Is a company a provider or a deployer under the EU AI Act?

A company that develops an AI system, or has one developed and puts it on the market under its own name, is a provider under Article 3(3) of the EU AI Act. A company that uses an AI system under its own authority in its business is a deployer under Article 3(4). A deployer becomes a provider under Article 25(1) if it puts its own name on a high-risk system, substantially modifies it, or changes its purpose so that it becomes high-risk.

When do a deployer's obligations under the EU AI Act apply?

The AI literacy duty in Article 4 has applied since 2 February 2025, when Article 113 brought Chapters I and II into application. The transparency obligations in Article 50 apply from 2 August 2026. Regulation (EU) 2026/1744 moved the high-risk obligations, including Article 26 and the Article 27 impact assessment, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Under Article 111(2), a high-risk system placed on the market or put into service before its date is covered only if its design changes significantly from then on, except systems intended for public authorities, which must comply by 2 August 2030.

How long must a deployer keep the logs of a high-risk AI system?

Article 26(6) of the EU AI Act requires a deployer of a high-risk AI system to keep the logs the system generates automatically, to the extent they are under the deployer's control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless other Union or national law sets a different period.

Does every deployer need a fundamental rights impact assessment?

Only some deployers need a fundamental rights impact assessment under the EU AI Act. Article 27(1) applies to deployers that are bodies governed by public law or private entities providing public services, and to deployers of the credit scoring and life and health insurance systems listed in points 5(b) and 5(c) of Annex III. It excludes the critical infrastructure systems in point 2 of Annex III, and other deployers of high-risk systems are not required to carry one out.

Does holding the EU AI Act documents mean a company meets the Act?

Holding the documents the EU AI Act describes is not the same as meeting the Act. The documents record what the Act asks a deployer to do and who does it. Whether a system is high-risk, whether the obligations apply and whether they are met in practice depend on the system and how it is used, which a document records but cannot settle on its own.

What documents does the EU AI Act require from a deployer of AI?

Written by PolicyDrafters. Published 4 October 2026, updated 8 November 2026.

Every EU AI Act deployer needs a record of its Article 4 AI literacy measures; some need Article 50 notices. Deployers of Annex III high-risk systems add, from 2 December 2027, Article 26 procedures for use, human oversight and monitoring, logs kept at least six months, notices to workers and affected people and sometimes an Article 27 impact assessment.

Is your business a provider or a deployer?

Regulation (EU) 2024/1689, the EU AI Act, divides most of its obligations between two roles, and the documents you need depend on which one you are. A deployer is a natural or legal person, public authority, agency or other body that uses an AI system under its own authority, except where the use is personal and non-professional, under Article 3(4). A provider is the person or body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, under Article 3(3) [1].

Most small and medium-sized businesses are deployers: they subscribe to a recruitment screening tool, a credit decisioning service or a customer service assistant and use it in their own operations. The heavy documentation in Chapter III Section 2, from the risk management system in Article 9 to the technical documentation in Article 11 and Annex IV, sits with the provider. The deployer's obligations are about use, oversight and records.

Article 25(1) is the exception to watch. A deployer takes on the provider's obligations for a high-risk system if it puts its own name on it, substantially modifies it, or changes the purpose of a system so that it becomes high-risk [2].

What does every deployer need under Article 4?

Article 4 applies to providers and deployers of any AI system, not only high-risk ones. Under Article 3(56), AI literacy is the skills, knowledge and understanding that let providers, deployers and affected persons make an informed deployment of AI systems. It also covers being aware of the opportunities and risks of AI and the harm it can cause.

Regulation (EU) 2026/1744 replaced Article 4 from 27 July 2026. Article 4(1) requires providers and deployers to take measures to support the development of AI literacy among their staff and the other people who operate and use AI systems on their behalf. The measures must take into account the training and experience of those people, the context of use and the people on whom the systems are used [3]. The amended text adds that the duty does not require them to secure any specific level of literacy in any individual. Article 4(2) has the Commission publish practical examples of how to meet it.

