with GDPR storage limitation and sectoral law
- [ ] Workers' representatives and affected workers informed before workplace use
- [ ] Public-sector deployer verified that the system is registered before use
- [ ] DPIA carried out using the Art 13 information
- [ ] Art 26(11) notice drafted for decisions about natural persons
- [ ] FRIA scope tested against all three Art 27(1) categories, including Annex III 5(b) and (c)
- [ ] FRIA contains all six elements, by text or explicit cross-reference to the DPIA
- [ ] FRIA notified to the market surveillance authority