Skip to content

Deployer obligations

Deployer obligations are the duties the EU AI Act places on the organisation using a high-risk AI system, as distinct from the provider that built it. They include using the system according to its instructions, assigning competent human oversight, monitoring operation, keeping logs and informing the people affected. An employer using assessment systems is a deployer.

The Act defines a deployer as anyone using an AI system under their authority, which makes the employer, not the vendor, responsible for how it is used.

Why it matters when the plan changes

Employers tend to assume the vendor carries the regulatory weight. The Act splits it: the provider is responsible for how the system is built and documented, the deployer for how it is used, overseen and explained to the people it affects. Article 3 defines the deployer as whoever uses the system under its own authority, which is usually the employer, not the vendor supplying it. A compliant system used carelessly is the deployer's problem, and the deployer is the one the affected employee works for.

The tension is capability. A deployer can only oversee a system it understands, monitor operation it can see and inform people about logic it has been told. All of that depends on what the provider hands over under Article 26's instructions for use. The instructions for use and the technical documentation are where the deployer's ability to meet its duties is either enabled or quietly undermined.

In practice

An employer deploys an assessment system and assigns oversight to an HR analyst who was never told what the system measures or how confident its outputs are. When an employee asks how a decision was informed, the analyst cannot say. The provider has documentation; the deployer never asked for it. Both have obligations and only one was aware of them.

Evidence

What it cannot tell you

Deployer obligations describe duties for the organisation using a system, not a way to judge whether the system itself is sound. They say nothing about the quality of the provider's design, training data or accuracy, and a deployer can meet every duty in Article 26 while operating a system that performs poorly for reasons outside its authority to see.

Questions

The employer, because it uses the system under its authority to inform decisions about its people. The supplier is the provider. Where the supplier's own experts operate the system as part of a service, the split can need careful drafting, and the agreement should say who holds which duty.

Under Article 26 of the European Union Artificial Intelligence Act (2024), a deployer must assign human oversight to people with the competence, training and authority to exercise it, ensure input data it controls is relevant, and inform worker representatives and affected people before use begins.

Article 26 requires a deployer to use the system according to the instructions for use, monitor its operation, keep the required logs, suspend use and inform the provider of any risk, and be able to explain to an affected person the role the system played in a decision about them.

Yes, if it substantially modifies the system, changes its intended purpose, or puts its own name on it. An employer that fine-tunes a vendor's model on its own data or repurposes a tool for a use the vendor did not intend may have taken on provider duties without noticing.

The instructions for use, the technical documentation relevant to oversight, a description of what the system measures and how confident it is, the logging it produces, and a named route for reporting problems. A provider unable to supply those is leaving the deployer unable to comply.