The Act does not prescribe a document, but an obligation to take measures is proved by a record of them: an AI literacy section in the AI governance policy, stating which roles use which systems and what training each receives, and a training record. Under Article 113 this duty has applied since 2 February 2025, so it is the first document a deployer is asked for.

Which transparency notices does Article 50 require?

Three of the transparency obligations in Article 50 of the EU AI Act fall on deployers.

Under Article 50(3), a deployer of an emotion recognition or biometric categorisation system must inform the natural persons exposed to it that the system is operating.
Under Article 50(4), a deployer of a system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content is artificially generated or manipulated. A narrower disclosure applies to evidently artistic or satirical content.
Also under Article 50(4), a deployer that publishes AI-generated text to inform the public on matters of public interest must disclose that the text is artificially generated or manipulated. This does not apply where the text has been through human review or editorial control and a person holds editorial responsibility for it.

Article 50(5) requires the information to be given clearly and distinguishably, at the latest at the first interaction or exposure [4].

The documents are notices: the wording shown before an emotion recognition or categorisation system runs, the label on generated media, and the disclosure line on published text. They belong in the AI use policy, so that the people publishing content know when a label is required.

What does Article 26 require when a system is high-risk?

Article 26 is the centre of a deployer's documentation when a system is high-risk, which for most businesses means a system listed in Annex III: recruitment and selection, promotion and termination decisions and worker monitoring under point 4, credit scoring under point 5(b), and risk assessment and pricing for life and health insurance under point 5(c), among others. Each paragraph of Article 26 implies a document [5].

Article 26(1) requires the deployer to take appropriate technical and organisational measures to ensure the system is used in accordance with the provider's instructions for use. The document is a use procedure that restates the provider's instructions in the deployer's own operating terms and records the measures taken.

Article 26(2) requires human oversight to be assigned to natural persons who have the necessary competence, training, authority and support. The document is a human oversight procedure that names the overseers by role, states what they may do, including stopping the system or overriding an output, and records their training. Article 26(3) preserves the deployer's freedom to organise its own resources, so the procedure can fit the business.

Article 26(4) requires that, to the extent the deployer exercises control over the input data, the data is relevant and sufficiently representative in view of the intended purpose. The document is an input data check: a record of which inputs the deployer controls and how their relevance has been assessed.

Article 26(5) requires the deployer to monitor the operation of the system on the basis of the instructions for use and, where relevant, to inform the provider under Article 72. Where the deployer has reason to consider that use may present a risk within Article 79(1), it informs the provider or distributor and the market surveillance authority without undue delay and suspends use; where it identifies a serious incident, it immediately informs first the provider, then the importer or distributor and the relevant market surveillance authorities. The document is a monitoring and incident procedure with the contact routes and the clock written in.

Article 26(6) requires the deployer to keep the logs automatically generated by the system, to the extent they are under its control, for a period appropriate to the intended purpose and for at least six months, unless other Union or national law provides otherwise. The document is a log retention line in the data retention schedule.

Article 26(7) requires a deployer that is an employer, before putting a high-risk system into service or using it at the workplace, to inform the workers' representatives and the affected workers that they will be subject to the system. The document is the notice to workers, with a record of when it was given.

Article 26(9) requires the deployer, where applicable, to use the information the provider supplies under Article 13 to carry out a data protection impact assessment under Article 35 of the GDPR [6]. The document is the DPIA itself, which belongs with the privacy documentation a privacy policy pack supplies.

Article 26(11) requires a deployer of an Annex III system that makes or assists decisions about natural persons to inform those persons that they are subject to it.

Article 86 gives a person subject to a decision taken on the basis of the output of an Annex III system, other than the critical infrastructure systems in point 2 of that Annex, a right to an explanation where the decision produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights. That person may obtain from the deployer a clear and meaningful explanation of the system's role in the decision and the main elements of the decision [7].

The documents are the notice to affected persons and an explanation template for the staff who answer those requests.

Which logs does a deployer keep under Article 12?

Article 12 is a provider obligation. It requires a high-risk AI system to allow the automatic recording of events over its lifetime, so that risks can be identified, post-market monitoring under Article 72 is supported and the deployer's own monitoring under Article 26(5) is possible [8]. The deployer does not design the logging, but Article 26(6) makes it the keeper of the logs under its control, so the system inventory should record where each system's logs are held and who can reach them.

