AI Act Deployer Obligations Record: [High-risk AI system] at [Deployer]
Checklist and evidence record for a deployer of a high-risk AI system
under Article 26 of the EU Artificial Intelligence Act (Regulation (EU)
2024/1689 as amended by Regulation (EU) 2026/1744, the Digital Omnibus
on AI), with the Article 27 fundamental rights impact assessment
trigger and the Article 86 right to explanation. It records use in
line with the instructions for use, assigned human oversight, input
data control, monitoring and incident reporting, log retention,
information to workers and affected persons, and cooperation with
authorities. Replace every [bracketed] value and every row marked
Example. Under the amended Article 113, the Chapter III Section 3
obligations, which include Article 26, apply from 2 December 2027 for
Annex III systems and from 2 August 2028 for Annex I systems; check
the consolidated text. This is a documentation format, not legal
advice: check the current official text and a qualified professional.
Document control
| Field | Value |
|---|
| Document ID | [DEP-001] |
| Deployer | [Legal name, address] |
| Deployer type | [Private organisation / Public authority / Union institution or body / Financial institution] |
| High-risk AI system | [Name, version] |
| Provider | [Provider name, contact] |
| Instructions for use relied on | [Document ID, version, date] |
| Classification basis | [Annex III point / Annex I product] |
| AI system inventory ID | [AIS-ID from the inventory] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@deployer-owner] |
| Reviewers | [@legal], [@dpo], [@hr], [@it-security] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |
Approvals
| Role | Name | Decision | Date |
|---|
| Business owner | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Data protection officer | [@name] | [Opinion] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | Example: Approved before go-live; worker consultation completed |
| 1.1 | YYYY-MM-DD | [@name] | Example: Updated for provider release 2.5 and new instructions for use |
Contents
1. Role and applicability
| Question | Answer | Evidence |
|---|
| Do we use the system under our authority in a professional activity? | [Yes / No] | Example: Used by the recruitment team of Tamberlane Recruitment Services |
| Is the system high-risk under Article 6(1) (Annex I) or Article 6(2) (Annex III)? | [Yes / No] | Example: Annex III point 4(a), recruitment and selection; provider's EU declaration of conformity |
| Did we put our name or trademark on it? | [Yes / No] | Article 25(1)(a) |
| Did we make a substantial modification? | [Yes / No] | Article 25(1)(b) |
| Did we change the intended purpose of a system so that it became high-risk? | [Yes / No] | Article 25(1)(c) |
| Is the system registered in the EU database (where required)? | [Yes / No / Not required] | [Database reference] |
Conclusion: [Example: Tamberlane is a deployer. Tarnwick Analytics
is the provider of CRV Shortlist 2.4, an Annex III point 4(a) system.
None of the Article 25 conditions is met.]
2. System summary
| Item | Value |
|---|
| Intended purpose (from instructions for use) | Example: Ranks applications against the published job criteria to help recruiters decide whom to invite for interview |
| Our use | Example: All applications for warehouse and driver roles, about 18,000 a year, 72 per working day on 250 working days |
| Decisions informed | Example: Invitation to interview; the system never rejects an applicant on its own |
| Users | Example: 14 recruiters, 3 team leads |
| Input data we control | Example: Application form fields, CV text, role criteria entered by recruiters |
| Logs available to us | Example: Ranking events, recruiter overrides, model version, timestamp |
| Go-live date | YYYY-MM-DD |
3. Article 26 obligations checklist
| Ref | Duty (summarised) | Applies? | Status | Evidence | Owner |
|---|
| 26(1) | Take technical and organisational measures to use the system in line with the instructions for use | [Yes] | [Status] | Example: SOP-REC-07 maps each instruction to a team procedure | [@owner] |
| 26(2) | Assign human oversight to people with the competence, training and authority needed, and support them | [Yes] | [Status] | Section 4 | [@owner] |
| 26(3) | Other legal duties and our freedom to organise oversight are unaffected | [Note] | n/a | Record any sector rules that add to 26(1) and 26(2) | [@legal] |
| 26(4) | Where we control input data, make sure it is relevant and sufficiently representative for the intended purpose | [Yes / No] | [Status] | Example: Role criteria review checklist RC-02 | [@owner] |
| 26(5) | Monitor operation on the basis of the instructions for use, inform the provider, suspend use when a risk arises, report serious incidents | [Yes] | [Status] | Section 5 | [@owner] |
| 26(6) | Keep the logs under our control for a period suited to the purpose, at least six months unless other law says otherwise | [Yes] | [Status] | Example: Log retention set to 12 months in the provider console, screenshot LOG-01 | [@it] |
| 26(7) | Employers inform workers' representatives and affected workers before putting the system into service at the workplace | [Yes / No] | [Status] | Section 6.1 | [@hr] |
