Who must you tell when an AI system helps decide about people?

Under Article 26 of the EU AI Act, a deployer of a high-risk system must inform workers and their representatives before putting the system into use at work, and must inform people subject to decisions made or assisted by an Annex III system. Treat notices as a product requirement, with a record of when they went out.

The two duties

Article 26(7), workplace. Before putting a high-risk system into service or using it at the workplace, employers must inform workers' representatives and the affected workers that they will be subject to the system. This follows applicable Union and national rules and practice on informing workers.

Article 26(11), affected persons. Deployers of Annex III high-risk systems that make decisions or assist in making decisions related to natural persons must inform those persons that they are subject to the use of the system. This is without prejudice to Article 50. Law enforcement uses follow a different Directive.

Other Article 26 duties, such as assigning human oversight to people with competence, training and authority, and keeping logs for at least six months unless other law says otherwise, are covered in our deployer checklist.

What this means for agents

If an agent is part of the decision flow in an Annex III area, such as recruitment, the notice duty may apply even if a person makes the final call, because the text covers systems that assist in decisions. Confirm scope with counsel.

Agents make this harder to see. They are added by teams, not procurement, and their role can grow. So:

• Maintain an inventory of agents and what they touch.
• Tie each to a decision type and ask whether it is in Annex III.
• Link notices to the inventory entry.

What a good notice contains

The article does not prescribe wording in the parts reviewed, so write for a reader:

1. That an AI system is used, and for what.
2. What decision it informs.
3. Whether a person reviews the outcome.
4. How to ask a question or request review.
5. A contact.

Keep it short and plain, and put it where the person will see it before the use, such as the application page or the staff intranet and a team briefing.

Record keeping

For each notice, keep the date, audience, channel, version of the text and the system it relates to. When the agent or its purpose changes, review and reissue.

Where Safeguard fits

Safeguard's asset discovery and compliance evidence automation can hold the agent inventory and the dated records, so you can show who was told what and when.

Quick check

Sources

• Article 26, EU AI Act

Last reviewed: 19 October 2026.