AI Act Obligations for Deployers

Source text: “This Regulation applies to:”

In practice: Map your organisation's role (provider or deployer) and determine whether your AI systems or their outputs reach EU users. Even if your company is based outside the EU, if your AI system's output is used in the EU, you must comply. Conduct a territorial scope assessment as a first compliance step.

Source text: “Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used.”

In practice: Conduct an AI literacy gap analysis across all roles that interact with AI systems. Develop role-specific training programmes covering AI fundamentals, system-specific operation, ethical use, and risk awareness. Document training completion and periodically review literacy levels as AI systems evolve or new deployments occur.

Source text: “For the purpose of implementing paragraphs 1, 2 and 3, the high-risk AI system shall be provided to the deployer in such a way that natural persons to whom human oversight is assigned are enabled, as appropriate and proportionate:”

In practice: Include in the instructions for use explicit sections on system limitations, known failure modes, automation bias risks, and guidance on interpreting outputs, including any available interpretation tools or methods.

Source text: “For high-risk AI systems referred to in point 1(a) of Annex III, the measures referred to in paragraph 3 of this Article shall be such as to ensure that, in addition, no action or decision is taken by the deployer on the basis of the identification resulting from the system unless that identification has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority. The requirement for a separate verification by at least two natural persons shall not apply to high-risk AI systems used for the purposes of law enforcement, migration, border control or asylum, where Union or national law considers the application of this requirement to be disproportionate.”

In practice: Implement a mandatory dual-review workflow in your deployment process for biometric identification systems, with automatic logging of both verifications. Document the exception procedure clearly if operating in law enforcement or border control contexts where the two-person rule may be waived.

Source text: “Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances:”

In practice: Organisations that rebrand, substantially modify, or repurpose AI systems should conduct a legal review before doing so to determine whether they will assume full provider obligations under Article 16. Document all modifications and purpose changes in writing.

Source text: “Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.”

In practice: Establish an internal policy requiring staff to read and follow the provider's instructions for use before deploying any high-risk AI system. Document the technical and organisational measures taken (e.g., access controls, staff training, configuration settings) and keep records updated whenever instructions change.

Source text: “Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.”

In practice: Create a formal role assignment process for human oversight of high-risk AI systems. Define competency requirements, provide targeted training, and document the authority granted to oversight personnel. Ensure adequate resources and support structures are in place for those individuals.

Source text: “The obligations set out in paragraphs 1 and 2, are without prejudice to other deployer obligations under Union or national law and to the deployer’s freedom to organise its own resources and activities for the purpose of implementing the human oversight measures indicated by the provider.”

In practice: When implementing human oversight measures, ensure compliance with both the AI Act requirements and any other applicable Union or national law (e.g., labour law, sector-specific regulations). Document how your organisational arrangements satisfy all applicable obligations simultaneously.

Source text: “Without prejudice to paragraphs 1 and 2, to the extent the deployer exercises control over the input data, that deployer shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system.”

In practice: Implement a data quality review process for any input data you control before it is fed into a high-risk AI system. Document how the data was assessed for relevance and representativeness relative to the system's intended purpose, and maintain records of these assessments.

Source text: “Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident. If the deployer is not able to reach the provider, Article 73 shall apply mutatis mutandis. This obligation shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities. For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation set out in the first subparagraph shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service law.”

In practice: Establish a formal incident and risk monitoring procedure for each high-risk AI system in use. Define escalation paths for notifying providers, distributors, and market surveillance authorities. For financial institutions, map existing internal governance compliance to the AI Act monitoring obligation and document the equivalence. Maintain logs of all monitoring activities and notifications.

Source text: “Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data. Deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the logs as part of the documentation kept pursuant to the relevant Union financial service law.”

In practice: Implement a log retention policy for all high-risk AI systems that defaults to a minimum of six months. For financial institution deployers, integrate AI system log retention into existing internal governance documentation frameworks under applicable Union financial services law (e.g., MiFID II, CRD IV). Ensure logs are stored securely and are accessible for audit purposes.

Source text: “Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system. This information shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives.”

In practice: Before deploying any high-risk AI system in a workplace context, establish a formal notification process for workers and their representatives. Document the notification, including the intended purpose of the AI system and the types of decisions it may influence. Align the process with existing works council or employee representative consultation procedures under national labour law.

Source text: “Deployers of high-risk AI systems that are public authorities, or Union institutions, bodies, offices or agencies shall comply with the registration obligations referred to in Article 49. When such deployers find that the high-risk AI system that they envisage using has not been registered in the EU database referred to in Article 71, they shall not use that system and shall inform the provider or the distributor.”

In practice: Before deploying any high-risk AI system, public authority deployers should verify the system's registration status in the EU database. Establish a pre-deployment checklist that includes a database registration check. If the system is not registered, halt deployment and notify the provider or distributor immediately, documenting the notification.

Source text: “Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.”

In practice: When conducting a DPIA for a high-risk AI system, systematically incorporate the information provided by the provider in the instructions for use (Article 13 information) into the DPIA documentation. Map the AI system's data flows, risks, and intended purpose from the provider's documentation directly into the DPIA template to ensure completeness and regulatory alignment.

Source text: “Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system. For high-risk AI systems used for law enforcement purposes Article 13 of Directive (EU) 2016/680 shall apply.”

In practice: Implement a clear, accessible notice mechanism (e.g., on-screen disclosure, written notice, or signage) informing individuals when a high-risk AI system is being used to make or assist in decisions about them. For law enforcement deployers, align the notification process with Article 13 of Directive (EU) 2016/680 rather than this provision directly.

Source text: “Deployers shall cooperate with the relevant competent authorities in any action those authorities take in relation to the high-risk AI system in order to implement this Regulation.”

