Knowledge base · AI in HR

What duties do we have from December 2027 as a deployer of a high-risk HR system?

You use the system in accordance with the instructions for use and monitor it, assign human oversight to competent and authorised people, ensure that the input data you control is relevant and representative, keep the logs for at least six months and inform employees and the people the system decides about. These duties of Article 26 apply from 2 December 2027.

Prepare; applies from 2 December 2027Trusq editorial · checked against the official textLast verified: 6 November 2026

Next step: Record your HR AI tools in Trusq

Use and monitoring

You take appropriate technical and organisational measures to use the system in accordance with the instructions for use ^[1]. You monitor its operation; if use in accordance with the instructions may present a risk, you inform the provider or distributor and the market surveillance authority and suspend the use. If you identify a serious incident, you immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities ^[2].

Human oversight and input data

You assign human oversight to people with the necessary competence, training and authority, and give them the necessary support ^[3]. If you control the input data, for example the job requirements or the candidate data you enter, you ensure that it is relevant and sufficiently representative for the purpose ^[4].

Keeping logs

You keep the automatically generated logs under your control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise ^[5].

Informing and explaining

As an employer you inform the workers' representatives and the workers concerned in advance ^[6]. You inform the persons about whom the system takes or helps to take decisions, such as applicants ^[7]. Anyone affected by a decision based on the output can ask for clear and meaningful explanations ^[8]; that right is in Article 86, not in Article 26 (see below). For a DPIA you use the information that the provider supplies ^[9].

From when

The duties of Article 26 are in Chapter III, Section 3, and apply to Annex III systems from 2 December 2027 ^[10]. The right to an explanation of Article 86 is in Chapter IX: it has applied since the general date of application, 2 August 2026 ^[11]. The right concerns decisions based on a high-risk system from Annex III (except point 2) that produce legal effects or similarly significant adverse effects ^[8]. The classification rules of Chapter III apply to Annex III systems only from 2 December 2027 ^[10], and for systems already in use the transitional rule of Article 111(2) applies ^[12]. Assess per system and per decision, therefore, whether the right already applies.

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

Use per instructions and monitoring AI Act 26, AI Act 73
Human oversight AI Act 14, AI Act 26
Relevant and representative input data AI Act 26
Logging AI Act 12, AI Act 19, AI Act 26
Workers and their representatives informed AI Act 26
Informing the people the system is used on AI Act 26
Explanation of individual decisions on request AI Act 86
DPIA using the provider's information AI Act 13, AI Act 26

Sources

[1] AI Act Art. 26(1) (AI Act, Regulation (EU) 2024/1689). Deployers take appropriate technical and organisational measures to use the system in accordance with the instructions for use.
Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.
Source, retrieved on 2 October 2026.
[2] AI Act Art. 26(5), first subparagraph (AI Act, Regulation (EU) 2024/1689). Deployers monitor the operation; if use in accordance with the instructions may present a risk, they inform the provider or distributor and the market surveillance authority and suspend the use; they report a serious incident immediately, first to the provider and then to the importer or distributor and the relevant market surveillance authorities.
Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident.
Source, retrieved on 2 October 2026.
[3] AI Act Art. 26(2) (AI Act, Regulation (EU) 2024/1689). Human oversight rests with natural persons who have the necessary competence, training and authority and who get the necessary support.
Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
Source, retrieved on 2 October 2026.
[4] AI Act Art. 26(4) (AI Act, Regulation (EU) 2024/1689). To the extent the deployer controls the input data, they ensure that it is relevant and sufficiently representative for the intended purpose.
Without prejudice to paragraphs 1 and 2, to the extent the deployer exercises control over the input data, that deployer shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system.
Source, retrieved on 2 October 2026.
[5] AI Act Art. 26(6), first subparagraph (AI Act, Regulation (EU) 2024/1689). Deployers keep the automatically generated logs under their control for a period appropriate to the intended purpose, of at least six months, unless Union or national law provides otherwise.
Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data.
Source, retrieved on 2 October 2026.
[6] AI Act Art. 26(7) (AI Act, Regulation (EU) 2024/1689). An employer that is about to use a high-risk system in the workplace informs the workers' representatives and the workers concerned in advance, in accordance with the rules and practice on informing workers.
Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system. This information shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives.
Source, retrieved on 2 October 2026.
[7] AI Act Art. 26(11) (AI Act, Regulation (EU) 2024/1689). Deployers of an Annex III system that takes or helps to take decisions about natural persons inform those persons that the system is used on them; this is in addition to Article 50.
Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system.
Source, retrieved on 2 October 2026.
[8] AI Act Art. 86(1) to (3) (AI Act, Regulation (EU) 2024/1689). Anyone affected by a decision based on the output of an Annex III system (except point 2) that produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights has the right to clear and meaningful explanations; not where Union or national law provides exceptions, and only to the extent Union law does not already provide for that right.
Any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2 thereof, and which produces legal effects or similarly significantly affects that person in a way that they consider to have an adverse impact on their health, safety or fundamental rights shall have the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken. 2. Paragraph 1 shall not apply to the use of AI systems for which exceptions from, or restrictions to, the obligation under that paragraph follow from Union or national law in compliance with Union law. 3. This Article shall apply only to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law.
Source, retrieved on 2 October 2026.
[9] AI Act Art. 26(9) (AI Act, Regulation (EU) 2024/1689). Where a DPIA is needed, the deployer uses for it the information the provider supplies under Article 13.
Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.
Source, retrieved on 2 October 2026.
[10] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
Source, retrieved on 2 October 2026.
[11] AI Act Art. 113, second paragraph (AI Act, Regulation (EU) 2024/1689). The Regulation applies from 2 August 2026.
It shall apply from 2 August 2026.
Source, retrieved on 3 October 2026.
[12] Regulation (EU) 2026/1744 Art. 1(39)(a) (replaces AI Act Art. 111(2)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Transition for existing high-risk systems: the Regulation applies to systems placed on the market before the date of application of Chapter III only if they undergo significant design changes from that date; Article 5 remains unaffected.
Without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a), this Regulation shall apply to operators of high-risk AI systems, other than the systems referred to in paragraph 1 of this Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113, only if, as from that date, those systems are subject to significant changes in their designs.
Source, retrieved on 22 October 2026.

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.