Deployers must monitor high-risk AI, suspend use on risk and report serious incidents
Download: JSON · MarkdownUnder EU AI Act, Article 26(5)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
Deployers must monitor high-risk AI, suspend use on risk and report serious incidents is a legal requirement under the EU AI Act in the European Union (Article 26(5)). Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. It applies from 2 December 2027.
- Instrument
- EU AI Act
- Jurisdiction
- European Union
- Nature
- Legal requirement
- Source reference
- Article 26(5)
- Applies from
- 2 December 2027
- Who it binds
- Deployer / user organisation, Public authority / government body
- Evidence examples
- 2
- Framework mappings
- ISO/IEC 42001:2023, NIST AI Risk Management Framework 1.0
- Controls that meet it
- 2
- Official source
- Open official text
- Verification
- Verified against the official source 26 Sep 2026
What does it require?
Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. If they have reason to think the system as used may present a risk to health, safety or fundamental rights, they must inform the provider or distributor and the market surveillance authority without undue delay and suspend use. On a serious incident, they must immediately inform the provider, then the importer or distributor and the authorities. Financial institutions meet this through their internal governance rules.
Practical action
Give each high-risk system an operational owner with a kill-switch authority and a written escalation route to the provider and the authority.
Who does it apply to?
Deployers of high-risk AI systems; the incident-reporting leg is aligned with Article 73.
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesTechnical measureAI system owner · continuousPost-deployment monitoring and drift detection
Serves 10 recorded duties · evidence: Post-market monitoring plan, Monitoring dashboard or periodic monitoring report, Monitoring review decision
Deployer-side monitoring with feedback to the provider.
-
satisfiesProcessIncident coordinator · continuousAI incident management and regulatory reporting
Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority
Suspension decision and notifications to provider and authority.
Templates that cover this duty
Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.
- EU AI Act Role and Risk Classifier
Checklist · XLSX · v4
- AI Incident Response Playbook and Log
Procedure · DOCX and XLSX · v3
- EU AI Act Article 50 Transparency Kit
Kit · DOCX and XLSX · v44
- ISO/IEC 42001 Gap Assessment and Statement of Applicability
Assessment · XLSX · v3
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Operational monitoring log | record | |
| Suspension and escalation procedure | document |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every European Union duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Clause 9.1; Annex A.6.2.6, A.8.4 | Operation and monitoring; communication of incidents. | high |
| NIST AI RMF 1.0 | MANAGE 2.4, MANAGE 4.1, MANAGE 4.3 | Deactivation mechanisms, post-deployment monitoring and incident response. | high |
Frequently asked questions
Is this a legal requirement?
Yes. It is a legal requirement under EU AI Act (Article 26(5)).
Who must comply with this obligation?
Deployers of high-risk AI systems; the incident-reporting leg is aligned with Article 73.
When does this obligation apply?
It applies from 2 December 2027.
What evidence shows compliance?
A reviewer would expect: Operational monitoring log; Suspension and escalation procedure.
Which frameworks map to this obligation?
It is mapped to ISO/IEC 42001:2023 Clause 9.1; Annex A.6.2.6, A.8.4, NIST AI Risk Management Framework 1.0 MANAGE 2.4, MANAGE 4.1, MANAGE 4.3. These are editorial crosswalks with a stated confidence, not official mappings.
Which controls satisfy this obligation?
Post-deployment monitoring and drift detection; AI incident management and regulatory reporting.
What should an organisation do in practice?
Give each high-risk system an operational owner with a kill-switch authority and a written escalation route to the provider and the authority.
Cite this record
AIPolicyTracker (2026). “Deployers must monitor high-risk AI, suspend use on risk and report serious incidents (EU AI Act)” [AIPT-OBL-0033, verified 26 September 2026]. https://aipolicytracker.org/id/AIPT-OBL-0033 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-OBL-0033: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
BibTeX
@misc{aipolicytracker2026_deployersmustmonitorhigh,
author = {{AIPolicyTracker}},
title = {{Deployers must monitor high-risk AI, suspend use on risk and report serious incidents (EU AI Act)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension}},
url = {https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Change history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Similar obligations in other instruments
- Operate a post-market monitoring system — EU AI Act, European Union
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.