In practice: Establish internal procedures and designated contact points to respond promptly to requests from market surveillance or other competent authorities. Maintain up-to-date documentation on deployed high-risk AI systems to facilitate efficient cooperation during inspections or investigations.

GDPR Art. 35(1): “Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.”

GDPR Art. 35(2): “The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment.”

GDPR Art. 35(3): “A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:”

GDPR Art. 35(4): “The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority shall communicate those lists to the Board referred to in Article 68.”

GDPR Art. 35(5): “The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board.”

GDPR Art. 35(6): “Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union.”

GDPR Art. 35(7): “The assessment shall contain at least:”

GDPR Art. 35(8): “Compliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors shall be taken into due account in assessing the impact of the processing operations performed by such controllers or processors, in particular for the purposes of a data protection impact assessment.”

GDPR Art. 35(9): “Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.”

GDPR Art. 35(10): “Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be necessary to carry out such an assessment prior to processing activities.”

GDPR Art. 35(11): “Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations.”

Bridge: GDPR Article 35 is implemented as a control module in RuleMesh — the same control you would evidence here. Explore GDPR control modules →

Source text: “Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce. For that purpose, deployers shall perform an assessment consisting of:”

In practice: Create a standardised FRIA template that maps each high-risk AI use case to the deployer's processes, deployment schedule, and affected population categories. Align this with existing DPIA workflows to avoid duplication.

Source text: “The obligation laid down in paragraph 1 applies to the first use of the high-risk AI system. The deployer may, in similar cases, rely on previously conducted fundamental rights impact assessments or existing impact assessments carried out by provider. If, during the use of the high-risk AI system, the deployer considers that any of the elements listed in paragraph 1 has changed or is no longer up to date, the deployer shall take the necessary steps to update the information.”

In practice: Establish a review trigger mechanism within your AI governance process so that any change in deployment context, affected population, or system configuration automatically flags the need to update the FRIA.

Source text: “Once the assessment referred to in paragraph 1 of this Article has been performed, the deployer shall notify the market surveillance authority of its results, submitting the filled-out template referred to in paragraph 5 of this Article as part of the notification. In the case referred to in Article 46(1), deployers may be exempt from that obligation to notify.”

In practice: Integrate the FRIA notification step into your AI deployment workflow as a mandatory gate before go-live, and maintain a record of submissions to the market surveillance authority for audit purposes.

Source text: “If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the fundamental rights impact assessment referred to in paragraph 1 of this Article shall complement that data protection impact assessment.”

In practice: Map your existing DPIA process against the FRIA requirements and create a combined assessment template that satisfies both obligations simultaneously, clearly documenting which elements address each requirement.

Source text: “Before putting into service or using a high-risk AI system listed in Annex III, with the exception of high-risk AI systems listed in point 2 of Annex III, deployers that are public authorities, Union institutions, bodies, offices or agencies or persons acting on their behalf shall register themselves, select the system and register its use in the EU database referred to in Article 71.”

In practice: Public authorities should establish an internal workflow requiring EU database registration and system selection before any high-risk AI system deployment. Designate a responsible official to manage registrations and maintain up-to-date records of all deployed high-risk AI systems.

Source text: “Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law.”

In practice: Before deploying an emotion recognition or biometric categorisation system, prepare a clear notice for affected individuals explaining the system's operation. Conduct a DPIA under GDPR and ensure data processing agreements are in place. Document any law enforcement exception relied upon.

Source text: “Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work. Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.”

In practice: Implement a clear labelling or disclosure mechanism for all deep fake content at the point of publication or distribution. For artistic or satirical works, include a disclosure that does not impair enjoyment of the work. For AI-generated public interest text, establish an editorial review process and assign editorial responsibility to avoid the disclosure obligation.

Source text: “Paragraphs 1 to 4 shall not affect the requirements and obligations set out in Chapter III, and shall be without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems.”

In practice: Deployers should audit all applicable transparency obligations from both Chapter III of the AI Act and any sector-specific or national laws, ensuring that compliance with Article 50(1)-(4) does not substitute for those broader obligations.

Source text: “The report referred to in paragraph 1 shall be made immediately after the provider has established a causal link between the AI system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 15 days after the provider or, where applicable, the deployer, becomes aware of the serious incident. The period for the reporting referred to in the first subparagraph shall take account of the severity of the serious incident.”

In practice: Implement an internal escalation and triage process that starts the 15-day reporting clock from the moment any team member becomes aware of a potential serious incident, and document the causal link assessment as part of the incident record.

Source text: “Notwithstanding paragraph 2, in the event of the death of a person, the report shall be provided immediately after the provider or the deployer has established, or as soon as it suspects, a causal relationship between the high-risk AI system and the serious incident, but not later than 10 days after the date on which the provider or, where applicable, the deployer becomes aware of the serious incident.”

In practice: Establish a specific mortality-related incident protocol that triggers an immediate internal alert and initiates the reporting process as soon as a causal link to the AI system is suspected, with a hard deadline of 10 days from awareness.

Source text: “Where, having performed an evaluation under Article 79, after consulting the relevant national public authority referred to in Article 77(1), the market surveillance authority of a Member State finds that although a high-risk AI system complies with this Regulation, it nevertheless presents a risk to the health or safety of persons, to fundamental rights, or to other aspects of public interest protection, it shall require the relevant operator to take all appropriate measures to ensure that the AI system concerned, when placed on the market or put into service, no longer presents that risk without undue delay, within a period it may prescribe.”

In practice: Operators should maintain a risk register that goes beyond regulatory compliance checklists and includes residual risk assessments. Establish a rapid-response protocol for receiving and acting on market surveillance authority directives, including a designated contact point and escalation path.