If you use a high-risk AI system rather than build it, Article 26 is your list. Use the system per the provider's instructions, assign trained human oversight, check input data, monitor, keep logs for at least six months, inform workers and affected people, report serious incidents and cooperate with authorities.
The checklist
Work through these for each high-risk system.
- Instructions: take appropriate technical and organisational measures to use the system according to its instructions for use.
- Oversight: assign human oversight to people with the competence, training, authority and support needed.
- Input data: where you control input data, make sure it is relevant and sufficiently representative for the intended purpose.
- Monitoring: watch the system's operation. If it may present a risk, tell the provider, distributor or importer and the market surveillance authority, and suspend use.
- Serious incidents: notify the provider first, then importer or distributor and authorities. If the provider cannot be reached, Article 73 applies.
- Logs: keep automatically generated logs under your control for at least six months, unless other law requires longer.
- Workers: before putting a system into use at work, inform workers' representatives and affected workers.
- Public bodies: register the system in the EU database. If it is not registered, do not use it and inform the provider or distributor.
- Data protection: use the provider's Article 13 information for any data protection impact assessment.
- Affected people: for Annex III systems that make or assist decisions about natural persons, tell those people the system is in use.
- Cooperation: work with competent authorities.
Financial institutions can meet monitoring duties through existing financial governance rules and keep logs within financial documentation.
Turning it into operations
A list on paper does nothing. Attach each line to an owner and a place where evidence lives:
- Oversight: a named role per system, a training record, an escalation path.
- Logs: where they are stored, retention setting, who can read them.
- Incident route: a contact at the provider, an internal on-call owner, and a decision tree for suspension.
- Worker notice: a template and a record of when it was sent.
What to ask the provider before you buy
Instructions for use, the intended purpose, accuracy levels and metrics, how to export logs, who to call in an incident, and what changes would count as a substantial modification. These answers decide whether you can meet your own duties.
A caution on scope
Article 26 applies to high-risk systems, which means Annex III uses from 2 December 2027 and Annex I systems from 2 August 2028. Other AI uses have lighter duties such as literacy and transparency.
Add a short onboarding gate for new AI tools: nobody switches on a high-risk system until the checklist has an owner and evidence for each line. Even if your tools are not high-risk today, the same gate catches shadow AI and keeps the inventory honest.
Quick check
How long must deployers keep logs?
At least six months for logs under their control, unless other law requires longer.
Who do I tell first about a serious incident?
The provider first, then the importer or distributor and the relevant authorities.
Sources
- AI Act Article 26, obligations of deployers (an unofficial reader; confirm wording against the Official Journal)
- European Commission, AI Act regulatory framework
Last reviewed: 19 October 2026.
