High-risk AI: obligations for employers using it
Article 26 of the AI Act defines the obligations of professional users of high-risk AI. Prepare human oversight, information for affected people and traceability in line with the revised timeline.
An employer using the system must follow the provider's instructions, appoint competent people with the necessary authority to oversee the tool, and monitor its operation. Where the employer controls the input data, that data must be relevant and sufficiently representative. Article 26 requires logs under its control to be kept for an appropriate period of at least six months, unless another applicable rule provides otherwise.
Inform workers' representatives and affected workers before using the system at work; also inform people subject to a decision assisted by an Annex III system. Put alert procedures in place and carry out a GDPR impact assessment where required. For Annex III recruitment tools, high-risk obligations are postponed until 2 December 2027 under the timeline presented in eu-ia-calendrier-omnibus-2026.