Deployers of high-risk AI systems carry specific duties under the EU AI Act, mainly in Article 26. This checklist lists each duty in plain words, the control that meets it when the system is an AI agent, the evidence it leaves and the owner, plus the transparency and AI literacy duties every deployer has.
Who counts as a deployer?
A deployer is an organisation using an AI system under its own authority in a professional activity. If you put an agent to work in your operations, you are almost certainly its deployer, and you may also be its provider if you developed it or put it into service under your own name. The definitions are explained in what a deployer is under the EU AI Act and the dividing line in who is the provider and who is the deployer of an AI agent. The wider map of duties to controls is in AI agent regulation, mapped to controls.
Most of Article 26 applies only to high-risk systems, so classify first. Every deployer, whatever the risk, has the Article 4 duty on AI literacy and, where people interact with the system, the Article 50 transparency duties.
When should you use it?
Before a high-risk agent goes live, and at each review of it. Use a shorter version for agents with transparency obligations only. For the article itself, read EU AI Act Article 26: deployer obligations when you run an AI agent; for the practical steps, how to meet deployer obligations for an AI agent.
How do you fill in each line?
Read each duty as it applies to an agent that acts, not a model that predicts. "Use the system in line with the instructions for use" means the agent's bounds must match what the provider says the system is fit for. "Assign human oversight" means named people, with authority to stop or override the agent, not a monitoring dashboard.
For each line, write the control in one sentence and name a record that proves it. If the only evidence is "we do this", the line is not met.
The checklist
| No. | Duty (in substance) | Applies to | Control for an agent | Evidence |
|---|---|---|---|---|
| 1 | Use the system in line with the provider's instructions for use | High-risk | Agent's role scope and bounds checked against instructions | Mapping document |
| 2 | Assign human oversight to people with the competence, training, authority and support needed | High-risk | Named overseers per capability with power to hold, override and suspend | Oversight procedure, training records |
| 3 | Where you control input data, make sure it is relevant and sufficiently representative for the intended purpose | High-risk | Sources limited to named systems; provenance recorded | Source list, data review |
| 4 | Monitor operation; inform the provider, and where required the authorities, of risks and serious incidents; suspend use where needed | High-risk | Daily review of held and refused work; incident and suspension procedures | Review records, incident log |
| 5 | Keep the logs the system generates automatically, to the extent they are under your control, for an appropriate period | High-risk | Append-only verdict record with retention set | Retention policy, log extract |
| 6 | Inform workers' representatives and affected workers before using the system in the workplace | High-risk, workplace use | Consultation record | Minutes or notice |
| 7 | Inform people that a high-risk system is used to make or help make decisions about them | High-risk, decisions on people | Notice in customer journey | Notice wording |
| 8 | Use the provider's information to carry out a data protection impact assessment where required | High-risk | DPIA under GDPR Article 35 | DPIA reference |
| 9 | Carry out a fundamental rights impact assessment where Article 27 applies | Certain deployers | FRIA completed before first use | FRIA reference |
| 10 | Tell people they are interacting with an AI system, where Article 50 applies | All | Disclosure at start of interaction | Disclosure wording |
| 11 | Take measures for a sufficient level of AI literacy among staff | All | Role-based training | Training records |
A filled example
A hypothetical insurer deploying an agent that prepares risk assessments for life insurance applications, which falls in an Annex III high-risk area.
| No. | Control in place | Evidence | Owner |
|---|---|---|---|
| 1 | Agent drafts a risk summary for underwriters; it does not set price. Matches provider's stated purpose | Mapping v2 | Head of underwriting |
| 2 | Three senior underwriters named; trained on the agent's limits; may reject any summary and suspend the agent | Procedure HO-03; training log | Head of underwriting |
| 3 | Reads only the application, medical questionnaire and policy system | Source list | Underwriting operations |
| 4 | Daily held queue review; serious incidents reported to provider within the contract timescale | Daily records; contract clause | Underwriting operations |
| 5 | All verdicts retained with policy records | Retention schedule | Records manager |
| 7 | Applicants told in the application journey that an AI system helps prepare the assessment | Journey wording | Compliance |
| 8 | DPIA covers health data processing | DP-11 | DPO |
| 9 | FRIA completed | FR-04 | Compliance |
Line 2 is the one supervisors are likely to test hardest. Named people with real authority to override and stop the agent, trained on its limits, are the substance of human oversight.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Do deployer obligations apply to agents that are not high-risk?
Most of Article 26 does not. AI literacy applies to every organisation using AI, and transparency duties under Article 50 apply where people interact with the agent or where certain content is generated.
Can we rely on the provider for compliance?
No. Providers and deployers have different obligations. The provider's documentation helps you meet yours, but oversight, monitoring and use in your operation are your duties.
When do the high-risk obligations apply?
The Act entered into force on 1 August 2024 and applies in phases. Application dates for the high-risk obligations have been subject to proposed changes, so check the current position with counsel.