European UnionAI Act, Article 26(8) (public-authority deployer registration)
Regulation (EU) 2024/1689, Article 26(8)
An AI governance rule binding government bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Licensing
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are a public authority, or a Union institution, body, office or agency, deploying a high-risk AI system, comply with the Article 49 registration obligations.NIST AI RMFGOVERN 1.1
- If you find that the high-risk AI system you plan to use has not been registered in the EU database, do not use it, and inform the provider or the distributor.NIST AI RMFGOVERN 6.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- GOVERN 6.1Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-10Intellectual Property
- MIT mitigations Draft
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(e): non-compliance with the obligations of deployers under Article 26 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines. Article 99(8) leaves it to each Member State to decide the extent to which an administrative fine may be imposed on a public authority or body established in that Member State, so this ceiling does not apply uniformly to a public-authority deployer the way it does to a private one.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Does a public-authority deployer comply with Article 26(8) by relying on the provider's registration alone, when the paragraph requires it to refrain from using a system it 'find[s]' has not been registered in the EU database referred to in Article 71?
What it makes you log
Logging duty
Article 26(8) is a registration duty: a public-authority deployer must register in the EU database under Article 49, and must not use an unregistered system. It names no separate log or record duty; the EU database entry itself is the registration record, and the profile's registered vocabulary does not carry a distinct 'registration' recordkeeping key.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
A deployer of a high-risk AI system that is a public authority, or a Union institution, body, office or agency, must comply with the Article 49 registration obligations. Where such a deployer finds that the high-risk AI system it plans to use has not been registered in the EU database, it must not use the system, and must inform the provider or the distributor.
Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 26(8) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .