LexLint.ioBeta

Know the law your code answers to.

Law / European Union

AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring)

Regulation (EU) 2024/1689, Article 26(1) to (5)

An AI risk obligations rule binding public and private bodies.

How the hook was established
express
What makes it apply
Operator establishment, Place of effect
Obligation class
Governance, Reporting
Audit expectation
none

What it requires

  • This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
  • If you are the deployer of a high-risk AI system, take appropriate technical and organisational measures to ensure you use it in accordance with the provider's instructions for use.NIST AI RMFMANAGE 3.1
  • This duty, and your duty to assign human oversight, do not override any other deployer obligation under Union or national law, and do not limit your freedom to organise your own resources and activities when implementing the provider's human oversight measures.
  • If you are the deployer of a high-risk AI system, assign its human oversight to natural persons who have the necessary competence, training and authority, and give them the necessary support.NIST AI RMFGOVERN 3.2
  • If you are the deployer of a high-risk AI system and you exercise control over its input data, ensure that input data is relevant and sufficiently representative in view of the system's intended purpose.NIST AI RMFMAP 2.3
  • If you are the deployer of a high-risk AI system, monitor its operation on the basis of the provider's instructions for use, and inform the provider where relevant.NIST AI RMFMEASURE 2.4
  • Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.NIST AI RMFMANAGE 4.3NIST AI RMFMANAGE 2.4
  • Where you have identified a serious incident, immediately inform first the provider, then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, report the incident yourself as Article 73 requires of a provider.NIST AI RMFMANAGE 4.3
  • This duty does not require disclosing your sensitive operational data if you are a law enforcement authority.
  • If you are a financial institution subject to internal-governance requirements under Union financial services law, you satisfy this monitoring duty by complying with those rules.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • GOVERN 3.2Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.
  • MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
  • MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
  • MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.
  • MANAGE 3.1AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.
  • MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.
NIST AI 600-1
NIST AI 200-2 Draft
  • 2.3Apply & Measure
  • 4.3Composing a TEVV Toolbox
OWASP LLM Top 10
OWASP Agentic Top 10
  • ASI09Human-Agent Trust Exploitation
MIT mitigations Draft
  • 1.1Board Structure & Oversight
  • 1.2Risk Management
  • 3.5Post-deployment Monitoring
  • 4.1System Documentation
  • 4.2Risk Disclosure
  • 4.3Incident Reporting
1 more
  • 4.5Third-Party System Access
FINOS AIGF
ETSI EN 304 223
  • 5.1.4-1Capability for human oversight designed in and maintained.
  • 5.2.1-1Full inventory of assets, including their dependencies and connections.
  • 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
  • 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
  • 5.4.2-1Operators log system and user actions.

Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Private right of actionNo

Penalty structure

Article 99(4)(e): non-compliance with the obligations of deployers under Article 26 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.

Rule
Lower of for SME
As of
Currency
EUR
Fixed cap
15,000,000
Turnover percentage cap
3

Who enforces it

Settledness

As of
Open questions
  • What counts as 'appropriate technical and organisational measures' under Article 26(1) for a deployer to use a high-risk AI system 'in accordance with the instructions for use', and what must the deployer do where the instructions say nothing about its use case?
  • When does a deployer 'have reason to consider' under Article 26(5) that use of the system may present a risk within the meaning of Article 79(1), so that it must inform the provider and the market surveillance authority and suspend use?

What it makes you log

Logging duty

Article 26(1) to (5) set use, oversight, input-data and monitoring duties; none of them requires the deployer to keep a log. The log-keeping duty is Article 26(6), its own row.

Kind
None
As of

Also on the record

EEA status

Status
Pending
Source link
https://www.efta.int/eea-lex/32024r1689

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A deployer of a high-risk AI system must take appropriate technical and organisational measures to ensure it uses the system in accordance with the instructions for use accompanying it. That duty, and the deployer's duty to assign human oversight, are without prejudice to other deployer obligations under Union or national law and to the deployer's freedom to organise its own resources and activities for the purpose of implementing the human oversight measures the provider indicated.

A deployer of a high-risk AI system must assign human oversight of the system to natural persons who have the necessary competence, training and authority, as well as the necessary support. Without prejudice to a deployer's duties to use a high-risk AI system per its instructions and to assign human oversight, a deployer that exercises control over a high-risk AI system's input data must ensure that input data is relevant and sufficiently representative in view of the system's intended purpose.

A deployer of a high-risk AI system must monitor its operation on the basis of the instructions for use and, where relevant, inform the provider of that monitoring.

Where a deployer has reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, it must, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and suspend use of the system; where it has identified a serious incident, it must immediately inform the provider and then the importer or distributor and the relevant market surveillance authorities.

The duty does not cover sensitive operational data of a law-enforcement deployer, and a deployer that is a financial institution subject to Union financial-services internal-governance rules satisfies it by complying with those rules.

Article 26 sits in Chapter III, Section 3, so like the other deployer duties in this article it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .

Article 26(1) to (5) do not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions.

Back to the example  ·  Lint your app

Page updated .