AI Act Article 26: Obligations, Deadlines & Penalties

Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems. Regulation (EU) 2024/1689, Article 26, Article 26

Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Regulation (EU) 2024/1689, Article 26, Article 26

To the extent the deployer exercises control over the input data, that deployer shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system. Regulation (EU) 2024/1689, Article 26, Article 26

Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Regulation (EU) 2024/1689, Article 26, Article 26

Where deployers have reason to consider that the use of the high-risk AI system may result in a risk, they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Regulation (EU) 2024/1689, Article 26, Article 26

Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident. Regulation (EU) 2024/1689, Article 26, Article 26

Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months. Regulation (EU) 2024/1689, Article 26, Article 26

Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system. Regulation (EU) 2024/1689, Article 26, Article 26

Deployers of high-risk AI systems that are public authorities, or Union institutions, bodies, offices or agencies shall comply with the registration obligations referred to in Article 49. Regulation (EU) 2024/1689, Article 26, Article 26

When such deployers find that the high-risk AI system that they envisage using has not been registered in the EU database referred to in Article 71, they shall not use that system and shall inform the provider or the distributor. Regulation (EU) 2024/1689, Article 26, Article 26

Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680. Regulation (EU) 2024/1689, Article 26, Article 26

In the framework of an investigation for the targeted search of a person suspected or convicted of having committed a criminal offence, the deployer of a high-risk AI system for post-remote biometric identification shall request an authorisation, ex-ante, or without undue delay and no later than 48 hours, by a judicial authority or an administrative authority whose decision is binding and subject to judicial review, for the use of that system. Regulation (EU) 2024/1689, Article 26, Article 26

If the authorisation requested pursuant to the first subparagraph is rejected, the use of the post-remote biometric identification system linked to that requested authorisation shall be stopped with immediate effect and the personal data linked to the use of the high-risk AI system for which the authorisation was requested shall be deleted. Regulation (EU) 2024/1689, Article 26, Article 26

In no case shall such high-risk AI system for post-remote biometric identification be used for law enforcement purposes in an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine and present or genuine and foreseeable threat of a criminal offence, or the search for a specific missing person. Regulation (EU) 2024/1689, Article 26, Article 26

It shall be ensured that no decision that produces an adverse legal effect on a person may be taken by the law enforcement authorities based solely on the output of such post-remote biometric identification systems. Regulation (EU) 2024/1689, Article 26, Article 26