Who needs a fundamental rights impact assessment under Article 27?

Article 27 requires some deployers, before putting a high-risk system referred to in Article 6(2) into use, to assess the impact its use may have on fundamental rights. It applies to bodies governed by public law, private entities providing public services, and deployers of the systems in points 5(b) and 5(c) of Annex III: credit scoring, and risk assessment and pricing for life and health insurance. Systems for the critical infrastructure area in point 2 of Annex III are excluded, and a deployer outside the categories the Article names is not required to carry one out [9].

A fundamental rights impact assessment under Article 27(1) of the EU AI Act has six parts:

The deployer's processes in which the system will be used.
The period and frequency of use.
The categories of natural persons and groups likely to be affected.
The specific risks of harm to those categories, taking account of the information the provider gives under Article 13.
How the human oversight measures are implemented.
The measures to be taken if the risks materialise, including internal governance and complaint arrangements.

Article 27(2) applies the duty to the first use and requires an update when any of those elements changes. Article 27(3) requires the deployer to notify the market surveillance authority of the results. It does so using the questionnaire template the AI Office is to develop under Article 27(5). Article 27(4), as amended in 2026, lets the deployer cross-refer to, or include, the relevant parts of a data protection impact assessment carried out under Article 35 of the GDPR.

When do the obligations apply under Article 113?

The Regulation was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. Article 113, as first enacted, applied it in stages [10]:

From 2 February 2025: Chapters I and II, which contain the definitions, the AI literacy duty in Article 4 and the prohibited practices in Article 5.
From 2 August 2025: Chapter III Section 4 on notifying authorities and notified bodies, Chapter V on general-purpose AI models, Chapter VII on governance and Chapter XII on penalties, except Article 101.
From 2 August 2026: the rest, including Article 50.
From 2 August 2027: Article 6(1) and the obligations that follow from it.

The timetable for high-risk systems was then changed. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

It amends Article 113 for Sections 1, 2 and 3 of Chapter III, which carry the high-risk requirements and the provider and deployer obligations in Articles 26 and 27. These now apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III. They apply from 2 August 2028 for systems classified as high-risk under Article 6(1) and Annex I [11].

Article 50 keeps its date of 2 August 2026. A new Article 111(4) gives providers of generative systems already on the market until 2 December 2026 to apply the marking in Article 50(2). The two prohibitions the amendment adds to Article 5 also apply from 2 December 2026.

Article 111(2), as amended, sets the rule for systems already in use. A high-risk system placed on the market or put into service before its Chapter III date is covered only if its design changes significantly from that date. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 in any case [12].

For an Annex III system, the Article 26 and 27 documents are therefore due from 2 December 2027, subject to that rule. The literacy and transparency documents are already due. The maintenance plan tracks the text as amended, so the dates in these documents move when the Regulation does.

Which document answers which article?

Scroll sideways for the other columns

Document	Article	Who needs it
AI literacy measures and training record	Article 4	Every deployer, from 2 February 2025
Transparency notices and labels	Article 50(3) to 50(5)	Deployers of emotion recognition, biometric categorisation, deep fakes and public AI text, from 2 August 2026
Use procedure with the provider's instructions filed	Article 26(1)	Deployers of high-risk systems
Human oversight procedure and overseer training record	Article 26(2) and 26(3)	Deployers of high-risk systems
Input data check	Article 26(4)	Deployers of high-risk systems that control input data
Monitoring and incident procedure	Article 26(5)	Deployers of high-risk systems
Log retention statement and inventory entry	Articles 26(6) and 12	Deployers of high-risk systems
Notice to workers' representatives and workers	Article 26(7)	Deployers that are employers using high-risk systems at work
Data protection impact assessment	Article 26(9)	Deployers where GDPR Article 35 applies
Notice to affected persons and explanation template	Articles 26(11) and 86	Deployers of Annex III systems deciding about natural persons
Fundamental rights impact assessment	Article 27	Public bodies, public service providers, credit scoring and insurance deployers

How does an AI governance suite cover them?

