European UnionAI Act, Article 26(11) (informing individuals subject to an Annex III decision)
Regulation (EU) 2024/1689, Article 26(11)
An AI risk obligations rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Disclosure
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the deployer of a high-risk AI system listed in Annex III that makes, or assists in making, a decision about a natural person, inform that person that they are subject to the use of the high-risk AI system.
- If the system is used for law enforcement purposes, follow Article 13 of Directive (EU) 2016/680 instead of this duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(e): non-compliance with the obligations of deployers under Article 26 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Does the duty in Article 26(11) to inform natural persons that they are subject to the use of a high-risk AI system apply to a deployer whose Annex III system only produces a score or recommendation that a person then uses, given that the paragraph reaches deployers that 'make decisions or assist in making decisions related to natural persons'?
- What must the Article 26(11) notice say and when must it be given, when the paragraph states neither its content nor its timing and is stated to be 'without prejudice to Article 50'?
What it makes you log
Logging duty
Article 26(11) requires a deployer to inform an affected natural person that a high-risk AI system was used in a decision about them; it names no record of that notification. The affected person's own right to demand an explanation of the decision is Article 86, a separate row.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Without prejudice to the Article 50 transparency duties, a deployer of a high-risk AI system listed in Annex III that makes a decision, or assists in making one, about a natural person must inform that person that they are subject to the use of the high-risk AI system. For a system used for law-enforcement purposes, Article 13 of the Law Enforcement Directive applies instead.
This individual-notification duty reaches the whole Annex III catalogue, including the Annex III point 4 employment use cases and the Annex III point 8(a) administration-of-justice use case. Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III.
Article 26(11) reaches only a high-risk AI system referred to in Annex III, so the later date in that schedule for a system classified under Article 6(1) and Annex I brings no further system within it.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 26(11) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .