What must a deployer of a high-risk AI system be able to show under Article 26?

Art. 26(2)

Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.

• GD-03 Approval log: who, when, what they saw, what they decided
• GD-04 Gate log: each item held, released or rejected

Art. 26(4)

Without prejudice to paragraphs 1 and 2, to the extent the deployer exercises control over the input data, that deployer shall ensure that input data is relevant and sufficiently representative in view of the intended purpose of the high-risk AI system.

• GD-06 Schema registry with version history, and reject counts for the period
• GD-08 The redaction rules in force, and a test showing no raw personal data reaches a log

Art. 26(5)

Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions for use and, where relevant, inform providers in accordance with Article 72. Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system. Where deployers have identified a serious incident, they shall also immediately inform first the provider, and then the importer or distributor and the relevant market surveillance authorities of that incident. If the deployer is not able to reach the provider, Article 73 shall apply mutatis mutandis. This obligation shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities.

For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law, the monitoring obligation set out in the first subparagraph shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service law.

• GD-05 Drill record: date, operator, what stopped, recovery time, the safe-state behaviour observed
• GD-17 Incident register for the period, open and closed

Art. 26(6)

Deployers of high-risk AI systems shall keep the logs automatically generated by that high-risk AI system to the extent such logs are under their control, for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data.

Deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law shall maintain the logs as part of the documentation kept pursuant to the relevant Union financial service law.

• GD-01 Ledger extract: time, subject, model version, estimated and actual cost, outcome
• GD-02 Chain verification output for the period

Art. 26(11)

Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system. For high-risk AI systems used for law enforcement purposes Article 13 of Directive (EU) 2016/680 shall apply.

• GD-04 Gate log: each item held, released or rejected
• GD-16 The contract for each source, versioned with the code

Art. 26(12)

Deployers shall cooperate with the relevant competent authorities in any action those authorities take in relation to the high-risk AI system in order to implement this Regulation.

• GD-18 The pack: twelve items in a dated folder, generated rather than written