Article 26 makes the deployer of a high-risk AI agent watch it once it is live: whether it is used as instructed, whether its inputs are fit, how it behaves and what goes wrong. Findings about the agent itself go to the provider; risks go to the provider and the authority, with use suspended; serious incidents are reported at once.
What does Article 26 require deployers to monitor?
The EU AI Act divides duties between providers, who build high-risk systems, and deployers, who use them. Article 26 lists the deployer's duties. The monitoring part, in substance, asks the deployer to:
- use the system in line with the provider's instructions for use;
- make sure input data it controls is relevant and sufficiently representative for the intended purpose;
- monitor the system's operation on the basis of those instructions;
- keep the logs generated under its control;
- inform the provider when monitoring reveals something the provider needs for its own post-market monitoring;
- inform the provider and the relevant authority, and suspend use, where it has reason to think use may present a risk;
- report serious incidents without delay.
Our overview of Article 26 deployer obligations covers the duties beyond monitoring, such as oversight and informing workers.
Who counts as a deployer here?
Any organisation using a high-risk AI system under its own authority in a professional capacity. A bank running a vendor's credit agent, or an insurer running a pricing agent for life cover, is a deployer. If it built the agent itself, it is also the provider and must monitor in both roles.
Regulated financial institutions have a specific accommodation: where they are subject to internal governance rules under financial services law, the Act treats meeting those rules as meeting the monitoring duty. That does not reduce what must be watched. It means monitoring should live inside existing risk and governance processes rather than a separate AI track. For a short summary of all deployer duties, see what the EU AI Act requires deployers to do.
What should you watch once an agent is live?
A scoring model's monitoring focuses on output quality and population drift. An agent needs more, because it takes steps and touches systems. Watch five things.
Use within instructions. Is the agent being used only for its intended purpose? Agents invite scope creep: staff start asking a claims-intake agent to draft settlement letters because it is there.
Input fitness. Are the sources the agent reads still the ones it was certified on? A new document type or a change in how data arrives can quietly degrade it.
Behaviour. Rates of allowed, held and refused actions, overrides by approvers and complaints, each tracked per capability. A sudden fall in refusals can be as worrying as a rise.
Outcomes. Are the decisions it supports producing the results expected, including for different groups of people?
Change. Has the provider updated the model, or has your configuration changed?
When must a finding go back to the provider?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Use in line with instructions | Agent bounds match the provider's intended purpose; out-of-scope requests refused | Refusal records naming scope as the deciding bound |
| Fit input data | Sources certified per agent; new source types blocked until tested | Source register with certification dates |
| Monitor operation | Verdict rates, overrides and complaints reported per capability against thresholds | Monitoring reports and threshold breaches |
| Inform provider of findings | Findings traceable to the system logged and sent through a defined channel | Provider notices with dates and responses |
| Risk: inform and suspend | Owner can drop agent to read-only or stop it; authority notified | Suspension record and notifications |
| Serious incidents reported | Incident triage includes the Act's serious incident test | Incident records and reports made |
| Keep logs | Append-only action record retained for the required period | Retention settings and export tests |
The dividing line is cause. If the finding comes from how you deployed the agent, such as a wrong limit you set or a source you added, fix it yourself and record it. If it comes from the system, such as the model mishandling a document type it was designed for, the provider needs to know. If the finding suggests the agent may harm health, safety or fundamental rights, suspend and tell both the provider and the authority. When in doubt, tell the provider: the duty exists because providers cannot see your operation.
What will a supervisor ask?
- What do you monitor for this agent, and who looks at it?
- What thresholds trigger review or suspension?
- Show us a finding you sent to the provider, and what happened.
- Have you ever suspended the agent? Why, and for how long?
- How do you know staff are using it only for its intended purpose?
- Are the people monitoring it trained to understand what they see?
That last question links monitoring to literacy; see how to meet AI literacy duties for staff who supervise agents.
What does Article 26 monitoring not cover?
It does not require deployers to validate the provider's design; that is the provider's conformity work. It does not set monitoring metrics or thresholds. It does not apply to agents outside the high-risk category, although the same discipline is good practice. And it is an EU duty: US deployers may meet similar expectations under state law, as set out in Colorado AI act duties for deployers. For the full control map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is monitoring the provider's dashboard enough?
Rarely. The provider sees its system; you see your cases, your complaints and your outcomes. Monitoring must include what only the deployer can observe.
How quickly must a risk be reported?
The Act expects action without undue delay, and serious incidents faster still. Set internal deadlines short enough that the reporting decision is made within days, not weeks.
Does suspending use mean switching the agent off?
Not necessarily. Reducing the agent to read-only, or holding every action for a person, can remove the risk while keeping useful work going.