GuideEU AI Act · Articles 4, 26, 27, 50Version 1.025 October 2026
EU AI Act deployer obligations, control by control
A company that uses an AI system under its own authority is a deployer under the EU AI Act, with duties where the system runs: AI literacy under Article 4, use according to instructions, human oversight, input data and log keeping under Article 26, transparency under Article 50 and, for some, a fundamental rights impact assessment under Article 27. This page maps each duty to the governance control that carries it and the record that evidences it, with the dates in force on 25 October 2026.
On this page
The duties sit where the system runs, with the deployer, not the model vendor.
In this document, "we" means Hikari Blue, which engineers and operates the AI operating layer and installs the Enterprise AI Governance Framework on client engagements. We map Articles 4, 26, 27 and 50 to our governance controls and to the record each one writes; the Commission has not reviewed the mapping.
Article references are to Regulation (EU) 2024/1689 in its consolidated version of 27 July 2026, which includes the amendments of Regulation (EU) 2026/1744. The consolidated text is a documentation tool without legal effect; the Official Journal governs.
In our reading, the operational duties of the Act sit with the company that uses the system in its own workflow, whichever model it calls. A contract can move work to the model vendor; it does not move these duties.
Mapping prepared by Hikari Blue; the European Commission has not reviewed it.
This is not legal advice. We do not promise legal compliance. Whether a system is high-risk, and which role an organization holds for it, is a question for counsel.
Who is a deployer, and when a deployer becomes a provider.
Article 3(4) defines the deployer as a natural or legal person, public authority, agency or other body using an AI system under its authority, except in the course of a personal non-professional activity. Article 3(3) defines the provider as the one that develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark.
Article 26 binds the deployers of high-risk systems. Articles 4 and 50 also reach the deployers of other AI systems. The role is qualified system by system, on the facts.
| Situation | Role under the Act | Provision |
|---|---|---|
| You use an AI system supplied by a vendor, under your own authority, in your workflows. | Deployer; the vendor is the provider | Art. 3(3) and 3(4) |
| You build an AI system on a vendor's model and put it into service under your own name. | In our reading, provider and deployer of that system; the vendor remains the provider of the model | Art. 3(3) and 3(4) |
| You put your name or trademark on a high-risk AI system already placed on the market or put into service. | Provider of that high-risk system, with the obligations of Article 16 | Art. 25(1)(a) |
| You make a substantial modification to a high-risk AI system, and it remains high-risk. | Provider of that high-risk system, with the obligations of Article 16 | Art. 25(1)(b) |
| You change the intended purpose of a system that was not high-risk, a general-purpose AI system included, so that it becomes high-risk: for example, an assistant put to filtering job applications. | Provider of the resulting high-risk system | Art. 25(1)(c) and Annex III, point 4(a) |
When one of the 3 cases of Article 25(1) occurs, the initial provider is no longer the provider of that specific system. Since Regulation (EU) 2026/1744, it cooperates with the new provider through documentation, known limitations and failure modes, and targeted technical access, unless it clearly specified that its system is not to be changed into a high-risk system (Article 25(2)).
Situations are illustrative and generic, not client cases.
Literacy already applies. The Annex III high-risk duties apply from December 2027.
Dates come from Article 113 as amended by Regulation (EU) 2026/1744, in force since 27 July 2026, and match the Commission's implementation timeline. They are the dates of our regulatory doctrine, the same on every page of this site.
| Duty | Who carries it | Applies from |
|---|---|---|
| AI literacy, Article 4 | Providers and deployers of all AI systems | 2 February 2025; current wording since 27 July 2026; enforced by national authorities from 2 August 2026 |
| Prohibited practices, Article 5 | Everyone in scope, since the use of a prohibited system is itself prohibited | 2 February 2025; prohibitions added in 2026 from 2 December 2026 |
| Penalties, Article 99 | Set and applied by Member States | 2 August 2025 |
| Transparency, Article 50(3) and (4) | Deployers of emotion recognition, biometric categorisation and deep fake systems, and of AI-generated text published to inform the public | 2 August 2026 |
| Use, oversight, input data, monitoring, logs and information, Article 26 | Deployers of high-risk AI systems | 2 December 2027 (Annex III) · 2 August 2028 (Annex I) |
| Fundamental rights impact assessment, Article 27 | Bodies governed by public law, private entities providing public services, and deployers of credit scoring systems and of risk and pricing systems for life and health insurance | 2 December 2027 (Annex III) |
| Right to explanation, Article 86 | Deployers whose decision rests on the output of an Annex III high-risk system, critical infrastructure excepted | 2 August 2026 under Article 113; in our reading, in effect once Annex III classification applies, from 2 December 2027 |
Fines. A breach of the deployer obligations of Article 26 or of the transparency obligations of Article 50 carries administrative fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4), points (e) and (g)). A prohibited practice carries up to EUR 35 million or 7%, and incorrect information to an authority up to EUR 7.5 million or 1%. For SMEs, including start-ups, the lower amount applies (Article 99(6)). Article 99 sets no specific fine for Article 4.
