# AI Act Deployer Obligations Record: [High-risk AI system] at [Deployer]

> Checklist and evidence record for a deployer of a high-risk AI system
> under Article 26 of the EU Artificial Intelligence Act (Regulation (EU)
> 2024/1689 as amended by Regulation (EU) 2026/1744, the Digital Omnibus
> on AI), with the Article 27 fundamental rights impact assessment
> trigger and the Article 86 right to explanation. It records use in
> line with the instructions for use, assigned human oversight, input
> data control, monitoring and incident reporting, log retention,
> information to workers and affected persons, and cooperation with
> authorities. Replace every `[bracketed]` value and every row marked
> *Example*. Under the amended Article 113, the Chapter III Section 3
> obligations, which include Article 26, apply from 2 December 2027 for
> Annex III systems and from 2 August 2028 for Annex I systems; check
> the consolidated text. This is a documentation format, not legal
> advice: check the current official text and a qualified professional.

<!--
Guidance: How to use this template
- Fill one record per high-risk AI system you use under your authority
  in a professional activity. If you only use AI that is not high-risk,
  this record is not required, but sections 4, 6 and 8 are still good
  practice.
- Confirm first (section 1) that you are a deployer and not a provider.
  If you put your name or trademark on the system, make a substantial
  modification or change its intended purpose so that it becomes
  high-risk, Article 25 can make you a provider, and a different set of
  obligations applies.
- Section 3 follows Article 26 paragraph by paragraph. Keep the
  numbering so an auditor or market surveillance authority can find each
  duty and its evidence quickly.
- Each row needs evidence that exists outside this document (a training
  record, a log setting, a notice). A row with no evidence is open.
- Questions and checklists only: decide with your legal adviser how each
  duty applies to your facts.
-->

## Document control

<!-- Guidance: Identify the system, its provider, the deployer and the accountable people. Link the instructions for use version you rely on, since most duties refer to it. -->

| Field | Value |
|---|---|
| Document ID | [DEP-001] |
| Deployer | [Legal name, address] |
| Deployer type | [Private organisation / Public authority / Union institution or body / Financial institution] |
| High-risk AI system | [Name, version] |
| Provider | [Provider name, contact] |
| Instructions for use relied on | [Document ID, version, date] |
| Classification basis | [Annex III point / Annex I product] |
| AI system inventory ID | [AIS-ID from the inventory] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@deployer-owner] |
| Reviewers | [@legal], [@dpo], [@hr], [@it-security] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Business owner | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Data protection officer | [@name] | [Opinion] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved before go-live; worker consultation completed |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Updated for provider release 2.5 and new instructions for use |

## Contents

<!-- Guidance: Keep aligned with the headings below. -->

1. [Role and applicability](#1-role-and-applicability)
2. [System summary](#2-system-summary)
3. [Article 26 obligations checklist](#3-article-26-obligations-checklist)
4. [Human oversight assignment](#4-human-oversight-assignment)
5. [Monitoring, suspension and incident reporting](#5-monitoring-suspension-and-incident-reporting)
6. [Information to workers and affected persons](#6-information-to-workers-and-affected-persons)
7. [FRIA trigger and DPIA link](#7-fria-trigger-and-dpia-link)
8. [Right to explanation (Article 86)](#8-right-to-explanation-article-86)
9. [Open actions and review](#9-open-actions-and-review)
10. [Glossary and references](#10-glossary-and-references)

## 1. Role and applicability

<!-- Guidance: Record why you are a deployer and why the system is high-risk. Most mistakes start here: a customised system or a new use can turn a deployer into a provider under Article 25. -->

| Question | Answer | Evidence |
|---|---|---|
| Do we use the system under our authority in a professional activity? | [Yes / No] | *Example:* Used by the recruitment team of Tamberlane Recruitment Services |
| Is the system high-risk under Article 6(1) (Annex I) or Article 6(2) (Annex III)? | [Yes / No] | *Example:* Annex III point 4(a), recruitment and selection; provider's EU declaration of conformity |
| Did we put our name or trademark on it? | [Yes / No] | Article 25(1)(a) |
| Did we make a substantial modification? | [Yes / No] | Article 25(1)(b) |
| Did we change the intended purpose of a system so that it became high-risk? | [Yes / No] | Article 25(1)(c) |
| Is the system registered in the EU database (where required)? | [Yes / No / Not required] | [Database reference] |

Conclusion: [*Example:* Tamberlane is a deployer. Tarnwick Analytics
is the provider of CRV Shortlist 2.4, an Annex III point 4(a) system.
None of the Article 25 conditions is met.]