| 26(8) | Public authorities and Union bodies register their use under Article 49 and do not use an unregistered system | [Yes / No] | [Status] | [Registration reference] | [@legal] |
| 26(9) | Use the provider's Article 13 information to carry out a DPIA where one is required | [Yes / No] | [Status] | Section 7 | [@dpo] |
| 26(10) | Post-remote biometric identification for law enforcement: authorisation, logging and reporting rules | [Yes / No] | [Status] | [Reference] | [@legal] |
| 26(11) | Inform natural persons that they are subject to an Annex III system that makes or assists decisions about them | [Yes / No] | [Status] | Section 6.2 | [@owner] |
| 26(12) | Cooperate with competent authorities | [Yes] | [Status] | Example: Regulator contact procedure REG-01 | [@legal] |
Related duties outside Article 26:
| Ref | Duty (summarised) | Status | Evidence |
|---|
| Art. 4 | Take measures to support AI literacy of staff who operate or use the system (as recast by Regulation (EU) 2026/1744) | [Status] | ai-data/ai-literacy-plan |
| Art. 27 | Fundamental rights impact assessment, where the deployer category triggers it | [Status] | Section 7 |
| Art. 50(3) | Inform people exposed to emotion recognition or biometric categorisation, where used | [Status / Not applicable] | [Reference] |
| Art. 86 | Give an explanation of the role of the system in an individual decision on request | [Status] | Section 8 |
4. Human oversight assignment
| ID | Role | People | Training completed | Authority | Support |
|---|
| OV-01 (Example) | Reviewing recruiter | 14 recruiters | 4-hour module on ranking limits and automation bias, YYYY-MM-DD | May invite any applicant regardless of rank; must review the full list for roles under 50 applicants | Escalation to team lead |
| OV-02 (Example) | Oversight lead | 1 team lead | Provider administrator training | May suspend use for a role or for all roles | Direct line to provider support |
| OV-03 (Example) | Monitoring analyst | 1 analyst | Fairness monitoring training | Raises a risk notice under section 5 | Monthly report to business owner |
Pitfall to avoid: oversight staff who have no time or authority to
disagree with the system. Record the workload assumption, for example
the maximum number of applications one recruiter reviews per day.
5. Monitoring, suspension and incident reporting
5.1 Monitoring indicators
| ID | Indicator | Threshold | Frequency | Owner |
|---|
| MON-01 (Example) | Share of applicants invited by age band compared with the share of applicants | Ratio below 0.8 for any band over one month | Monthly | [@analyst] |
| MON-02 (Example) | Recruiter override rate | Above 25% or below 2% over one month | Monthly | [@team-lead] |
| MON-03 (Example) | Complaints mentioning automated ranking | Any complaint | On receipt | [@owner] |
| MON-04 (Example) | System version in use matches the version in the instructions for use | Any mismatch | Each release | [@it] |
5.2 Response steps
| Event | Who decides | Who is told | Record |
|---|
| Risk notice | [@oversight-lead] | Provider, [distributor], [market surveillance authority where relevant] | [INC-ID] |
| Suspension | [@oversight-lead] | Recruiters, business owner | [INC-ID] |
| Serious incident | [@business-owner] | Provider first, then the authorities required by Article 26(5) and Article 73 | ai-data/ai-incident-report |
6. Information to workers and affected persons
6.1 Workers and their representatives (Article 26(7))
| Item | Value |
|---|
| Does the system affect our own workers? | [Yes / No] Example: Yes, recruiters' work allocation changes and their overrides are logged |
| Workers' representatives informed | [Body], YYYY-MM-DD |
| Affected workers informed | [Channel], YYYY-MM-DD |
| National consultation or co-determination duties checked | [Yes / No], [reference] |
| Information given | Example: Purpose, what is logged about recruiters, how logs are used, oversight role |
6.2 Affected persons (Article 26(11))
| Item | Value |
|---|
| Notice wording location | Example: Job application page and acknowledgement email |
| Content | Example: An AI system ranks applications to help recruiters decide whom to invite. A recruiter reviews every list. You can ask for an explanation and a human review. |
| Languages | [List] |
| Date published | YYYY-MM-DD |
7. FRIA trigger and DPIA link
| Question | Answer |
|---|
| Are we a body governed by public law or a private entity providing public services? | [Yes / No] |
| Is the system an Annex III point 5(b) (credit scoring) or 5(c) (life and health insurance pricing) system? | [Yes / No] |
| FRIA required under Article 27? | [Yes, see ai-data/ai-act-fria / No] |
| DPIA required under GDPR Article 35? | [Yes / No], [DPIA-ID] |
| Provider information used for the DPIA (Article 26(9)) | [Instructions for use sections] |
Example: Tamberlane is a private recruitment agency not providing
public services and the system is not in Annex III point 5, so Article
27 does not apply. A DPIA is required because applicants are evaluated
systematically; it is recorded in compliance/dpia as DPIA-014.
