Deployers of high-risk systems (Art. 26, 27)

From 2 December 2027 the high-risk rules apply to systems listed in Annex III (before the 2026 amendment: 2 August 2026). For AI in products under Annex I they apply from 2 August 2028. A deployer of a high-risk system then has these duties under Art. 26:

• Instructions. Use the system according to the provider’s instructions for use.
• Human oversight. Assign oversight to people who have the competence, training, authority and support they need.
• Input data. Where you control the input data, make sure it is relevant and sufficiently representative for the intended purpose.
• Monitoring. Monitor the operation of the system and inform the provider and the authorities about risks and serious incidents.
• Logs. Keep the logs the system generates automatically, as far as they are under your control, for at least six months, unless other law says otherwise.
• Workers. Before using a high-risk system at the workplace, inform the workers concerned and their representatives.
• Registration. Public authorities register their use in the EU database.
• Data protection. Use the information from the provider for a data protection impact assessment where one is needed.

#Fundamental rights impact assessment (Art. 27)

Before first use, some deployers assess the impact of the system on fundamental rights: bodies governed by public law, private bodies providing public services, and deployers of systems for credit scoring or for pricing life and health insurance. The amendment lets the assessment refer to an existing data protection impact assessment, and the AI Office provides a questionnaire template.

#Serious incidents

Providers report serious incidents within 15 days of becoming aware, within 2 days for a widespread infringement or certain serious incidents, and within 10 days in case of death (Art. 73). Deployers inform the provider and the authorities (Art. 26(5)).