Deployer Obligations

A mandatory, documented process for deployers of high-risk AI systems to evaluate the specific risks to the rights and freedoms of individuals likely to be affected by the system's operation. The assessment must include:

• A detailed description of the deployer's processes in which the high-risk AI system will be used
• The period and frequency of the system's intended use
• The categories of natural persons and groups likely to be affected
• The specific risks of harm likely to impact those groups
• The human oversight measures to be implemented
• The measures to be taken in case of materialized risks

Deployers must ensure that natural persons to whom human oversight is assigned have the necessary competence, training, and authority to carry out that role. This goes beyond a tokenistic rubber-stamp. Oversight must be built on human-in-the-loop, human-on-the-loop, or human-in-command paradigms. The operator must be able to:

• Fully understand the system's capacities and limitations
• Remain aware of automation bias
• Correctly interpret the system's output
• Decide to disregard, override, or reverse the output
• Intervene or stop the system via a 'kill switch'

The deployer bears strict responsibility for ensuring that the input data fed into the high-risk AI system is relevant and sufficiently representative for its intended purpose. This is a critical distinction from provider obligations. If a deployer feeds biased or irrelevant data into a compliant model, the deployer is liable for the resulting harm. This requires rigorous data governance at the point of use, including checks for distribution drift and data quality anomalies.

Deployers are legally obligated to monitor the operation of the high-risk AI system based on the instructions of use. If the deployer identifies or has reason to believe that the system presents a serious incident—defined as any malfunction or failure leading to death or serious damage to health or property—they must immediately notify the provider and the relevant market surveillance authority. This triggers a mandatory investigation and potential recall.

Deployers must retain the automatically generated logs of the high-risk AI system for a period appropriate to the system's intended purpose, at minimum six months unless otherwise specified in applicable EU or national law. These logs must capture:

• The period of each use
• The reference database against which input data has been checked
• The input data that led to a match
• The natural persons involved in verification

Deployers of emotion recognition systems or biometric categorization systems must inform the exposed natural persons of the operation of the system. For systems making consequential decisions—those producing legal effects or similarly significant impacts—the deployer must provide a meaningful explanation of the role of the AI in the decision-making procedure and the principal parameters of the decision taken. This operationalizes the right to explanation.

A mandatory, documented process deployers must complete before putting a high-risk AI system into use. It evaluates the specific risks to the rights and freedoms of individuals likely to be affected.

• Must include a detailed description of the deployer's processes, the system's intended purpose, and the categories of natural persons affected.
• Requires an analysis of the specific risks of harm to fundamental rights (e.g., non-discrimination, data protection, human dignity).
• Deployers must describe the human oversight measures and the actions taken to mitigate identified risks.
• The completed assessment must be notified to the relevant market surveillance authority.

Deployers must ensure that natural persons assigned to oversee a high-risk AI system have the necessary competence, training, and authority to intervene effectively.

• Oversight is not a passive monitoring role; it requires the capacity to override, ignore, or reverse the system's output.
• Deployers must guard against automation bias, where operators become over-reliant on the system's recommendations.
• The oversight mechanism must be designed to allow a human to fully understand the system's capacities and limitations and remain aware of any tendency to automatically rely on the output.
• This directly operationalizes the concept of Meaningful Human Intervention.

Deployers are legally obligated to ensure that the input data fed into a high-risk AI system is relevant and sufficiently representative for its intended purpose.

• This obligation shifts a portion of data governance responsibility from the provider to the professional user during the operational phase.
• Deployers must prevent data drift and ensure inputs do not introduce new biases or degrade the model's performance.
• This is a critical control point, as a system compliant at the time of CE Marking can become non-compliant if fed with poor-quality operational data.
• The obligation aligns with the broader Data Governance Criteria required for high-risk systems.

Deployers must monitor the operation of the high-risk AI system and immediately report any serious incident or malfunction to the provider and the market surveillance authority.

• A serious incident is defined as any event that directly or indirectly leads to death, serious damage to health, or serious and irreversible damage to property.
• Deployers must keep logs automatically generated by the system for a period appropriate to the system's intended purpose, at least six months unless otherwise specified.
• This duty creates a continuous feedback loop, feeding into the provider's Post-Market Monitoring obligations.
• Failure to report constitutes a direct breach of the Act.

Deployers must retain logs automatically generated by the high-risk AI system to ensure an adequate level of traceability of the system's functioning.

• These logs are essential for auditing, post-incident investigation, and fulfilling Data Subject Rights requests, including the right to explanation.
• The retention period is defined by law or the system's intended purpose, with a statutory minimum of six months.
• This obligation ensures that the AI Audit Trail is maintained not just by the provider but also by the entity operating the system in a live environment.
• Log integrity is crucial for demonstrating compliance during inspections by Market Surveillance Authorities.

Deployers are legally compelled to cooperate fully with national competent authorities, including Market Surveillance Authorities, upon any reasoned request.

• Cooperation includes providing access to logs, documentation, and operational data to demonstrate ongoing compliance.
• Deployers must take immediate corrective action if they determine a system is not in conformity with the Act, and inform the provider and distributor.
• This duty transforms the deployer from a passive user into an active participant in the Continuous Compliance Monitoring ecosystem.
• Non-cooperation can trigger enforcement actions, including fines and restrictions on the system's use.