Deployers must tell natural persons that a high-risk AI system is used in decisions about them
Context fileUnder EU AI Act, Article 26(11)
What does it require?
Deployers of Annex III high-risk AI systems that take decisions about natural persons, or help take them, must inform those persons that they are subject to the system. The notice is separate from any explanation owed under Article 86 and from the worker notice in Article 26(7). In law-enforcement contexts the duty follows the information rules of the Law Enforcement Directive.
Practical action
Add a plain-language AI-use notice to application forms, decision letters or account terms for each affected decision process.
Who does it apply to?
Deployers using Annex III systems for decisions about individuals, for example in recruitment, credit, education admissions or public benefits.
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessProduct owner · at launch and on material changeAI interaction and use disclosure notices
Serves 17 recorded duties · evidence: AI interaction or use notice, Notice catalogue, Notice wording approval
Notice to decision subjects at the point of the decision process.
-
supportsProcessCustomer operations lead · once per ai systemDecision explanation, human review and appeal route
Serves 10 recorded duties · evidence: Adverse-decision explanation template, AI decision challenge and human review procedure, Challenge and reversal log
Notice links to the Article 86 explanation route.
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Affected-person notice template and placement record | document |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every European Union duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Annex A.8.5 | Information for interested parties. | medium |
| NIST AI RMF 1.0 | GOVERN 5.1, MANAGE 4.1 | Communication with affected individuals. | medium |
Cite this record
AIPolicyTracker (2026). “Deployers must tell natural persons that a high-risk AI system is used in decisions about them (EU AI Act)”. https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons (accessed 24 September 2026). Data licensed CC BY 4.0.
Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
Similar obligations in other instruments
- Provide deployers with clear instructions for use — EU AI Act, European Union
- Employers must inform workers and their representatives before using high-risk AI at work — EU AI Act, European Union
- Disclose AI interaction and label synthetic content — EU AI Act, European Union
- Deployers of emotion recognition or biometric categorisation must inform exposed persons — EU AI Act, European Union
- Deployers must disclose deepfakes and AI-generated text published on matters of public interest — EU AI Act, European Union
- Deployers must explain individual decisions taken with high-risk AI on request — EU AI Act, European Union
- Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way — EU AI Act, European Union
- Notify individuals about the use of personal data in AI recommendations and decisions — PDPC AI advisory guidelines, Singapore
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.