Systems already in use. Since Regulation (EU) 2026/1744, a high-risk system placed on the market or put into service before the date of application of Chapter III falls under the Regulation only if its design changes significantly from that date; systems intended for public authorities comply by 2 August 2030 (Article 111(2)).
Calendar checked on 25 October 2026 against the AI Act Service Desk implementation timeline of the European Commission.
Each duty, the control that carries it and the record that proves it.
Read each row from left to right: the duty in the terms of the Act, the control of the Enterprise AI Governance Framework that carries it, and the record an auditor asks for. Field names in the last column are those of the 9-field record of the AI audit trail.
| Deployer duty | Control | Record that evidences it |
|---|---|---|
| Article 4 · Take measures to support the AI literacy of staff and other persons acting on the deployer's behalf | GOV-E-02 · Dated literacy records | A dated, role-resolved literacy record per person, linked to the identities in the agent and operator registers, held before access is granted. |
| Article 26(1) · Use the system in accordance with the instructions for use | GOV-P-04 · Instructions for use and transparency GOV-P-02 · Policy as code |
One instructions-for-use file per system, versioned with the model; the Policy applied field of each record names the rule in force when the system acted. |
| Article 26(2) · Assign human oversight to natural persons with the necessary competence, training, authority and support | GOV-A-03 · Human verification of consequential outputs GOV-E-02 · Dated literacy records |
The Human verification field of each record, with the verifier's identity and reason, and the verifier's competence record. |
| Article 26(4) · Keep the input data it controls relevant and sufficiently representative for the intended purpose | GOV-D-03 · Inputs by reference GOV-P-01 · Use-case register and classification |
The Inputs reference field shows which data each action read; the register entry states the intended purpose that data must fit. |
| Article 26(5) · Monitor operation, inform the provider and the authority of a risk and suspend use, report serious incidents | GOV-E-03 · Monitoring and incident record GOV-A-04 · Stop path and drill |
The incident register, with detection time, stop action and notification decision; the drill record of the stop path; the Actor identity and Timestamp fields locate each event. |
| Article 26(6) · Keep the automatically generated logs under its control for at least 6 months | GOV-E-01 · Append-only, chained trail | The trail itself: one 9-field record per action, chained by hash, verified daily. Our engagement baseline retains it 12 months minimum, above the 6-month floor. |
| Article 26(7) · Inform workers' representatives and affected workers before use at the workplace | GOV-P-04 · Instructions for use and transparency | The dated notice to workers' representatives and affected workers, filed with the register entry of the system. |
| Article 26(9) · Use the provider's Article 13 information for the GDPR data protection impact assessment | GOV-D-02 · Impact assessments before production | The signed data protection impact assessment, linked to its register entry and to the instructions-for-use file it draws on. |
| Article 26(11) · Inform natural persons that they are subject to an Annex III system that decides or assists decisions about them | GOV-P-04 · Instructions for use and transparency | The notice text shown to affected persons, versioned with the system it describes. |
| Article 26(12) · Cooperate with the competent authorities | GOV-E-01 · Append-only, chained trail | The regulator export: raw records for one system and one period, with the policy versions, the agent register and the literacy records in force at the time. |
| Article 27 · Assess the impact on fundamental rights before first use, and notify the results to the market surveillance authority | GOV-D-02 · Impact assessments before production GOV-P-01 · Use-case register and classification |
The signed fundamental rights impact assessment, dated before first use and linked to its register entry, with the notification sent to the authority. |
| Article 50(3) and (4) · Inform persons exposed to emotion recognition or biometric categorisation; disclose deep fakes and AI-generated text published to inform the public | GOV-P-04 · Instructions for use and transparency | The disclosure texts and where each system shows them; the Action field of each record that produced published content. |
| Article 86 · Give an affected person clear and meaningful explanations of the role of the system and the main elements of the decision | GOV-A-03 · Human verification of consequential outputs GOV-E-01 · Append-only, chained trail |
The Action and Human verification fields of the record behind the decision. |
| Article 25 · Know when a change of name, design or purpose makes the deployer a provider | GOV-P-01 · Use-case register and classification GOV-P-03 · Model selection and change control |
The signed classification of each use case, run again at each change of purpose or substantial modification, and the change entries in the trail. |
Mapping prepared by Hikari Blue; the European Commission has not reviewed it.