## 2. System summary

<!-- Guidance: Summarise only what the duties below depend on. Take the facts from the provider's instructions for use (Article 13) rather than from marketing material. -->

| Item | Value |
|---|---|
| Intended purpose (from instructions for use) | *Example:* Ranks applications against the published job criteria to help recruiters decide whom to invite for interview |
| Our use | *Example:* All applications for warehouse and driver roles, about 18,000 a year, 72 per working day on 250 working days |
| Decisions informed | *Example:* Invitation to interview; the system never rejects an applicant on its own |
| Users | *Example:* 14 recruiters, 3 team leads |
| Input data we control | *Example:* Application form fields, CV text, role criteria entered by recruiters |
| Logs available to us | *Example:* Ranking events, recruiter overrides, model version, timestamp |
| Go-live date | YYYY-MM-DD |

## 3. Article 26 obligations checklist

<!-- Guidance: One row per paragraph of Article 26. Status is Met, Partly met, Open or Not applicable, with a reason for Not applicable. Link evidence by ID. -->

| Ref | Duty (summarised) | Applies? | Status | Evidence | Owner |
|---|---|---|---|---|---|
| 26(1) | Take technical and organisational measures to use the system in line with the instructions for use | [Yes] | [Status] | *Example:* SOP-REC-07 maps each instruction to a team procedure | [@owner] |
| 26(2) | Assign human oversight to people with the competence, training and authority needed, and support them | [Yes] | [Status] | Section 4 | [@owner] |
| 26(3) | Other legal duties and our freedom to organise oversight are unaffected | [Note] | n/a | Record any sector rules that add to 26(1) and 26(2) | [@legal] |
| 26(4) | Where we control input data, make sure it is relevant and sufficiently representative for the intended purpose | [Yes / No] | [Status] | *Example:* Role criteria review checklist RC-02 | [@owner] |
| 26(5) | Monitor operation on the basis of the instructions for use, inform the provider, suspend use when a risk arises, report serious incidents | [Yes] | [Status] | Section 5 | [@owner] |
| 26(6) | Keep the logs under our control for a period suited to the purpose, at least six months unless other law says otherwise | [Yes] | [Status] | *Example:* Log retention set to 12 months in the provider console, screenshot LOG-01 | [@it] |
| 26(7) | Employers inform workers' representatives and affected workers before putting the system into service at the workplace | [Yes / No] | [Status] | Section 6.1 | [@hr] |
| 26(8) | Public authorities and Union bodies register their use under Article 49 and do not use an unregistered system | [Yes / No] | [Status] | [Registration reference] | [@legal] |
| 26(9) | Use the provider's Article 13 information to carry out a DPIA where one is required | [Yes / No] | [Status] | Section 7 | [@dpo] |
| 26(10) | Post-remote biometric identification for law enforcement: authorisation, logging and reporting rules | [Yes / No] | [Status] | [Reference] | [@legal] |
| 26(11) | Inform natural persons that they are subject to an Annex III system that makes or assists decisions about them | [Yes / No] | [Status] | Section 6.2 | [@owner] |
| 26(12) | Cooperate with competent authorities | [Yes] | [Status] | *Example:* Regulator contact procedure REG-01 | [@legal] |

Related duties outside Article 26:

| Ref | Duty (summarised) | Status | Evidence |
|---|---|---|---|
| Art. 4 | Take measures to support AI literacy of staff who operate or use the system (as recast by Regulation (EU) 2026/1744) | [Status] | ai-data/ai-literacy-plan |
| Art. 27 | Fundamental rights impact assessment, where the deployer category triggers it | [Status] | Section 7 |
| Art. 50(3) | Inform people exposed to emotion recognition or biometric categorisation, where used | [Status / Not applicable] | [Reference] |
| Art. 86 | Give an explanation of the role of the system in an individual decision on request | [Status] | Section 8 |

## 4. Human oversight assignment

<!-- Guidance: Name roles, not only teams. Article 26(2) asks for competence, training, authority and support. Check each against the oversight measures the provider lists in the instructions for use (Article 13(3)(d)). -->

| ID | Role | People | Training completed | Authority | Support |
|---|---|---|---|---|---|
| OV-01 *(Example)* | Reviewing recruiter | 14 recruiters | 4-hour module on ranking limits and automation bias, YYYY-MM-DD | May invite any applicant regardless of rank; must review the full list for roles under 50 applicants | Escalation to team lead |
| OV-02 *(Example)* | Oversight lead | 1 team lead | Provider administrator training | May suspend use for a role or for all roles | Direct line to provider support |
| OV-03 *(Example)* | Monitoring analyst | 1 analyst | Fairness monitoring training | Raises a risk notice under section 5 | Monthly report to business owner |

Pitfall to avoid: oversight staff who have no time or authority to
disagree with the system. Record the workload assumption, for example
the maximum number of applications one recruiter reviews per day.

## 5. Monitoring, suspension and incident reporting

<!-- Guidance: Article 26(5) asks you to monitor on the basis of the instructions for use, tell the provider (and where relevant the distributor or importer and the market surveillance authority) when use may present a risk, and suspend use. Serious incidents go to the provider first; Article 73 applies if the provider cannot be reached. Confirm the current deadlines in Article 73. -->

### 5.1 Monitoring indicators

| ID | Indicator | Threshold | Frequency | Owner |
|---|---|---|---|---|
| MON-01 *(Example)* | Share of applicants invited by age band compared with the share of applicants | Ratio below 0.8 for any band over one month | Monthly | [@analyst] |
| MON-02 *(Example)* | Recruiter override rate | Above 25% or below 2% over one month | Monthly | [@team-lead] |
| MON-03 *(Example)* | Complaints mentioning automated ranking | Any complaint | On receipt | [@owner] |
| MON-04 *(Example)* | System version in use matches the version in the instructions for use | Any mismatch | Each release | [@it] |

### 5.2 Response steps

```mermaid
flowchart TD
  A["Indicator breach, complaint or staff report"] --> B{"Risk to health, safety or fundamental rights?"}
  B -->|No| C["Record and keep monitoring"]
  B -->|Yes| D["Inform provider, and distributor or authority where relevant"]
  D --> E["Suspend use for affected roles"]
  E --> F{"Serious incident?"}
  F -->|Yes| G["Report to provider, then importer or distributor and the market surveillance authority"]
  F -->|No| H["Agree fix with provider and resume after review"]
  G --> H
```

| Event | Who decides | Who is told | Record |
|---|---|---|---|
| Risk notice | [@oversight-lead] | Provider, [distributor], [market surveillance authority where relevant] | [INC-ID] |
| Suspension | [@oversight-lead] | Recruiters, business owner | [INC-ID] |
| Serious incident | [@business-owner] | Provider first, then the authorities required by Article 26(5) and Article 73 | ai-data/ai-incident-report |

## 6. Information to workers and affected persons

<!-- Guidance: Two different audiences. Article 26(7) is about your own workers when the system is used at the workplace. Article 26(11) is about the people the system makes or assists decisions on. Check national labour law for consultation duties that go further. -->

### 6.1 Workers and their representatives (Article 26(7))

| Item | Value |
|---|---|
| Does the system affect our own workers? | [Yes / No] *Example:* Yes, recruiters' work allocation changes and their overrides are logged |
| Workers' representatives informed | [Body], YYYY-MM-DD |
| Affected workers informed | [Channel], YYYY-MM-DD |
| National consultation or co-determination duties checked | [Yes / No], [reference] |
| Information given | *Example:* Purpose, what is logged about recruiters, how logs are used, oversight role |

### 6.2 Affected persons (Article 26(11))

| Item | Value |
|---|---|
| Notice wording location | *Example:* Job application page and acknowledgement email |
| Content | *Example:* An AI system ranks applications to help recruiters decide whom to invite. A recruiter reviews every list. You can ask for an explanation and a human review. |
| Languages | [List] |
| Date published | YYYY-MM-DD |

## 7. FRIA trigger and DPIA link

<!-- Guidance: Article 27 applies only to some deployers (bodies governed by public law, private entities providing public services, and deployers of Annex III point 5(b) and 5(c) systems) and not to Annex III point 2 systems. Record the answer even when it is no. -->

| Question | Answer |
|---|---|
| Are we a body governed by public law or a private entity providing public services? | [Yes / No] |
| Is the system an Annex III point 5(b) (credit scoring) or 5(c) (life and health insurance pricing) system? | [Yes / No] |
| FRIA required under Article 27? | [Yes, see ai-data/ai-act-fria / No] |
| DPIA required under GDPR Article 35? | [Yes / No], [DPIA-ID] |
| Provider information used for the DPIA (Article 26(9)) | [Instructions for use sections] |

*Example:* Tamberlane is a private recruitment agency not providing
public services and the system is not in Annex III point 5, so Article
27 does not apply. A DPIA is required because applicants are evaluated
systematically; it is recorded in compliance/dpia as DPIA-014.

