Last updated: 3 November 2026
Quick answer: EU AI Act deployer obligations apply to any organisation using an AI system in a professional capacity. Today they cover AI literacy measures, the ban on prohibited practices and Article 50 transparency duties. Article 26 duties for high-risk systems, including human oversight, log retention and informing staff, apply from 2 December 2027 for Annex III systems.
Most organisations will never build an AI model, but almost all of them now use one. Under Regulation (EU) 2024/1689, that makes them deployers, and the AI Act gives deployers their own set of duties, separate from those of the providers who develop the systems.
The timetable changed in 2026. The Digital Omnibus on AI entered into force on 27 July 2026 and pushed back the high-risk rules, but it did not remove them, and several deployer duties already apply. This guide sets out which EU AI Act deployer obligations are live now, which are coming, and how to prepare.
Who has EU AI Act deployer obligations?
A deployer is any natural or legal person, public authority, agency or other body that uses an AI system under its authority, except for personal non-professional use. If your staff use an AI tool for work, your organisation is a deployer of that tool.
The definition in Article 3(4) of the AI Act on EUR-Lex is broad on purpose. It covers a bank using a credit scoring model, a retailer using a chatbot, an HR team using a CV screening tool and a hospital using triage software. The AI Act also applies to deployers established outside the EU where the output of the system is used in the EU.
When does a deployer become a provider?
Article 25 treats a deployer as a provider of a high-risk system, with the much heavier provider obligations, if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to it, or changes the intended purpose of a system so that it becomes high-risk. Fine-tuning a general tool and using it for recruitment decisions is a typical way this happens.
Common mistake: Assuming that buying an AI system from a reputable vendor moves all AI Act risk to the vendor. The provider carries the product obligations, but the way you use the system, and any changes you make, create obligations of your own.
Which EU AI Act deployer obligations apply now?
As of late 2026, three sets of deployer duties are already in application: the prohibitions, AI literacy and Article 50 transparency. The European Commission’s AI Act page confirms that prohibited practices and AI literacy obligations have applied since 2 February 2025.
Prohibited practices (Article 5)
Deployers must not use AI systems for prohibited practices, such as social scoring, certain manipulative techniques, emotion recognition in the workplace and education except for medical or safety reasons, and untargeted scraping of facial images to build recognition databases. The Digital Omnibus added new prohibitions on AI systems that generate child sexual abuse material or non-consensual intimate content.
AI literacy (Article 4)
Deployers must take measures to support the AI literacy of staff and others using AI systems on their behalf. The Digital Omnibus on AI, Regulation (EU) 2026/1744, softened the original wording, which required deployers to ensure a sufficient level of literacy. The duty still exists, so you still need a documented approach: role-based training, usage guidance and records.
Transparency (Article 50)
Article 50 has applied since 2 August 2026. Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them. Deployers who generate or manipulate image, audio or video deep fakes must disclose that the content is artificial, with lighter rules for evidently artistic, creative or satirical work. Deployers who publish AI-generated text to inform the public on matters of public interest must disclose that too, unless the text has undergone human editorial review and someone holds editorial responsibility.
In practice: Marketing and communications teams are often the first to trigger Article 50. Add an AI disclosure step to your content approval workflow and record which tools produced which assets.
What will Article 26 require for high-risk AI systems?
Article 26 sets the core duties for deployers of high-risk AI systems. Following the Digital Omnibus, they apply from 2 December 2027 for stand-alone high-risk systems listed in Annex III and from 2 August 2028 for high-risk systems that are safety components of products under Annex I.
Annex III covers areas such as biometrics, critical infrastructure, education, employment and worker management, access to essential private and public services (including credit scoring and life and health insurance pricing), law enforcement, migration and the administration of justice. If you use AI in any of these areas, Article 26 is likely to apply to you.
| Article 26 paragraph | Deployer obligation | Evidence to keep |
|---|---|---|
| 26(1) | Use the system in line with the provider’s instructions for use | Instructions on file, usage procedures |
| 26(2) | Assign human oversight to people with the competence, training, authority and support needed | Named overseers, training records |
| 26(4) | Ensure input data you control is relevant and sufficiently representative | Data quality checks |
| 26(5) | Monitor operation, inform the provider of risks, suspend use and report serious incidents | Monitoring logs, incident records |
| 26(6) | Keep automatically generated logs under your control for at least six months | Log retention configuration |
| 26(7) | Inform workers’ representatives and affected workers before workplace use | Consultation records, notices |
| 26(8) | Public authority deployers register use in the EU database | Registration confirmation |
| 26(9) | Use provider information to carry out a GDPR DPIA where required | Completed DPIA |
| 26(11) | Inform people that they are subject to an Annex III system making or assisting decisions about them | Privacy notices, decision letters |
| 26(12) | Cooperate with competent authorities | Contact point, response process |
Financial institutions have a specific link to their existing rules: under Article 26(6), those subject to EU financial services law keep logs as part of the documentation required by that law. If you are also working on DORA or NIS2, the same logging, monitoring and incident processes can serve both regimes.
Keeping these duties connected to your wider compliance programme is where a single platform helps. Enactia’s AI-powered GRC platform maps AI Act requirements to ISO 42001, GDPR and security frameworks through its cross-framework control mapping, so one control can evidence several obligations. To test it on your own AI inventory, start your 14-day free trial.
