Chapter 6: High-Risk Deployer — The 7 Obligations You Must Meet

EU AI Act Implementation Guide · 1 min read

If your AI system is classified as high-risk, knowing that is only the beginning. The EU AI Act imposes seven specific obligations on deployers — the organisations that use high-risk AI systems in their operations. These are not optional best practices. They are legal requirements, enforceable from 2 December 2027, with fines up to €15 million or 3% of global annual turnover.

It All Starts with One Document

Everything starts with the Instructions for Use (IFU) from your AI provider. Without it, you cannot properly fulfil any of the seven obligations. If you do not have it, request it in writing — today.

The Seven Obligations Under Article 26

The seven deployer obligations are: use the system according to the provider’s instructions, assign human oversight with real authority to override, ensure the quality of the data you feed into the system, actively monitor the system’s performance, retain automatically generated logs for at least six months, inform workers before deploying AI in the workplace, and inform affected individuals with the right to request a meaningful explanation of AI-assisted decisions.

The Most Common Mistakes

The most common mistakes are not technical — they are organisational. Assigning oversight to someone without the authority to intervene. Filing the IFU without reading it. Assuming the provider handles log retention. Confusing GDPR notification with AI Act notification. Each of these gaps is a compliance failure.

Implementation Effort

Total implementation effort is 30 to 90 hours, with 2 to 8 hours per month of ongoing maintenance. The full chapter covers each obligation with what the law requires, how to implement it, what evidence to keep, practical examples, and the mistakes to avoid — plus a self-check table and an implementation timeline.