Article 26(3) adds no duty; it preserves the deployer's other obligations and its freedom to organise oversight. Article 26(8) on public-authority deployers and Article 26(10) on post-remote biometric identification fall outside this mapping.
Control statements, owners and cadences are those of the Enterprise AI Governance Framework v1.0, published on 25 September 2026.
What the deployer cannot hand to the model vendor.
In our reading, a contract can move work to a vendor; it cannot move the duties the Act attaches to the deployer. 6 of them stay where the system runs.
The purpose of the use
The vendor does not know that its assistant now filters job applications. The intended purpose and the classification are the deployer's facts, and Article 25(1)(c) makes the company that changed the purpose a provider.
The people who oversee
Article 26(2) asks the deployer to assign oversight to persons with competence, training, authority and support. A vendor's safety team does not see your consequential outputs before they take effect.
The logs under its control
Article 26(6) covers the logs under the deployer's control. A model API keeps its own logs, for its own purposes; the record of your workflow exists only if your layer writes it.
The decision to suspend
Article 26(5) asks the deployer to suspend use when it has reason to consider that the system presents a risk. Suspension happens in the deployer's own systems, and a stop path built into its layer makes it fast and provable.
The notices to people
Workers, affected persons and the public are informed by the deployer, under Articles 26(7), 26(11) and 50(3) and (4). The vendor does not know who they are.
The explanation of a decision
Article 86 gives the affected person a right against the deployer, not against the vendor. The answer comes from the record of the decision, or it does not come.
What the provider does owe the deployer: instructions for use and the transparency that lets it interpret the output (Article 13), cooperation when a deployer becomes a provider (Article 25(2)), and, for general-purpose AI model providers, the obligations of Chapter V, in application since 2 August 2025.
90 days on one workflow, duty by duty.
The path is the adoption path of the governance framework: one workflow already in production, 3 blocks, each closed on artefacts. Here each artefact names the deployer duty it answers.
- 01
Days 1 to 30 · Map and assign
Register and classify the use cases, qualify the role for each, deployer or provider, name the accountable executive and the AI risk owner, sign the decision rights table and write the instructions for use and the notices of the first workflow.
Evidence: use-case register and classification (Articles 25 and 27), signed decision rights, instructions-for-use file and notice texts (Articles 26(1), 26(7), 26(11) and 50), gap list against the 15 controls. Exit at maturity level 1.
- 02
Days 31 to 60 · Enforce and record
Turn the policies into code, give each agent its identity and scope, start the chained trail, run the first kill switch drill, and sign the impact assessments that apply.
Evidence: policy repository (Article 26(1)), agent register, live trail (Article 26(6)), drill record of the stop path (Article 26(5)), signed DPIA and FRIA where they apply (Articles 26(9) and 27). Exit at maturity level 2.
- 03
Days 61 to 90 · Operate and report
Train and name the verifiers, run the weekly cadence, rehearse a regulator export, and issue the first board pack from the trail.
Evidence: dated literacy records (Article 4), verifier roster (Article 26(2)), export rehearsal report (Article 26(12)), first board pack. Exit at maturity level 3.
The 90 days and the maturity levels are those of the governance framework, sections 7 and 8. Level 4 depends on the transfer plan, not on the 90 days. Article 4 already applies; the high-risk duties apply from 2 December 2027 for Annex III systems.
The questions deployers ask about the EU AI Act.
Which EU AI Act obligations fall on the deployer rather than on the model provider?
The duties of use. Every deployer takes AI literacy measures (Article 4) and, for the systems concerned, informs or discloses under Article 50. A deployer of a high-risk system also uses it according to the instructions for use, assigns human oversight to competent people, checks the input data it controls, monitors operation, keeps the logs for at least 6 months and informs workers and affected persons (Article 26). Some must assess the impact on fundamental rights (Article 27), and a person affected by a decision based on an Annex III system can ask the deployer for an explanation (Article 86). The model provider carries the obligations of Chapter V.
