EU AI Act High-Risk: What a Deployer Must Be Able to Answer Before December 2027

TL;DR

• The European Commission says that, after the political agreement on the “AI Omnibus”, rules for high-risk AI in areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control apply from 2 December 2027. Systems integrated into products such as robotics and industrial machinery follow on 2 August 2028 (Commission guidelines page).
• If you use a high-risk system rather than build it, your core obligations sit in Article 26.
• Below, Article 26 is turned into twelve questions. If you can answer each one with a document, a log or a named person, you are in a good position. This is a practitioner’s checklist, not legal advice.

Why deployers should start now, not in late 2027

Most attention on the AI Act has gone to model providers. But most companies will be deployers: they buy or configure a system for recruitment screening, credit decisions, access to education or similar uses, and run it under their own authority.

The extra time from the Omnibus is useful, but deployer obligations are mostly about operations: who oversees the system, what data goes in, how it is monitored, how long logs are kept, who has been informed. Those take months to put in place in a real organisation, because they cut across HR, legal, IT and the business owner.

I studied business law before I spent most of my career in data and AI, and the pattern is familiar from GDPR. The organisations that coped well were the ones that turned the text into operational questions early and gave each question an owner.

Step zero: is the system high-risk at all?

The Commission has published draft guidelines to help providers and deployers “assess whether their AI system is high-risk or not”, with a list of practical examples. Two caveats from the Commission itself:

• The guidelines are “not legally binding”, but “reflect the Commission’s interpretation and will guide enforcement”.
• The examples “are not to be considered as exhaustive and may be updated over time.”

The page also says a targeted stakeholder consultation on the draft was open until 23 July 2026, with feedback to be incorporated before final adoption. So check the current version of the guidelines when you classify, and record which version you used.

Twelve questions from Article 26

The text below follows the consolidated version on the Commission’s AI Act Service Desk, which notes that it is based on the EUR-Lex consolidated text as at 27 July 2026, including Digital Omnibus amendments.

Use and oversight

1. Do we use the system according to the provider’s instructions for use, and can we show which technical and organisational measures ensure that? (Art. 26(1))

2. Who are the named people assigned to human oversight, and can we show they have “the necessary competence, training and authority, as well as the necessary support”? (Art. 26(2)) Authority is the word most often missed. An overseer who cannot pause the system is not oversight.

Input data

3. Where we control input data, how do we know it is “relevant and sufficiently representative in view of the intended purpose”? (Art. 26(4)) For an HR screening tool this means knowing which fields you send, from which sources, and how you checked them.

Monitoring and incidents

4. How do we monitor the system’s operation based on the instructions for use, and how do we inform the provider when relevant? (Art. 26(5))

5. If we have reason to think the system presents a risk, who decides to suspend its use and inform the provider or distributor and the market surveillance authority “without undue delay”? (Art. 26(5))

6. If a serious incident happens, do we know the order of notification? Article 26(5) says to immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities.

Logs

7. Do we keep the logs automatically generated by the system, to the extent they are under our control, for at least six months? (Art. 26(6)) Check this against your data protection retention rules, since the article explicitly defers to other Union or national law, “in particular in Union law on the protection of personal data”. For financial institutions the logs are kept as part of documentation under financial services law.

People affected

8. Before using the system at the workplace, have we informed workers’ representatives and the affected workers? (Art. 26(7)) In Sweden that will usually run through existing information and consultation routines with unions.

9. For Annex III systems that make or assist decisions about natural persons, how do we inform those persons that they are subject to the system? (Art. 26(11))

Data protection

10. Have we used the provider’s Article 13 information in our data protection impact assessment under GDPR Article 35, where applicable? (Art. 26(9)) This is the bridge between the AI Act and the DPIA you probably already know how to run.

Public sector and authorities

11. If we are a public authority or EU body, is the system registered in the EU database, and do we refuse to use it if it is not? (Art. 26(8))

12. Can we cooperate with competent authorities on request: who is the contact, and where is the evidence? (Art. 26(12))

Article 26(10) adds specific rules for post remote biometric identification in law enforcement, including authorisation within 48 hours. If that applies to you, you need dedicated legal support rather than a checklist. Also check Article 27 on fundamental rights impact assessments, which applies to certain deployers.

Turning the questions into evidence

For each of the twelve questions I would keep one row in a simple register:

That register is also what you show your board. It turns “we are working on AI Act compliance” into a list of owned gaps with dates.

A practical timeline to December 2027

• Now to Q1 2027: inventory AI systems in use, classify each against the current guidelines, record the version used.
• Q2 2027: for each high-risk system, assign oversight owners, map input data and log retention, align with the DPIA.
• Q3 2027: inform workers and representatives where relevant, set up monitoring and incident routines with providers.
• Q4 2027: dry run an incident and a regulator request. Close gaps before 2 December.

FAQ

When do the rules apply? From 2 December 2027 for high-risk areas such as employment and education, and 2 August 2028 for systems integrated into products, according to the Commission.

What is a deployer? The organisation using a high-risk AI system under its own authority, as opposed to the provider that builds or markets it.

How long must logs be kept? At least six months, for logs under the deployer’s control, unless other law says otherwise.

Must employers inform staff? Yes, workers’ representatives and affected workers, before the system is used at the workplace.

Are the guidelines binding? No, but they reflect the Commission’s interpretation and will guide enforcement.

Sources: European Commission, “Guidelines for providers and deployers of AI high-risk systems”; AI Act Service Desk, “Article 26: Obligations of deployers of high-risk AI systems”. Read 9 November 2026. Not legal advice.