European UnionAI Act, Article 26(9) (using Article 13 information for a data protection impact assessment)
Regulation (EU) 2024/1689, Article 26(9)
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- DPIA
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are the deployer of a high-risk AI system and you are separately required to carry out a data protection impact assessment under the General Data Protection Regulation (GDPR) or the Law Enforcement Directive, use the information the provider supplies you under Article 13 in that assessment.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- NIST AI 200-2 Draft
- 2.4Synthesize & Interrogate
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(e): non-compliance with the obligations of deployers under Article 26 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Does 'where applicable' in Article 26(9) make the use of the Article 13 information for a data protection impact assessment depend on the system processing personal data, and what must a deployer that does a data protection impact assessment do with that information beyond reading it?
What it makes you log
Logging duty
Article 26(9) requires a deployer to use Article 13 information in a data protection impact assessment it is already required to carry out; the impact-assessment duty itself, and any record it produces, arises under Article 35 GDPR or Article 27 of Directive (EU) 2016/680, outside this Regulation, so this row does not code that duty's own record-keeping requirement.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Where applicable, a deployer of a high-risk AI system must use the information the provider supplies under Article 13 to comply with the deployer's own duty to carry out a data protection impact assessment under Article 35 of the General Data Protection Regulation or Article 27 of the Law Enforcement Directive.
Article 26(9) does not itself create the impact-assessment duty, which is a data-protection duty owed under those instruments; it obligates a deployer already subject to one to draw on the provider's Article 13 disclosure when carrying it out.
Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 26(9) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .