{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","id":"AIPT-OBL-0033","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0033","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","short_title":"Deployer monitoring and suspension","category":"post_market_monitoring","summary":"Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. If they have reason to think the system as used may present a risk to health, safety or fundamental rights, they must inform the provider or distributor and the market surveillance authority without undue delay and suspend use. On a serious incident, they must immediately inform the provider, then the importer or distributor and the authorities. Financial institutions meet this through their internal governance rules.\n","practical_action":"Give each high-risk system an operational owner with a kill-switch authority and a written escalation route to the provider and the authority.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 26(5)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["deployer","public_authority"],"sectors":["cross_sector","employment","financial_services","public_services"],"use_cases":["hiring_and_hr","finance_and_credit","public_services","safety_critical"],"applicability":[{"description":"Deployers of high-risk AI systems; the incident-reporting leg is aligned with Article 73.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Operational monitoring log","description":null,"artifact_type":"record"},{"title":"Suspension and escalation procedure","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 9.1; Annex A.6.2.6, A.8.4","note":"Operation and monitoring; communication of incidents.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 2.4, MANAGE 4.1, MANAGE 4.3","note":"Deactivation mechanisms, post-deployment monitoring and incident response.","confidence_level":"high","is_original":true}],"controls":[{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"satisfies","note":"Deployer-side monitoring with feedback to the provider.","confidence_level":"high","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"},{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"satisfies","note":"Suspension decision and notifications to provider and authority.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}