Art. 26 deployer duties: what you actually have to run
Deployer obligations are lighter than a provider's but they are not paperwork. Use per instructions, human oversight, input data relevance, monitoring, and logs.
Article 26 is where deployer obligations live, and it is shorter than most people expect. That brevity is misleading: each line turns into an operational control that someone has to own.
The five that carry operational weight
- Use in accordance with the instructions for use the provider supplies. This means knowing what the instructions say and being able to show you followed them, which in turn means keeping them on file.
- Human oversight by competent, trained, supported people. Named, not implied.
- Input data relevance — where you control the input, it has to be relevant and sufficiently representative for the intended purpose.
- Monitoring of operation, with suspension and notification when something is wrong.
- Logs, kept for an appropriate period, for high-risk systems.
The one that gets skipped
Deployers of high-risk systems that are public bodies, private entities providing public services, or in the credit and insurance use cases, also carry the Art. 27 fundamental rights impact assessment. It is a separate duty from Art. 26 with a separate output; running the Art. 26 controls does not produce it.
ProhibScan maps your answers onto these duties and reports the gaps it finds. It reports them as gaps. It does not fill them in with text that reads like a control.
Decision-support only. Confirm the duty set against the current consolidated text of Regulation (EU) 2024/1689.