8. Right to explanation (Article 86)
| Step | Detail |
|---|
| Intake channel | Example: Form on the careers site and the recruitment mailbox |
| Response owner | [@owner] |
| Target response time | [Internal target, for example 20 working days, and any legal deadline under other law] |
| Content of the explanation | Role the system played; main factors behind the ranking; human decision and who took it; how to ask for review |
| Sources used | Logs (section 3, 26(6)), recruiter notes, provider explanation features listed in the instructions for use |
| Link to GDPR rights | Check the relationship with GDPR Articles 15 and 22 with the DPO |
| Request ID | Date received | Decision concerned | Response date | Outcome |
|---|
| EXP-001 (Example) | YYYY-MM-DD | Not invited to interview, driver role | YYYY-MM-DD | Explanation sent; applicant re-reviewed and invited |
9. Open actions and review
| ID | Action | Linked duty | Owner | Due | Status |
|---|
| ACT-01 (Example) | Extend log retention from 6 to 12 months to cover the complaint window | 26(6) | [@it] | YYYY-MM-DD | Open |
| ACT-02 (Example) | Translate the applicant notice into the two most common other languages | 26(11) | [@owner] | YYYY-MM-DD | Open |
Review triggers: new provider version or instructions for use, change of
intended use or user group, monitoring threshold breach, serious
incident, new guidance from the Commission or national authority,
annual review.
10. Glossary and references
| Term | Meaning |
|---|
| Deployer | A natural or legal person, public authority or body using an AI system under its authority, other than in a personal non-professional activity |
| Provider | The organisation that develops an AI system and places it on the market or puts it into service under its own name |
| Instructions for use | The provider's information on intended purpose, performance, limits, oversight and logs required by Article 13 |
| Serious incident | An incident or malfunction leading to the outcomes listed in Article 3(49), such as death, serious harm to health or a serious breach of fundamental rights obligations |
| FRIA | Fundamental rights impact assessment under Article 27 |
References (check the current consolidated text):
- Regulation (EU) 2024/1689 (AI Act), Articles 3, 4, 6, 25, 26, 27, 49, 50, 73, 86, 113 and Annex III: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24 July 2026, in force 27 July 2026: http://data.europa.eu/eli/reg/2026/1744/oj
- Regulation (EU) 2016/679 (GDPR), Articles 15, 22 and 35
- Related templates: ai-data/ai-act-instructions-for-use, ai-data/ai-act-fria, ai-data/human-oversight-design, ai-data/ai-incident-report, ai-data/ai-literacy-plan, ai-data/ai-system-inventory, compliance/dpia
Other jurisdictions, as dated examples only: in the United States, New
York City Local Law 144 of 2021 regulates automated employment decision
tools used for hiring in the city (https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page);
in the United Kingdom, there is no AI-specific deployer statute, and the
UK GDPR rules on automated decision-making (Articles 22A to 22D, inserted
by the Data (Use and Access) Act 2025; the ICO reported in June 2026
that all of the Act's data protection changes were in force) and the Equality Act 2010 apply to automated
recruitment (https://www.legislation.gov.uk/ukpga/2025/18). Check the
current position with a qualified professional.
Standard and licence note
Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), Articles
26, 27 and 86 on deployers of high-risk AI systems, as published in the
Official Journal of the European Union; EU legislative texts are free to
reuse. The duties are summarised in original wording and no text of the
Regulation is reproduced. Check the consolidated text on EUR-Lex for the
binding wording, later amendments and Commission guidance; under the
amended Article 113 the Article 26 obligations apply from 2 December
2027 for Annex III systems and from 2 August 2028 for Annex I systems.
All organisations and figures in examples are fictional. This is a
documentation format, not legal advice. Template licence: MIT.