An AI governance suite drafts the deployer's documents as one set:

The governance policy carries the Article 4 literacy section and the Article 50 notice rules.
The human oversight procedure carries Article 26(2).
The incident and complaint procedure carries Article 26(5) and the Article 86 explanation route.
The system inventory carries the Article 12 and 26(6) log entries.
The risk management procedure carries the Article 27 points or the risk register.

The same documents are drafted against the NIST AI Risk Management Framework, AI RMF 1.0 [13], and ISO/IEC 42001:2023 [14]. A SaaS company selling into both markets therefore keeps one set.

Each document is reviewed by our legal team before delivery. Under the maintenance plan, it is revised with the changes marked when the Act moves. The suite records the classification you make for each system and the reasons for it. It does not decide the classification for you.

Questions

Is a company a provider or a deployer under the EU AI Act?: A company that develops an AI system, or has one developed and puts it on the market under its own name, is a provider under Article 3(3) of the EU AI Act. A company that uses an AI system under its own authority in its business is a deployer under Article 3(4). A deployer becomes a provider under Article 25(1) if it puts its own name on a high-risk system, substantially modifies it, or changes its purpose so that it becomes high-risk.
When do a deployer's obligations under the EU AI Act apply?: The AI literacy duty in Article 4 has applied since 2 February 2025, when Article 113 brought Chapters I and II into application. The transparency obligations in Article 50 apply from 2 August 2026. Regulation (EU) 2026/1744 moved the high-risk obligations, including Article 26 and the Article 27 impact assessment, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Under Article 111(2), a high-risk system placed on the market or put into service before its date is covered only if its design changes significantly from then on, except systems intended for public authorities, which must comply by 2 August 2030.
How long must a deployer keep the logs of a high-risk AI system?: Article 26(6) of the EU AI Act requires a deployer of a high-risk AI system to keep the logs the system generates automatically, to the extent they are under the deployer's control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless other Union or national law sets a different period.
Does every deployer need a fundamental rights impact assessment?: Only some deployers need a fundamental rights impact assessment under the EU AI Act. Article 27(1) applies to deployers that are bodies governed by public law or private entities providing public services, and to deployers of the credit scoring and life and health insurance systems listed in points 5(b) and 5(c) of Annex III. It excludes the critical infrastructure systems in point 2 of Annex III, and other deployers of high-risk systems are not required to carry one out.
Does holding the EU AI Act documents mean a company meets the Act?: Holding the documents the EU AI Act describes is not the same as meeting the Act. The documents record what the Act asks a deployer to do and who does it. Whether a system is high-risk, whether the obligations apply and whether they are met in practice depend on the system and how it is used, which a document records but cannot settle on its own.

Sources

Regulation (EU) 2024/1689, Article 3(3) and 3(4)eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 25(1)eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 4, as amended by Regulation (EU) 2026/1744 (consolidated text of 27 July 2026)eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 50(3) to 50(5)eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 26eur-lex.europa.eu
Regulation (EU) 2016/679 (GDPR), Article 35eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 86(1)eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 12eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 27, as amended by Regulation (EU) 2026/1744 (consolidated text of 27 July 2026)eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 113, as first enactedeur-lex.europa.eu
Regulation (EU) 2026/1744 (Digital Omnibus on AI), 8 July 2026eur-lex.europa.eu
Regulation (EU) 2024/1689, Article 111, as amended by Regulation (EU) 2026/1744 (consolidated text of 27 July 2026)eur-lex.europa.eu
NIST AI Risk Management Framework (AI RMF 1.0)nist.gov
ISO/IEC 42001:2023, AI management systemsiso.org

The documents this guide is about

Applies to

SaaS and technology

AI governance suite
An AI governance documentation suite is the set of policies, procedures and record templates that sets out how an organisation approves, risk-assesses, oversees and monitors the AI systems it builds or uses, and keeps the evidence of each step in the form the EU AI Act, the NIST AI RMF and ISO/IEC 42001 describe.
$3,000 to $5,000
20 working days
Privacy policy pack
A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023.
$1,200 to $2,500
10 working days