The Complete Deployer Obligations Checklist (Article 26)

If you use AI systems developed by others—whether SaaS tools, APIs, or embedded AI—you're likely a deployer under the EU AI Act. This article provides a complete checklist of your obligations under Article 26.

Who is a Deployer?

A deployer is any natural or legal person that uses an AI system under their authority, except where the AI system is used in the course of a personal non-professional activity.

Most SMEs fall into this category. You didn't build the AI, but you're responsible for how it's used.

The Complete Deployer Checklist

✅ Use According to Instructions

• Obtain and retain the provider's instructions for use
• Use the AI system only as intended by the provider
• Don't modify the system beyond what's allowed

✅ Assign Human Oversight

• Designate competent individuals for oversight
• Ensure they have appropriate training
• Give them authority to intervene or stop the system

✅ Manage Input Data

• Ensure input data is relevant and representative
• Control data quality where you have control
• Document your data management practices

✅ Monitor Operation

• Monitor the AI system during operation
• Watch for risks or incidents
• Review performance regularly

✅ Keep Logs

• Retain logs generated by the AI system
• Keep them for at least 6 months (or as required)
• Ensure logs are accessible for audits

✅ Inform Affected Parties

• Tell workers when AI is used in the workplace (high-risk)
• Provide transparency notices to affected persons
• Handle subject access requests appropriately

✅ Report Issues

• Inform the provider of any risks you identify
• Suspend use if you suspect non-compliance
• Report serious incidents to authorities

✅ Conduct Impact Assessments (if required)

• Complete FRIA for high-risk public sector deployments
• Link to existing DPIAs where relevant

Download the Full Checklist

Get our Article 26 Deployer Checklist as a downloadable template you can use to track your compliance.