Who must carry out a fundamental rights impact assessment?
Under Article 27, a fundamental rights impact assessment (FRIA) is required before first use of an Annex III high-risk system by bodies governed by public law, private entities providing public services, and deployers of systems for credit scoring or life and health insurance risk assessment and pricing. High-risk systems used for critical infrastructure are excluded.
The FRIA must describe how and how often the system will be used, the categories of people affected, the specific risks of harm, human oversight measures, and the steps to take if risks materialise, including complaint mechanisms. The deployer must notify the market surveillance authority of the results. Where a data protection impact assessment already covers some of these points, the FRIA complements it rather than duplicating it. Our guide to DPIAs under GDPR explains that process.
How do the obligations of deployers and providers compare?
Providers build and certify the system; deployers use it responsibly. The table below summarises the split for high-risk systems.
| Topic | Provider | Deployer |
|---|---|---|
| Risk and quality management | Risk management system and quality management system | Use according to instructions, monitor operation |
| Technical documentation | Prepare and keep technical documentation, conformity assessment, CE marking | Keep instructions for use and records of use |
| Logs | Design the system to record logs | Keep logs under their control for at least six months |
| Human oversight | Design for effective oversight | Assign competent, trained people to oversee |
| Impact on people | Accuracy, robustness and cybersecurity by design | Inform affected people and workers; FRIA where required |
| Incidents | Post-market monitoring and serious incident reporting | Inform provider and authorities, suspend use if needed |
What are the penalties for deployers?
Breaches of deployer obligations under Article 26 and transparency obligations under Article 50 can lead to fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. Using a prohibited practice can lead to fines of up to EUR 35 million or 7%. For SMEs, including start-ups, Article 99 applies whichever of the two amounts is lower.
EU AI Act deployer checklist
Use this checklist to build your deployer programme before the high-risk rules apply.
- Inventory: List every AI system in use, its vendor, business owner and purpose.
- Classify: Mark each system as prohibited, high-risk (Annex I or III), transparency-only or minimal risk.
- Check your role: Confirm you are a deployer and not a provider under Article 25 for each system you have modified or rebranded.
- Stop prohibited uses: Confirm no system is used for a practice banned by Article 5.
- AI literacy: Run role-based training and keep records, with a documented AI use policy.
- Transparency: Add disclosure steps for deep fakes, public-interest text and emotion recognition.
- Vendor due diligence: Request instructions for use, conformity information and log access from providers through your vendor risk assessments.
- Human oversight: Name overseers for each high-risk system and train them.
- Logs and monitoring: Configure at least six months’ log retention and a monitoring routine.
- People: Prepare worker consultation and notices for affected individuals.
- Assessments: Plan FRIAs and DPIAs where required, before first use.
- Incidents: Extend incident procedures to cover AI serious incidents and provider notification.
Key takeaways
- Any organisation using AI professionally is a deployer under the EU AI Act.
- Prohibitions and AI literacy have applied since 2 February 2025, and Article 50 transparency since 2 August 2026.
- The Digital Omnibus moved Article 26 high-risk duties to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Public bodies, public service providers, lenders and insurers need a FRIA before first use of certain high-risk systems.
- Start with an AI inventory and risk classification; everything else depends on it.
Frequently asked questions
What are the main EU AI Act deployer obligations?
Deployers must avoid prohibited practices, support staff AI literacy and meet Article 50 transparency duties now. For high-risk systems, Article 26 adds using systems according to instructions, human oversight, input data quality, monitoring, log retention for at least six months, informing workers and affected people, and cooperation with authorities, with a FRIA for some deployers.
When do Article 26 deployer obligations apply?
After the Digital Omnibus on AI, Regulation (EU) 2026/1744, Article 26 duties apply from 2 December 2027 for stand-alone high-risk systems listed in Annex III, and from 2 August 2028 for high-risk systems covered by the product legislation in Annex I. Prohibitions, AI literacy and Article 50 transparency already apply.
Is using ChatGPT or a similar tool at work a deployer activity?
Yes. Using a general-purpose AI tool for work makes your organisation a deployer of that system. Most everyday uses are not high-risk, but AI literacy and, where relevant, Article 50 transparency duties apply. If you use the tool for an Annex III purpose, such as screening job applicants, high-risk obligations may follow.
Does a FRIA replace a GDPR DPIA?
No. The fundamental rights impact assessment under Article 27 and the data protection impact assessment under Article 35 GDPR are separate obligations. Where a DPIA already covers some FRIA content, the FRIA complements it. In practice, many organisations run both from a shared template to avoid duplicating descriptions of the system and its risks.
Can a deployer become responsible as a provider?
Yes. Under Article 25, a deployer is treated as a provider of a high-risk system if it puts its own name or trademark on it, makes a substantial modification, or changes the intended purpose of a system so that it becomes high-risk. In those cases the full provider obligations, including conformity assessment, apply.
Prepare now, while the timeline allows
The Digital Omnibus gave deployers more time for high-risk duties, not an exemption. Organisations that build their AI inventory, literacy programme and oversight processes now will be ready by December 2027 and can show regulators, customers and staff that AI use is under control. Pairing the AI Act with an AI management system such as ISO/IEC 42001 is a practical way to structure the work, as our ISO 42001 certification roadmap explains.
To discuss your AI governance programme, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
