What the deployer still owes
Deployers of high-risk systems have their own short list: use it according to the instructions, assign human oversight to competent people with authority to intervene, ensure input data is relevant, keep the logs they control, and inform workers before deploying it in the workplace.
Why it is like this
The provider's controls only work if someone operates them. Those duties are the operating half of the provider's design.
Not to be confused with
Nothing. And one duty is easy to miss: deployers that are public bodies, or that provide public services, must carry out a fundamental rights impact assessment before first use.
In practice
Assigning oversight to someone who cannot actually stop the system is the most common failure — authority to intervene is part of the requirement, not an implementation detail.
Source: Regulation (EU) 2024/1689 (AI Act) — Article 26 and Article 27. Read on .
Say it back Check yourself
Name three obligations a deployer of a high-risk system carries, and the extra one that applies to public bodies.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Use the system in accordance with the instructions for use
- Assign human oversight to competent, trained people with the authority to intervene
- Ensure input data is relevant and sufficiently representative for the intended purpose
- Keep the automatically generated logs under its control
- Inform workers' representatives and affected workers before deployment at work
- Public bodies and providers of public services: a fundamental rights impact assessment
The fundamental rights impact assessment is the one most inventories miss, because it sits in its own article.