EU_AI_ACT_ART26_DEPLOYER_OBLIGATIONS_001

rules/regulations/eu/eu_ai_act_article26_deployer_obligations.yaml

Citation

Regulation (EU) 2024/1689, Article 26(1): Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6. Article 26(2): Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support. Article 26(4): Without prejudice to paragraphs 1 and 2, to the extent the deployer exercises control over the input data, that deployer shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system. Article 26(5), first subparagraph, first sentence: Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Article 26(6), first subparagraph: Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data. Article 26(7), first sentence: Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system.

Condition

Requires deployers of high-risk AI systems to use such systems in accordance with instructions, assign human oversight to competent persons, ensure input data is relevant and representative, monitor operation, keep auto-generated logs for at least six months, and cooperate with competent authorities. Article 26.

Layer 1 detects

"deploy", "deploying" or "deployer" followed by "without instructions", "without oversight", "without monitoring" or "without logs"; "no", optionally "deployer", then "obligation", "obligations", "compliance" or "oversight", then "for" or "with", then "high-risk", "high risk" or "AI"; "ignore" or "ignoring" followed by "instruction for use", "instructions for use" or "deployer obligations"; "no log retention", "no automatic log", "no auto log" or "no incident report"; "fail", "failing" or "failure" followed by "to monitor", "to inform worker", "to inform workers", "to inform provider", "to inform authority", "to keep logs", "to assign human" or "to assign oversight"; "input data not representative", "not relevant" or "not validated"; "without competent" or "without trained" followed by "oversight" or "personnel"; and "deploy" or "deploying", optionally followed by "AI", then "without informing" or "without notification". Case is ignored, the words must follow each other with no other word between them unless stated, and a phrase can start inside a longer word. It matches wording, not meaning: it misses the practice told in other words, it does not check that the system is high-risk (any "AI" counts), and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

review