High-Risk AI System Deployer

Deployer obligation measurement

Deployment documentation measured against the EU AI Act's deployer-specific requirements under Articles 26 and 27.

This form collects the information required under Articles 26 and 27 of the EU AI Act for deployers of high-risk AI systems. Fields reference the specific paragraph of Article 26 or 27 that imposes each obligation. Deployer obligations are distinct from provider obligations: they apply to any natural or legal person that puts a high-risk AI system into service or use under their own responsibility. Complete all required fields before submission. Provectio will measure your documentation against the applicable requirements and return a governed receipt with findings and integrity hashes.

Provectio measures documentation. It does not advise.

* Required field

01 Deployer Information ▲

Company name *

Registered address

Contact person *

Contact email *

Sector *

Sector — specify

Public body or acting on behalf of a public body Art. 26(9a)

Yes No

Article 26(9a) imposes an obligation to carry out a fundamental rights impact assessment on public bodies and on private deployers in certain sectors. This selection determines whether Section 7 is applicable.

02 AI System Identification Art. 26(1) ▲

AI system name *

Version

Provider name *

Annex III category * Annex III

Risk classification received from provider Art. 26(1)

Article 26(1) requires deployers to use the system in accordance with the instructions of use provided by the provider. The provider's risk classification informs those instructions.

CE marking received from provider Art. 48–49

Yes No Unknown

Date first put into service Art. 26(9a)

Article 26(9a) requires certain impact assessments to be completed before first deployment.

Member States of deployment

03 Instructions of Use Art. 26(1) ▼

Instructions of use received from provider Art. 26(1)

Yes No Partial

Article 26(1) requires deployers to use the system only in accordance with the instructions of use provided by the provider.

Reference or description of instructions of use received

System used within its intended purpose as defined by the provider Art. 26(1)

Yes No — deviations documented below

Deviations from intended purpose — describe Art. 26(1)

Modifications made to the system Art. 26(1)

None Configuration only Substantial modifications

Substantial modifications may reclassify the deployer as a provider under Article 25.

Modifications — describe

04 Human Oversight Art. 26(2) ▼

Persons assigned to human oversight Art. 26(2)

Article 26(2) requires deployers to assign the task of human oversight to natural persons with necessary competence, training, and authority.

Competence and training of oversight persons Art. 26(2)

Oversight persons have authority to override or halt the system Art. 26(2)

Yes No Partial — describe below

Override and halt procedures — describe Art. 26(2)

05 Input Data Management Art. 26(4) ▼

Description of input data used in operation Art. 26(4)

Article 26(4) requires deployers to ensure that input data is relevant and sufficiently representative for the intended purpose.

Data relevance assessment Art. 26(4)

Data representativeness assessment Art. 26(4)

Bias monitoring procedures Art. 26(4)

06 Monitoring and Incident Reporting Art. 26(5)–(6) ▼

Operational monitoring procedures Art. 26(5)

Article 26(5) requires deployers to monitor the operation of the AI system on the basis of instructions of use and to inform the provider or distributor of any serious incidents identified.

Serious incident reporting to provider or distributor Art. 26(5)

Log retention policy Art. 26(6)

Article 26(6) requires deployers to keep logs automatically generated by the system for a minimum period of six months, subject to applicable Union or national law.

Log retention period Art. 26(6)

Log storage system or platform Art. 26(6)

Data protection impact assessment completed Art. 26(9)

Yes No In progress Not required

Article 26(9) requires deployers to carry out a data protection impact assessment in accordance with Regulation (EU) 2016/679 (GDPR) where required under that regulation.

07 Fundamental Rights Impact Assessment Art. 27 ▼

This section applies to public bodies and to private deployers operating in credit, life and health insurance, human resources and recruitment, migration and asylum, law enforcement, or administration of justice and judiciary. It has been shown based on your responses to Section 1.

Fundamental rights impact assessment status Art. 27(1)

Article 27(1) requires the assessment to be completed before the first deployment of the system.

Date of assessment (or planned date) Art. 27(1)

Description of processes in which the system is used Art. 27(2)(a)

Timeframe of deployment Art. 27(2)(a)

Categories of natural persons affected Art. 27(2)(b)

Specific risks to fundamental rights Art. 27(2)(c)

Human oversight measures to address identified risks Art. 27(2)(d)

Measures if identified risks materialise Art. 27(2)(e)

Governance and complaints procedures Art. 27(2)(f)

Competent market surveillance authority notified Art. 27(3)

Yes No Not required

Article 27(3) requires deployers to register in the EU database referred to in Article 71 and to notify the relevant market surveillance authority of the FRIA before putting the system into service in certain cases.

08 Transparency to Affected Persons Art. 26(11) ▼

Natural persons informed that they are subject to the AI system Art. 26(11)

Yes No Not applicable — not a public body

Article 26(11) requires deployers that are public bodies or act on behalf of a public body to inform natural persons that they are subject to the high-risk AI system.

Method of informing affected persons Art. 26(11)

Content of the notice given to affected persons Art. 26(11)

09 Document Upload ▼

Instructions of use from provider Art. 26(1)

Upload the instructions of use received from the provider. Accepted formats: PDF, Markdown, plain text, DOCX.

Human oversight policy or procedure document Art. 26(2)

Upload your internal policy or procedure document governing human oversight of the deployed system.

Data protection impact assessment Art. 26(9)

Upload the completed DPIA, if applicable and available.

Fundamental rights impact assessment Art. 27

Upload the completed FRIA document, if applicable.

Additional supporting documents

Optional. Further documentation relevant to Articles 26–27 coverage (e.g. incident log samples, training records, monitoring reports). Multiple files accepted.

10 Attestation ▲

The information provided is accurate to the best of my knowledge, and I am authorised to submit this documentation on behalf of the deployer named above.

I understand that Provectio measures documentation against the EU AI Act. It does not advise.

I acknowledge the deployer's obligation to cooperate with competent authorities on request under Article 26(12).

Submission is currently opened through guided onboarding rather than public self-service registration.

One or more required fields are incomplete. Review the form and ensure all required fields are filled before resubmitting.