# EU AI Act Article 26: give every obligation an owner > Use an Article 26 deployer checklist for high-risk AI, with applicability gates, evidence questions, accountable roles and synthetic examples. Canonical: https://synainesi.com/resources/article-26-deployer-checklist/ Category: [Resources](https://synainesi.com/resources/) / Regulated work A checklist earns its place when it changes a decision. For a small regulated firm, the useful question is not whether someone has ticked “human oversight”. It is whether the right person can explain the system’s limits, intervene in the actual workflow and show the evidence behind the decision. Use this worksheet to connect an obligation to a named owner and an unresolved issue that somebody can act on. ## Gate one: establish the right scope [Article 26](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26) concerns deployers of high-risk AI systems. It is not a universal checklist for every chatbot. Record your classification reasoning, role, system purpose and applicable timing before assigning its obligations. Check the current [Article 113 application provisions](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113); this worksheet does not state a universal start date. Ask the reviewer to write a short applicability memo before filling the detailed worksheet. Identify the actual system configuration, what the organisation does with its output and the decisions it influences. Attach the provider’s description and record any mismatch with actual use. “It is only an assistant” is a label, not an assessment. Equally, “we are regulated” does not explain the classification of a particular AI system. Escalate uncertainty rather than converting a tentative answer into a green tick. ## A compact map of the legal text The [Commission’s operative Article 26 text, paragraphs 1–12](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26), addresses use according to instructions; capable, authorised human oversight; input suitability where controlled; monitoring, suspension and notification; controlled logs; workplace information; public-body registration; applicable impact assessments; specialised biometric use; information to affected people; and authority cooperation. Each has its own scope. Paragraphs 5–6 contain financial-sector qualifications for monitoring and log documentation. They do not waive the whole article. For controlled automatic logs, paragraph 6 specifies purpose-appropriate retention of at least six months, unless applicable Union or national law provides otherwise, particularly personal-data law. Workplace information under paragraph 7 and information under paragraph 11 have different triggers. Read the relevant paragraph before marking it applicable. ## Copy this obligation-to-evidence worksheet The following are suggested implementation questions, not additional legal duties. Create one row per applicable paragraph. Give each row an owner, an evidence reference, an open action, a decision maker and a review trigger. Use the statuses “evidence reviewed”, “gap”, “not assessed” and “not applicable with reasons”. A status should describe the file’s condition, not promise that a system is safe. - **Instructions and use, paragraph 1:** Can the workflow owner show which instructions apply to this configuration? Compare a real task description with the documented purpose. Record unsupported uses separately instead of allowing them through an ambiguous approval. - **Human oversight, paragraphs 2–3:** Who can intervene, and where? Ask the overseer to demonstrate stopping, rejecting and escalating in a synthetic scenario. Record absence cover, available time and missing information in the review screen. - **Input data, paragraph 4:** Which inputs can the organisation actually control? Ask the data owner to show a sample selection method, relevant exclusions and known blind spots. Avoid claiming that a tidy sample represents every future case. - **Monitoring and escalation, paragraph 5:** Who receives an alert and decides what happens next? Rehearse an inaccurate-output scenario and a loss-of-service scenario separately. Link the decision tree to named roles and checked contact routes. - **Logs, paragraph 6:** Which automatic records are accessible to the firm? Ask the records owner to demonstrate retrieval for a synthetic event and explain gaps, access controls and the retention decision. Distinguish provider-held records from records under your control. - **Workplace information, paragraph 7:** Ask the people lead and legal reviewer whether this scenario triggers the paragraph, then record the reasoning, intended audience, communication owner and evidence location. - **Registration, paragraph 8:** Ask the legal reviewer whether the deployer’s identity brings this paragraph into scope. Do not copy a public-body obligation into every private firm’s checklist without an applicability explanation. - **Impact assessment, paragraph 9:** Ask the data protection lead what assessment work is applicable and which provider information is missing. Link the assessment reference rather than reproducing sensitive content inside the checklist. - **Specialised biometric use, paragraph 10:** Refer any such use to specialist review. This worksheet is not a biometric authorisation procedure. Record why the row is outside scope where that is the assessed position. - **Affected people and authorities, paragraphs 11–12:** Identify the relevant communication and cooperation processes. Ask who can retrieve the file, explain the workflow and correct a misleading account of what the system did. ## Completed synthetic example: an unresolved oversight gap **Fully synthetic example. No real firm, person or deployment is described.** File DEP-EX-A assumes, solely for the exercise, that the firm’s legal reviewer has documented a high-risk classification and relevant timing. That assumed classification is not advice about any real workflow. The system assists with a consequential internal assessment. The worksheet owner is the risk lead; the operational owner is the team supervisor. The paragraph 2 row reads: “Gap. Supervisor can refuse an output but cannot see the source passage that drove it.” Evidence reference EX-SCREEN-A contains a synthetic screen description. The open action is to provide the missing source view and repeat the intervention exercise. The decision maker is the authorised business owner, with security and legal input. The working restriction is no permission for this consequential task until the gap is resolved. A signature on the checklist would not repair the screen. The paragraph 6 row reads: “Not assessed. Export includes event identifiers but the relationship to system-generated logs is unclear.” The records owner must obtain a sample export, identify which records are under the firm’s control and document the retention basis. An event count alone would not resolve that question. The synthetic file deliberately leaves this row open to show what an honest unfinished assessment looks like. ## Reuse existing governance without hiding the gaps A small firm can reference an existing incident procedure, records schedule or oversight committee. The useful test is whether that existing process actually covers this system and task. Add a precise section reference and an owner who accepts the responsibility. “Covered by policy” without a location or explanation creates work for the next reviewer and can conceal an unanswered question. Close the worksheet with a decision note: what is permitted; what remains restricted; which evidence was examined; which assumptions could invalidate the decision; and who must review a material change. Preserve disagreements and missing evidence. A concise file with visible limits is more useful than a large collection of documents whose relevance nobody has explained. Related: [Article 4 literacy evidence](https://synainesi.com/resources/ai-literacy-article-4/), [a worked AI decision file](https://synainesi.com/resources/worked-ai-decision-file/), [DORA service questions](https://synainesi.com/resources/dora-ai-third-party-risk/), [Evidence without surveillance](https://synainesi.com/insights/evidence-without-surveillance/) and [regulated-work questions](https://synainesi.com/solutions/). Our vision for Synainesi puts accountable human decisions at the heart of AI governance. General information, not legal advice. This worksheet does not replace classification, timing or legal analysis for a particular system and organisation. --- Synainesi: AI within your rules. Source: https://synainesi.com/resources/article-26-deployer-checklist/. The HTML page is canonical; this Markdown version is provided as a convenience.