## 8. Right to explanation (Article 86)

<!-- Guidance: Article 86 lets an affected person ask the deployer for a clear and meaningful explanation of the role of an Annex III system (other than point 2) in a decision that has legal or similarly significant effects on them. It applies only where other Union law does not already give that right. Prepare the process before the first request arrives. -->

| Step | Detail |
|---|---|
| Intake channel | *Example:* Form on the careers site and the recruitment mailbox |
| Response owner | [@owner] |
| Target response time | [Internal target, for example 20 working days, and any legal deadline under other law] |
| Content of the explanation | Role the system played; main factors behind the ranking; human decision and who took it; how to ask for review |
| Sources used | Logs (section 3, 26(6)), recruiter notes, provider explanation features listed in the instructions for use |
| Link to GDPR rights | Check the relationship with GDPR Articles 15 and 22 with the DPO |

| Request ID | Date received | Decision concerned | Response date | Outcome |
|---|---|---|---|---|
| EXP-001 *(Example)* | YYYY-MM-DD | Not invited to interview, driver role | YYYY-MM-DD | Explanation sent; applicant re-reviewed and invited |

## 9. Open actions and review

<!-- Guidance: Every Open or Partly met row in section 3 needs an action. Review this record on each new system version, each change in use, and at least once a year. -->

| ID | Action | Linked duty | Owner | Due | Status |
|---|---|---|---|---|---|
| ACT-01 *(Example)* | Extend log retention from 6 to 12 months to cover the complaint window | 26(6) | [@it] | YYYY-MM-DD | Open |
| ACT-02 *(Example)* | Translate the applicant notice into the two most common other languages | 26(11) | [@owner] | YYYY-MM-DD | Open |

Review triggers: new provider version or instructions for use, change of
intended use or user group, monitoring threshold breach, serious
incident, new guidance from the Commission or national authority,
annual review.

## 10. Glossary and references

<!-- Guidance: Define terms for non-specialist readers and list the official sources used, with the date checked. -->

| Term | Meaning |
|---|---|
| Deployer | A natural or legal person, public authority or body using an AI system under its authority, other than in a personal non-professional activity |
| Provider | The organisation that develops an AI system and places it on the market or puts it into service under its own name |
| Instructions for use | The provider's information on intended purpose, performance, limits, oversight and logs required by Article 13 |
| Serious incident | An incident or malfunction leading to the outcomes listed in Article 3(49), such as death, serious harm to health or a serious breach of fundamental rights obligations |
| FRIA | Fundamental rights impact assessment under Article 27 |

References (check the current consolidated text):

- Regulation (EU) 2024/1689 (AI Act), Articles 3, 4, 6, 25, 26, 27, 49, 50, 73, 86, 113 and Annex III: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24 July 2026, in force 27 July 2026: http://data.europa.eu/eli/reg/2026/1744/oj
- Regulation (EU) 2016/679 (GDPR), Articles 15, 22 and 35
- Related templates: ai-data/ai-act-instructions-for-use, ai-data/ai-act-fria, ai-data/human-oversight-design, ai-data/ai-incident-report, ai-data/ai-literacy-plan, ai-data/ai-system-inventory, compliance/dpia

Other jurisdictions, as dated examples only: in the United States, New
York City Local Law 144 of 2021 regulates automated employment decision
tools used for hiring in the city (https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page);
in the United Kingdom, there is no AI-specific deployer statute, and the
UK GDPR rules on automated decision-making (Articles 22A to 22D, inserted
by the Data (Use and Access) Act 2025; the ICO reported in June 2026
that all of the Act's data protection changes were in force) and the Equality Act 2010 apply to automated
recruitment (https://www.legislation.gov.uk/ukpga/2025/18). Check the
current position with a qualified professional.

## Standard and licence note

Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), Articles
26, 27 and 86 on deployers of high-risk AI systems, as published in the
Official Journal of the European Union; EU legislative texts are free to
reuse. The duties are summarised in original wording and no text of the
Regulation is reproduced. Check the consolidated text on EUR-Lex for the
binding wording, later amendments and Commission guidance; under the
amended Article 113 the Article 26 obligations apply from 2 December
2027 for Annex III systems and from 2 August 2028 for Annex I systems.
All organisations and figures in examples are fictional. This is a
documentation format, not legal advice. Template licence: MIT.