What must deployers do under the EU AI Act?
Article 26 gives deployers — organizations that use AI systems under their own authority — their own set of obligations. These include: using the system in accordance with provider instructions, assigning human oversight to competent persons, ensuring input data quality, monitoring the system during operation, maintaining logs, and informing affected persons when required.
Many organizations assume AI Act compliance is mainly a provider problem. It is not. Deployers face direct regulatory obligations that must be governed independently.
Key points
- Deployers must follow provider instructions for use. Deviating from the intended purpose may shift the deployer's actor role to provider.
- Human oversight must be assigned to specific, competent individuals — not delegated generically to a department.
- Deployers of high-risk systems in specific public-sector and private-sector contexts must conduct a fundamental rights impact assessment.
- Automatic logging must be maintained for the duration required by the regulation, and logs must be available to competent authorities on request.
- Deployers must cooperate with the provider's post-market monitoring activities and share operational data where relevant.
Why it matters
The deployer role is where AI governance becomes operational for most organizations. You may not build AI systems, but you use them — and the EU AI Act holds you accountable for how you use them. Deployer obligations cannot be satisfied by pointing to the provider's compliance. The organization must document its own governance: how oversight is assigned, how the system is monitored, how transparency is ensured, and how evidence is maintained.
How EAB approaches this
EAB structures deployer governance through the AI System Registry, Actor Role Assessment, Human Oversight Documentation, and Obligation Matrix. Each deployer obligation is mapped, evidence-tracked, and connected to the approval and audit trail.