Builds on AR-000142 (Human Oversight), AR-000210 (High-Risk AI Systems), AR-000230 (Transparency), and AR-000240 (Provider Obligations) — none of their content is re-derived here. This is the deployer-side counterpart to AR-000240's provider-side checklist.
Executive summary
What this means
Who this applies to
Regulatory context
Requirements
What organizations must do
- Treat Article 26(1)'s "use per instructions" duty as the anchor obligation — monitoring and human oversight are both measured against how carefully the instructions for use are implemented.
- Build internal risk-escalation paths that do not wait for external confirmation — the paragraph 5 suspension duty is triggered by the deployer's own reasonable belief, not a regulator's finding.
- Treat worker notification (paragraph 7) as a pre-condition to lawful workplace use, not a courtesy — notification must occur before putting the system into service.
- Build individual notification (paragraph 11) into the decision workflow itself for Annex III systems used to make or assist decisions about people.
- Treat the EU database registration check as a gating step before use for public-authority deployers, not a formality completed afterward.
Common mistakes
Assuming human oversight is satisfied once a person is nominally assigned to the role, without confirming they have the competence, training, and authority Article 26(2) specifies, is a common mistake — the paragraph's three qualifying conditions are cumulative, not any-one-of.
Treating the six-month log retention period as a ceiling rather than a floor is a second mistake — Article 26(6) specifies "at least six months," calibrated to the system's intended purpose.
Assuming the data protection impact assessment obligation under Article 26(9) is automatically satisfied by AI Act compliance is a third mistake — the paragraph directs deployers to use the Article 13 information to help meet their existing GDPR Article 35 or Law Enforcement Directive Article 27 obligation; it does not substitute the AI Act for that separate legal duty.
Confusing the Article 26(11) individual-notification duty (which applies specifically to Annex III systems making or assisting decisions about natural persons) with the broader Article 50 transparency duties covered in AR-000230 (which apply based on system function, not Annex III status) is a fourth mistake.
Open questions
- Whether Article 26 is genuinely unamended by the Digital Omnibus, given the absence of a disclaimer on its Service Desk page — consistent with the pattern already noted for Articles 13, 16, 17, 20, 47, 48, and 49.
- How Article 27 (fundamental rights impact assessment) interacts with the Article 26 obligations covered here — Article 27 sits immediately adjacent in the Regulation's structure but was outside this article's scope and was not independently verified on this pass.
- Whether the Article 26(9) direction to use Article 13 information changes the scope of a deployer's existing GDPR Article 35 DPIA, or only supplies an input to it — not addressed by any source consulted on this pass.