EU AI Act, Article 26

Deployer obligations

Unit OH-40 in the Accountability theme. The held citation is EU AI Act, Article 26, and the row asks for 4 pieces of evidence.

At a glance

Ref: OH-40
Theme: Accountability
Held source: EU AI Act
Citation: EU AI Act, Article 26
Evidence: 4 items
Gaps: 3 common

Evidence to keep

Deployer obligationsDeployer monitoring records
Deployer obligationsLogs retained for at least six months
Deployer obligationsThe oversight assignment and competence record
Deployer obligationsThe DPIA where applicable

Questions before you sign

Who is the assigned overseer?
Are the logs kept long enough?
Has the workforce been informed?

The requirement, in our words

Deployers of high-risk systems must use them in line with the instructions, assign oversight to competent people, ensure input data is relevant and representative, monitor operation, inform the provider of risks and incidents, keep logs for at least six months, inform workers and complete a data protection impact assessment where required.

What it means for human oversight

Article 26 is the deployer's side of Article 14. It makes oversight an assigned duty with a competent person, not a general expectation that someone will watch the system.

How to evidence it

Attach the artefacts above to the Deployer obligations row with the system name, the owner and the date. The first one is the anchor: Deployer monitoring records. The OH-40 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Logs retained for at least six months. If that artefact for OH-40 cannot be produced, the row is a gap, whatever the policy says.

OH-40 carries 4 evidence items and 3 common gaps. For deployer obligations, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-40 statement above is ours, written from EU AI Act, Article 26, not a reproduction of the licensed text.

Common gaps

Deployer not following the instructions
No oversight assignment
Logs deleted before six months

Where the FDIS fits. The public abstract says the draft applies to all types of organizations across the AI system life cycle, so deployer obligations is one of the places the guidance is expected to operate. For OH-40, the FDIS clause numbering and wording are not public, so this page cites EU AI Act, Article 26 above and does not quote the draft.

Related units

Source for this page: EU AI Act, Article 26. Open EU AI Act, Article 26 and compare it with the OH-40 statement above. Retrieved 2026-10-21.