EU AI Act · Article 26
If your company uses AI — a CRM with AI features, a chatbot, an internal assistant — you are a deployer under the EU AI Act, and Article 26 sets your obligations. Here is each one, and the engineering control that satisfies it.
Scope
The Act defines a deployer as a natural or legal person using an AI system under its authority, other than in a personal non-professional activity. In 2026 that is most companies. You do not need to have built the system. You do not need to have "intentionally" deployed it. If your CRM has an AI lead-scoring feature, you are a deployer of that feature.
This is the most common misunderstanding: using a SaaS product with AI features makes you a deployer of those AI features, even when the vendor markets it as "AI-powered" rather than "an AI system."
The obligations
Engineering control: Document which systems you run, their stated purpose, and how your use aligns. If the provider says a use case is unsupported, either stop that use or get written confirmation it is supported.
Engineering control: Name an owner per system. The oversight must be able to interpret the output, monitor anomalies, and suspend use. "A human exists somewhere" is not enough — the person must have the authority to stop it.
Engineering control: Capture what data feeds each AI system. If the input is biased, stale, or out-of-distribution, the output is unreliable and you are exposed. This is a monitoring and data-lineage problem, not a checkbox.
Engineering control: Structured, tamper-evident logs of every execution — inputs, outputs, model version, provider, and any human decision. Retention enforced at the runtime, not reconstructed after a regulator asks.
Engineering control: A communication and documentation step. If your AI touches hiring, evaluation, or task allocation, the affected workforce must be told. Keep a dated record of the notice.
Engineering control: A documented impact assessment for high-risk deployments. This is the piece most organisations skip — and the one a market surveillance authority asks for first.
Enforcement in code
Four of the six obligations above — instructions, oversight, monitoring, and logs — are exactly the controls TramAI enforces in the execution path: human approval gates, model routing, structured audit logging, and guardrails. Instead of a compliance binder you hope survives an audit, the evidence is generated as the system runs.
FAQ
Any natural or legal person using an AI system under its authority, outside a personal non-professional activity. In practice that means most companies: if your CRM, chatbot, or SaaS tool has AI features you rely on, you are a deployer of those features — even when a vendor built them.
Use the system per its instructions (26(1)); arrange competent human oversight (26(2)); ensure input data is relevant and representative (26(3)); monitor operation and retain logs for at least six months (26(4)); inform affected workers (26(5)); and assess the fundamental-rights impact of high-risk systems (26(6)).
At least six months of automatic logs. The engineering requirement is that they are structured and tamper-evident — inputs, outputs, model version, provider, and any human decision — so the evidence exists when a regulator asks, not reconstructed afterwards.
Article 26 governs deployers of high-risk AI systems. Those obligations apply with the high-risk timeline — Annex III systems from 2 December 2027 (deferred by the Digital Omnibus, Regulation 2026/1744) and Annex I systems from 2 August 2028. The underlying duties should be in place well before those dates.