Ongoing operations
Deployer Workspace
If you are a deployer of high-risk AI systems, Article 26 gives you six concrete duties that are not satisfied by a single toggle. The Deployer Workspace turns the generic tenant_action obligation into a per-system dashboard so you can see, per system, which duty is still todo and which is evidenced.
Transcript
Article 26 gives deployers six duties for high-risk AI systems. The Deployer Workspace makes them visible per system, not as a flat toggle.
Without the deployer role, the workspace correctly returns 403. Set your organisation role to deployer or both in onboarding or Company Profile.
The six duties are use per instructions, assign human oversight, ensure input data relevance, monitor and report, retain logs for six months, and inform workers where AI is used at work.
Open the workspace and see per system which of the six derived checks are still todo. A fully completed row means all six are evidenced via risk owner, checklist and last review.
Assign a risk owner for human oversight, keep the last review current for monitoring and log retention, and attest input-data relevance and worker information where they apply.
Why this is required
Article 26 applies only when you are a deployer (or both provider and deployer) and the system is high-risk, but a flat obligation tracker hides that per-system variation. A deployer who has assigned human oversight for one high-risk system but not another needs to see exactly where the gap is, not a tenant-wide percentage.
Human oversight (Art.26(2)), input-data relevance (Art.26(4)) and worker information (Art.26(7)) all require a person-level attestation that cannot be inferred from a risk assessment alone. A dashboard that derives completed vs todo from risk_owner, checklist and last_reviewed makes the remaining manual steps visible rather than silently assumed done.
What EuroCompliant does
GET /deployer/obligations returns the six Art.26 duties (26(1) use per instructions, 26(2) assign human oversight, 26(4) input data relevance, 26(5) monitor & report, 26(6) log retention 6 months, 26(7) inform workers) only when CompanyProfile.role is deployer or both, otherwise 403 with a fix hint.
GET /deployer/systems returns every registered AI system with derived checks per Art.26 duty: 26(1) completed when the high-risk checklist is completed/locked, 26(2) when risk_owner is set or a human_oversight checklist item is completed, 26(5)/26(6) when last_reviewed exists (proxy for log retention), and 26(4)/26(7) remain todo until you attest them. A fully completed row means all six checks are completed.
The frontend Deployer Workspace (/deployer) renders the six obligations and a systems table with todo/completed badges per duty, plus a fully_completed counter. The text under the table reminds you that checks are dashboard signals derived from RiskAssessment, ComplianceChecklist, AISystem.risk_owner and last_reviewed, not a legal determination.
Walking through it
Set your organisation role to deployer
Onboarding or Company Profile → role deployer or both. Without it, the workspace returns 403, which is correct: a provider-only tenant has no Art.26 duties.
Open /settings/profile →Open the Deployer Workspace
See the six duties and, per system, which of the six derived checks are still todo.
Open /deployer →Close the remaining todos
Assign a risk owner and complete the human_oversight checklist item for 26(2), keep last_reviewed current for 26(5)/26(6), and attest 26(4) input-data relevance and 26(7) worker information where they apply.
Open /deployer →The law
Frequently asked
Why does the workspace 403 for my tenant?
Your CompanyProfile.role is not deployer or both. Art.26 only applies to deployers, so the API returns 403 with a fix hint. Update the role in onboarding or Company Profile.
Are the per-system checks legally determinative?
No. They are dashboard signals derived from risk_owner, checklist and last_reviewed, a useful proxy, not a legal determination. Evidence is satisfied via the Evidence Vault and the deployer register, not the badge colour alone.
Related guides
Risk classification
The Article 6 assessment that decides which obligations a system carries, and why the reasoning matters as much as the result.
Compliance checklists
How Articles 9 to 15 become tracked, owned, evidenced work rather than a document nobody reads.
Evidence vault & audit trail
Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial