Deployer
A deployer uses an AI system under its own authority in a professional activity — for example a company running an AI hiring tool it did not build. Deployers of high-risk AI have duties under Article 26.
Article 26 sets the deployer's duties for high-risk systems: use the system in accordance with the provider's instructions, assign human oversight to natural persons with the necessary competence, training and authority, ensure input data is relevant and sufficiently representative where the deployer controls it, monitor operation and suspend use where a risk emerges, keep the automatically generated logs, inform workers' representatives and affected workers before putting the system into use at the workplace, and inform individuals subject to decisions the system helps make. Certain deployers must also complete a Fundamental Rights Impact Assessment under Article 27.
- Art. 3(4)
- Art. 26
- Art. 27
- Art. 86
Deployer: why it matters
Deployer is the role that catches ordinary businesses — a hospital, a bank, a city council — that never intended to be an AI company. Its duties cannot be outsourced back to the vendor by contract, because they are about how the system is used inside your organisation. The obligation to inform workers before a system is used on them is the one that most often collides with an existing rollout plan, and the obligation to assign competent oversight staff with real authority to override is the one that most often reveals that the deployment was designed to remove humans rather than support them.
Deployer in practice
A hospital deploys a triage-support system it bought from a vendor. The vendor's conformity file is irrelevant to the hospital's own duties: it must name the clinicians responsible for oversight and train them, log system output for the retention period, verify that the patient data it feeds in matches the intended purpose, stop use and tell the provider if it sees the system underperforming on a patient group, and — as a public body providing an essential service — complete a FRIA before first use.
Deployer: the mistake people make
Assuming the vendor's compliance covers you. Provider and deployer duties are separate and cumulative; a perfectly CE-marked, fully documented high-risk system deployed without human oversight, without log retention and without informing affected workers is a deployer breach even though the product itself is compliant.
Deployer: common questions
- Are we a deployer if we just use ChatGPT at work?
- You are a deployer of that AI system in a professional capacity, but deployer obligations under Article 26 attach to high-risk systems. General productivity use carries the Article 4 AI-literacy duty and any Article 50 transparency duties, not the Article 26 list.
- Do deployers have to tell employees about AI use?
- Yes, for high-risk systems used at work. Before putting the system into service, deployers must inform workers' representatives and the affected workers that they will be subject to it, alongside any obligations under national and EU labour law.
- Which deployers must run a FRIA?
- Bodies governed by public law, private entities providing public services, and deployers of Annex III systems used for creditworthiness assessment or for risk assessment and pricing in life and health insurance.
Deployer: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.