EU AI Act — Deployer Duties & Evidence (Article 26)
Deployers of high-risk AI must monitor operation, retain logs, ensure human oversight, and cooperate with providers — in force from August 2026 alongside transparency rules. This guide maps deployer duties to ai_act.* events you can export. It does not determine whether you are a deployer or whether your system is high-risk.
Deployer vs provider (evidence split)
| Role | Typical duty | Sigigo evidence angle |
|---|---|---|
| Provider | Embed Art. 12 logging in product (Arts. 12, 19, 72) | SDK in vendor high-risk feature |
| Deployer | Operate, monitor, retain, oversee (Art. 26) | Overlay SDK at API boundary if vendor logs are weak |
| Both | Value-chain cooperation on log access | Exportable evidence packs both sides can verify |
Article 12 field map: Article 12 hub.
Article 26 → what to evidence
| Deployer duty (summary) | Evidence expectation | ai_act.* events |
|---|---|---|
| Take provider instructions into account (26(1)) | Prove configured operating conditions | Policy metadata on inference_started |
| Assign human oversight (26(2)) | Oversight assigned and exercised | ai_act.human_review_completed, human_override |
| Monitor operation (26(5)) | Periodic operational checks | ai_act.operation_monitored |
| Retain logs ≥ 6 months (26(6)) | Exportable retention window | Tenant policy + evidence pack slice |
| Relevant input data quality (26(4)) | Data suitability at decision time | ai_act.input_received + validation metadata |
| Inform workers (26(11)) | Workplace transparency where applicable | ai_act.transparency_disclosure (if AI interaction) |
| Serious incidents (26(5) + Art. 73) | Detection → report chain | ai_act.serious_incident_reported |
Deployer checklist (engineering)
- Confirm high-risk scope via legal review or FLI Compliance Checker — then run the technical readiness quiz
- Instrument every production inference path — no shadow APIs without logging
- Link human review events to the same
session_idas model output - Set retention ≥ 180 days; document sector-law extensions in tenant policy
- Schedule
ai_act.operation_monitoredcheckpoints for post-market monitoring alignment - Practice evidence pack export for a sample retention window before surveillance asks
Typical deployer gaps
| Approach | Why it falls short |
|---|---|
| Rely on vendor dashboard only | No independent verification; weak deployer control story |
| SIEM with 90-day retention | May miss six-month floor; weak tamper evidence |
| Manual oversight spreadsheets | Not automatic — fails Article 12 at provider; weak for deployer monitoring |
| Separate HR and AI logs | Cannot reconstruct session without shared session_id |
FAQ
- We buy SaaS AI — are we still a deployer?
- Often yes, when you operate high-risk AI in your context. You may need an overlay at your API boundary even if the vendor claims compliance. Contractual assurances are not tamper-evident logs.
- Does Article 26 replace Article 12?
- No. Providers must enable Art. 12 logging; deployers must monitor, retain, and oversee under Art. 26. Both need evidence — see the Article 12 hub for automatic logging requirements.
- What about FRIA (Article 27)?
- Certain public-sector and private deployers must complete Fundamental Rights Impact Assessments. Evidence the process with review and sign-off events — Sigigo witnesses execution, not legal conclusions.
Run the readiness quiz or book a workshop to map deployer duties to your production AI flows.
This guide supports qualification and architecture planning — it is not legal advice. Work with your legal and compliance teams on classification, DPAs, and deployment approvals. See also our Regulatory & Compliance page.