Understand the deployment responsibilities.
Article 26 addresses high-risk deployers' responsibilities for use according to instructions, competent human oversight, relevant input data, monitoring and other specified duties. Check the applicable requirements and dates for the actual system.
Begin with the provider's instructions and the organisation's real workflow. Identify any differences between the intended use and the way teams plan to rely on the output.
Give the operational owner usable instructions.
Define the approved purpose, permitted inputs and limits on reliance. Identify the person who can answer questions about the system and the person who may pause or restrict use. Include arrangements for new staff, absence cover and handover between teams.
An instruction is useful only if people can follow it with the information and time available. Review the workflow with the users rather than assuming that a policy acknowledgement proves it works.
Keep supplier and internal responsibilities connected.
Know how to obtain current instructions, report concerns and receive important change notices. Maintain the link between the supplier's system reference and the organisation's use-case record. When a supplier changes a feature or limitation, identify the teams and decisions affected.
- Approved use and relevant service or release.
- Operational owner and oversight arrangements.
- Supplier contacts and communication routes.
- Monitoring questions and reassessment triggers.
Keep evidence of the operating decision.
Record the initial review, any conditions, subsequent concerns and the actions taken. If a new use falls outside the earlier decision, route it for review before treating it as approved. Ensure that serious questions reach someone with the authority to act.
EUAIC can help structure the deployment record and follow-up process. A tool does not take over the deployer's responsibilities, and a provider's conformity statement does not establish that every way of using the system is appropriate.