EU AI Act Article 26 deployer duties: why employers need competent overseers

Article 26 is the reason EU employers using high-risk AI need competent overseers. It requires deployers to assign human oversight to people with the necessary competence, training and authority, and to support them. A name on an org chart does not meet that duty; the employer needs people who can show they can do the work.

What does Article 26 require of deployers?

The EU AI Act separates providers, who build AI systems, from deployers, who use them under their own authority. Article 26 sets out what deployers of high-risk systems must do. In plain words, a deployer must:

• use the system in line with the provider's instructions, through suitable technical and organisational measures;
• assign human oversight to natural persons who have the necessary competence, training and authority, and the support they need;
• make sure the input data it controls is relevant and sufficiently representative for the intended purpose;
• monitor the system's operation, tell the provider and authorities about risks and serious incidents, and suspend use where needed;
• keep the logs the system generates, where they are under its control, for an appropriate period;
• inform workers' representatives and affected workers before putting a high-risk system into use at the workplace;
• tell people when a high-risk system on the Act's list makes or assists decisions about them.

Certain deployers, including those using AI for credit scoring of individuals or for life and health insurance pricing, must also carry out a fundamental rights impact assessment under Article 27. A plain definition of the deployer role is in what is a deployer under the EU AI Act.

Who does it apply to?

Article 26 applies to organisations that deploy high-risk AI systems in the EU. The clearest examples in financial services are creditworthiness assessment and credit scoring of individuals, and risk assessment and pricing in life and health insurance. Banks, lenders, buy-now-pay-later firms and insurers are the obvious employers. Public bodies using high-risk systems are deployers too, with extra transparency duties.

Agents that act outside the high-risk categories do not trigger Article 26, but employers often borrow its structure. A payments firm may not be deploying a high-risk system in the Act's sense and still choose to name, train and record its overseers, because supervisors and auditors expect controls. How that plays out in practice is covered for banking and for payments.

Why does "competence, training and authority" matter to you?

Each of the three words is a hiring criterion.

Competence means the person can actually do the oversight. They understand what the system decides, where it fails and what the policy behind it says. An employer has to judge this before assigning someone, which means it wants evidence at hiring time or soon after.

Training means the employer has prepared the person for this system and this task. That creates internal programmes, refresher cycles and records of who completed what. Candidates who arrive with relevant training already done are easier to assign.

Authority means the person can override or stop the system without asking permission each time. That shapes the role's grade. An overseer who cannot reject the system's output is not an overseer, so employers have to place these roles where approval rights sit.

Put together, Article 26 turns oversight from an informal habit into a named role with a standard. That is the opening for people moving from claims, credit, collections, customer service and operations into AI operations.

Which roles carry these duties?

Titles vary widely, and many have not caught up with the work. That argument is made at length in job titles have not caught up with AI agents, so read the duties. The common shapes are:

• Reviewer with approval rights: decides on cases the system holds or flags.
• Oversight or operations lead: monitors the system, handles incidents and suspends use when needed.
• Agent or system owner: answers for one system's scope, data and logs.
• Quality and control analyst: samples decisions and checks logs.

For a list of the titles employers actually use, see what job titles employers use for people who supervise AI agents.

How do you show employers you meet Article 26?

What will an interviewer ask?

Expect questions that test the three words directly:

1. "What would you need to know about our credit system before you could oversee it?" Name its purpose, inputs, known limits, the policy it applies and the stop procedure.
2. "Your manager asks you to sign off a batch of cases you have not reviewed. What do you do?" Decline and explain why. Oversight without review is the failure Article 26 is meant to prevent.
3. "When would you recommend suspending the system?" When errors repeat with a shared cause, when a serious incident occurs, or when you cannot explain its behaviour.

A candidate we will call Elena, a mortgage processor, prepared by mapping her current four-eyes checks to the deployer duties. It showed she already practised competence and authority, only without an AI system in the loop.

What does Article 26 not cover?

It does not apply to systems outside the high-risk categories. It does not set a qualification for overseers or name an approved course. It does not transfer the organisation's accountability to the individual. And it does not replace other law: GDPR, consumer protection rules and sector supervision still apply.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy gives you evidence for all three words. The Operator track covers how a governed agent decides and human review; the written exam and two-week practicum, signed off by an assessor, show competence and training. Some employers that use Pryme Intelligence tie approval rights to a current certificate, which is one practical way to link authority to proof. Certificates are issued through VerifyDoc.ai and checkable at source.