# Deployers must use the provider's transparency information in their data protection impact assessment

- **Record type**: Obligation
- **Instrument**: Regulation (EU) 2024/1689 — Artificial Intelligence Act
- **Jurisdiction**: European Union
- **Category**: privacy_data_protection
- **Binding**: Yes
- **Applies from**: 2026-08-02
- **Provision**: Article 26(9)

## What the duty requires

Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment.

## What an organisation does about it

Attach the provider's instructions for use to the DPIA template and cross-reference the Article 27 fundamental rights impact assessment where one is required.

## Controls that meet this duty

- AI impact and fundamental-rights impact assessment (supports): https://aipolicytracker.org/controls/ai-impact-assessment
- Privacy and data-protection controls for AI (satisfies): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai

## Parent instrument

- Regulation (EU) 2024/1689 — Artificial Intelligence Act
  - Record: https://aipolicytracker.org/policies/eu-ai-act
  - Context file: https://aipolicytracker.org/policies/eu-ai-act.md

## Provenance

- **Record page**: https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information
- **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- **Provision**: Article 26(9)
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.