EU AI Act Article 26(1), (3), (5) — Deployer use per instructions, monitoring and incident reporting
Deployers of high-risk AI must use the system in accordance with the provider’s instructions for use, monitor its operation, and report risks and serious incidents to the provider and the market surveillance authority
Where this comes from
Provision: Article 26(1), (3), (5) — Deployer use per instructions, monitoring and incident reporting
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 26(1), (3) and (5), Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Who it applies to
High-risk AI deployer in scope — all of these:
- Service deploys AI systems in a professional capacity
- AI Act role is Deployer or we provide some AI systems and deploy others
Annex III high-risk area (Art. 6(2)) — any one of these:
- Annex III high-risk areas includes Biometrics
- Annex III high-risk areas includes Critical infrastructure
- Annex III high-risk areas includes Education and vocational training
- Annex III high-risk areas includes Employment and worker management
- Annex III high-risk areas includes Essential public services
- Annex III high-risk areas includes Creditworthiness
- Annex III high-risk areas includes Insurance
- Annex III high-risk areas includes Law enforcement
- Annex III high-risk areas includes Migration, asylum and border control
- Annex III high-risk areas includes Administration of justice and democratic processes
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 6(3): an Annex III system is NOT high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — which applies where the system (a) performs... (AI Act Art. 6(3))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 6(2): the AI system falls within an area listed in Annex III and is therefore high-risk, no documented Art. 6(3) derogation applying (and it is ALWAYS high-risk where it performs profiling of natural persons)
- Art. 26(1), read with Art. 3(4): the actor is a 'deployer' — a natural or legal person using an AI system under its authority, other than in the course of a personal non-professional activity
What engineering work it implies
- Human Oversight Gate (Review Queue with Stop and Override)Covers part of it
A decision state machine that holds an automated decision as a proposal until a designated, competent reviewer releases, overrides or stops it — with an audit of who...
Sample acceptance criteria Landfall generates for this obligation:
- The provider's instructions for use are held, versioned, and the deployment is checked against them before go-live (Art. 26(1))
- Any use outside the stated intended purpose is identified and either stopped or escalated as a role change to provider (Art. 25(1))
- Operation is monitored against defined indicators, with a named owner for the monitoring (Art. 26(5))
- A route exists to inform the provider, the distributor and the market surveillance authority of a risk or serious incident, with a target time
- Use of the system is suspended when a risk to health, safety or fundamental rights is identified, without waiting for a release
Evidence an auditor expects
- Policy documentDocument review
Technical and organisational measures securing use in accordance with the instructions for use (Art. 26(1))
Documented operating procedure tying each instruction-for-use constraint to the control that enforces it, with the owner for each
- Process recordDocument reviewReviewed continuous; incident file reviewed on each occurrence
Operational monitoring record and serious-incident notification file (Art. 26(5) with Art. 72 and Art. 73)
Monitoring records kept on the basis of the instructions for use; and, for any event where the deployer had reason to consider the system presented an Art. 79(1) risk, dated evidence of informing the provider or distributor and the relevant market surveillance authority WITHOUT UNDUE DELAY and of suspending use. For a serious incident, evidence that the provider was informed immediately, then the importer or distributor and the market surveillance authorities
Questions people ask
- Does EU AI Act Article 26(1), (3), (5) — Deployer use per instructions, monitoring… apply to my service?
- It applies when Service deploys AI systems in a professional capacity; AI Act role is Deployer or we provide some AI systems and deploy others; and at least one of: Annex III high-risk areas includes Biometrics; Annex III high-risk areas includes Critical infrastructure; Annex III high-risk areas includes Education and vocational training; Annex III high-risk areas includes Employment and worker management; Annex III high-risk areas includes Essential public services; Annex III high-risk areas includes Creditworthiness; Annex III high-risk areas includes Insurance; Annex III high-risk areas includes Law enforcement; Annex III high-risk areas includes Migration, asylum and border control; Annex III high-risk areas includes Administration of justice and democratic processes. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 26(1), (3), (5) — Deployer use per instructions, monitoring… is enforceable from 2 August 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Technical and organisational measures securing use in accordance with the instructions for use (Art. 26(1)); Operational monitoring record and serious-incident notification file (Art. 26(5) with Art. 72 and Art. 73).
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.