Who must carry out a fundamental rights impact assessment?
Under Article 27(1), before first use of an Annex III high-risk system other than critical infrastructure: deployers that are bodies governed by public law or private entities providing public services, and deployers of systems that evaluate creditworthiness or set credit scores, fraud detection excepted, or that assess risk and set prices for life and health insurance (Annex III, points 5(b) and 5(c)). Its results are notified to the market surveillance authority, and it may cross-refer to an existing GDPR data protection impact assessment (Article 27(4)).
When does a deployer become a provider?
In 3 cases under Article 25(1): it puts its name or trademark on a high-risk system already on the market, it makes a substantial modification to a high-risk system that remains high-risk, or it changes the intended purpose of a system so that it becomes high-risk. It then carries the provider obligations of Article 16, and the initial provider stops being the provider of that system but must cooperate (Article 25(2)).
When do the deployer duties apply?
AI literacy since 2 February 2025, in its current wording since 27 July 2026; penalties since 2 August 2025; transparency since 2 August 2026. The duties of Article 26 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, and the fundamental rights impact assessment of Article 27 from 2 December 2027, under Regulation (EU) 2026/1744.
What fines does a deployer face?
Up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher, for a breach of Article 26 or Article 50 (Article 99(4)), and up to EUR 35 million or 7% for a prohibited practice. For SMEs, including start-ups, the lower amount applies. Member States lay down the penalties; Article 99 has applied since 2 August 2025.
Does the model vendor's compliance cover the deployer?
No. In our reading, the provider's compliance covers the system or model it places on the market, and the deployer's duties attach to its own use. The provider's instructions for use are an input to the deployer's compliance, not a substitute for it.
Reference documents and primary sources.
Every article, date and amount on this page comes from the sources below, read on 25 October 2026.
Reference documents
- Enterprise AI Governance Framework v1.0 The 15 controls, with their statement, evidence, owner, cadence and regulatory hook. CC BY 4.0.
- Regulatory doctrine v1.0 8 dated theses on the rules that govern AI in production; the dates of this page are its dates.
- AI audit trail: definition, fields and EU AI Act mapping The 9-field record that evidences the deployer duties of Article 26.
- AI literacy and Article 4 of the EU AI Act What Article 4 requires since its July 2026 wording, who is covered and the records that show it is met.
- The EU AI Act for Swiss companies When the Act reaches a company established outside the Union, and the role it then holds.
- NIST AI RMF implementation, control by control The same 15 controls and the same 90 days, read against the NIST AI RMF for US operations.
Primary sources, consulted on 25 October 2026
- EUR-Lex · Regulation (EU) 2024/1689, the AI Act, consolidated text (opens in a new tab) Version of 27 July 2026. Articles 3, 4, 5, 13, 25, 26, 27, 50, 86, 99, 111 and 113, and Annex III. A documentation tool without legal effect.
- EUR-Lex · Règlement (UE) 2024/1689, texte consolidé (opens in a new tab) French version of the same consolidated text, source of the legal terms of the French edition of this page.
- Official Journal · Regulation (EU) 2026/1744, Digital Omnibus on AI (opens in a new tab) Regulation of 8 July 2026, published on 24 July 2026, in force on 27 July 2026. Among its amendments: Articles 4, 25, 27, 99, 111 and 113.
- European Commission · AI Act Service Desk, implementation timeline (opens in a new tab) Application and enforcement milestones after the Digital Omnibus on AI, from 1 August 2024 to 2 August 2028.
How to cite this document.
This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.
Preferred citation
Hikari Blue, "EU AI Act deployer obligations, control by control v1.0", 25 October 2026, https://hikariblue.com/governance-framework/eu-ai-act-deployer
Section anchors are stable: #status, #deployer, #dates, #mapping, #cannot-delegate, #path, #faq, #references, #cite.
Changelog
v1.0 · 25 October 2026. First public version.
License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.
Place one workflow against the deployer duties.
30 minutes with a named partner. We take one AI workflow you already run, qualify your role for it, and place it against Articles 4, 26, 27 and 50 with the control and the record each duty asks for. You leave with the gap list, whether or not we work together.
- Your role for one workflow, deployer or provider
- The duties that apply to it, with their dates
- The records that exist today, and those that are missing