DAILY

Whoever uses a high-risk AI system under their own authority is a deployer and bears the obligations of Art. 26 AI Act, complemented by AI literacy (Art. 4), the fundamental rights impact assessment (Art. 27) and the right to explanation (Art. 86). This checklist shows which obligations are met and where gaps remain. For Annex III high-risk systems the obligations apply from 2 December 2027, for Annex I systems from 2 August 2028.

Applicability

1. Is the system a high-risk AI system under Art. 6 (Annex I or Annex III)?

If in doubt, run the risk classification first.

Art. 6 KI-VO Open in the law texts
2. Do you use the system under your own authority in the course of a professional activity (deployer)?
Art. 3 Nr. 4 KI-VO Open in the law texts

Operation

3. Have you taken technical and organisational measures to ensure the system is used in accordance with the provider's instructions for use?
Art. 26 Abs. 1 KI-VO Open in the law texts
4. Is human oversight assigned to natural persons who have the necessary competence, training and authority, and the necessary support?
Art. 26 Abs. 2 KI-VO Open in the law texts
5. Do the staff dealing with the operation and use of the system have a sufficient level of AI literacy?
Art. 4 KI-VO Open in the law texts
6. To the extent you exercise control over the input data: is it relevant and sufficiently representative in view of the intended purpose?
Art. 26 Abs. 4 KI-VO Open in the law texts
7. Do you monitor the operation on the basis of the instructions for use and inform the provider where relevant?
Art. 26 Abs. 5 UAbs. 1 KI-VO Open in the law texts
8. Is it laid down that use is suspended and the provider or distributor and the market surveillance authority are informed without undue delay if the system presents a risk within the meaning of Art. 79(1)?
Art. 26 Abs. 5 UAbs. 1 KI-VO Open in the law texts
9. Is there a procedure to report serious incidents without undue delay first to the provider, then to the importer or distributor and the authorities?
Art. 26 Abs. 5, Art. 73 KI-VO Open in the law texts
10. Are the automatically generated logs, to the extent under your control, kept for at least six months?

Longer periods under other law take precedence; shorter deletion periods under data protection law need to be weighed.

Art. 26 Abs. 6 KI-VO Open in the law texts

Affected persons

11. When used at the workplace: were workers' representatives and affected workers informed before the system was put into service?

In Germany, the works council's co-determination right for technical monitoring equipment applies in addition.

Art. 26 Abs. 7 KI-VO Open in the law texts
12. Does the system make or assist decisions about natural persons (Annex III) – and are those persons informed that it is used?
Art. 26 Abs. 11 KI-VO Open in the law texts
13. Can you give affected persons, on request, a clear and meaningful explanation of the role of the system in the decision-making procedure and of the main elements of the decision?
Art. 86 KI-VO Open in the law texts

Records and authorities

14. Does the system process personal data – and have you used the provider's Art. 13 information to carry out a data protection impact assessment?
Art. 26 Abs. 9 KI-VO Open in the law texts
15. Where a fundamental rights impact assessment is required (public bodies, private providers of public services, creditworthiness, life and health insurance): was it carried out before first use and notified to the authority?
Art. 27 KI-VO Open in the law texts
16. As a public authority or Union institution, body or agency, or acting on their behalf: is the use registered in the EU database?
Art. 26 Abs. 8, Art. 49 KI-VO Open in the law texts
17. Is it settled who cooperates with the competent authorities and provides information?
Art. 26 Abs. 12 KI-VO Open in the law texts
This result is not saved. With an account, assessments are stored with date and catalog version.