AI Act Deployer Obligations Explained
CyberRank Research
A deployer under the EU AI Act is any organisation that uses an AI system under its own authority, for example a company using a vendor's AI tool to screen job applicants. Deployers of high-risk AI have their own duties: use the system as instructed, assign human oversight, monitor it, keep logs and inform the people affected. CyberRank's AI-use signal (Beta) shows which of your vendors use AI, so you can see where you may be a deployer.
TL;DR
- If you use a vendor's AI system under your own authority, you are its deployer under the AI Act.
- Deployers of high-risk AI must follow the instructions for use, assign human oversight, monitor, keep logs and inform workers and affected people.
- After the 2026 Digital Omnibus, these duties apply to Annex III high-risk systems from 2 December 2027.
- CyberRank's AI-use signal (Beta) shows which vendors use AI and gives a candidate risk level for your team to confirm.
Who is a deployer?
Any organisation that uses an AI system under its own authority in a professional context, whether it built the system or bought it.
Most companies are deployers rather than providers, because they use AI inside software they buy. If you put your own name on a vendor's high-risk system or substantially modify it, you can become its provider instead, with heavier duties. The roles are compared in our article about the EU AI Act and your vendors.
What must a deployer of high-risk AI do?
Use the system as the provider instructs and make sure people, logs and information are in place around it.
Where the AI makes decisions about people using personal data, data protection rules also apply, including Indonesia's UU PDP for Indonesian data subjects.
- Use the system according to the provider's instructions for use.
- Assign human oversight to people with the competence and authority to act.
- Make sure input data under your control is relevant to the intended purpose.
- Monitor operation and report serious incidents and risks to the provider and authorities.
- Keep the automatically generated logs under your control for an appropriate period.
- Inform workers and affected people that a high-risk system is used; some deployers also run a fundamental rights impact assessment.
When do deployer obligations apply?
For Annex III high-risk systems, from 2 December 2027 after the 2026 Digital Omnibus; for AI in products covered by Annex I EU product law, from 2 August 2028.
AI literacy duties under Article 4 have applied since 2 February 2025 to providers and deployers alike. Confirm dates for a specific system against the consolidated text with your legal team.
How CyberRank helps
CyberRank's AI-use signal (Beta) detects AI use from public evidence, gives a candidate AI Act level and Annex III area, and lets your team confirm it. That gives you the list of vendors where you may be a deployer. CyberRank does not make a legal classification or decide whether you comply; your legal team does.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating