Ongoing operations
Deployer Workspace
If you deploy high-risk AI systems, you have six concrete duties: use the system only as instructed, assign human oversight, ensure input data is relevant, monitor and report performance, keep logs for six months, and inform your workers. The Deployer Workspace shows, per system, which duties are done and which still need attention.
Transcript
Article 26 gives deployers six duties for high-risk AI systems. The Deployer Workspace makes them visible per system, not as a flat toggle.
Without the deployer role, the workspace correctly returns 403. Set your organisation role to deployer or both in onboarding or Company Profile.
The six duties are use per instructions, assign human oversight, ensure input data relevance, monitor and report, retain logs for six months, and inform workers where AI is used at work.
Open the workspace and see per system which of the six derived checks are still todo. A fully completed row means all six are evidenced via risk owner, checklist and last review.
Assign a risk owner for human oversight, keep the last review current for monitoring and log retention, and attest input-data relevance and worker information where they apply.
Why this is required
A flat obligation tracker hides per-system variation. A deployer who has assigned human oversight for one system but not another needs to see exactly where the gap is, not a tenant-wide percentage.
Human oversight, input-data relevance and worker information all require a person-level attestation that cannot be inferred from a risk assessment alone.
What EuroCompliant does
The workspace lists the six Article 26 duties and, for each registered AI system, shows a badge per duty: completed or todo.
A duty is marked completed when its evidence exists. For example, human oversight is done when a risk owner is assigned, and monitoring is done when the system has been reviewed recently.
A fully completed row means all six checks pass for that system.
Walking through it
Set your organisation role to deployer
Onboarding or Company Profile → role deployer or both. Without it, the workspace returns 403, which is correct: a provider-only tenant has no Art.26 duties.
Open /settings/profile →Open the Deployer Workspace
See the six duties and, per system, which of the six derived checks are still todo.
Open /deployer →Close the remaining todos
Assign a risk owner and complete the human_oversight checklist item for 26(2), keep last_reviewed current for 26(5)/26(6), and attest 26(4) input-data relevance and 26(7) worker information where they apply.
Open /deployer →The law
Frequently asked
Why does the workspace 403 for my tenant?
Your CompanyProfile.role is not deployer or both. Art.26 only applies to deployers, so the API returns 403 with a fix hint. Update the role in onboarding or Company Profile.
Are the per-system checks legally determinative?
No. They are dashboard signals derived from risk_owner, checklist and last_reviewed, a useful proxy, not a legal determination. Evidence is satisfied via the Evidence Vault and the deployer register, not the badge colour alone.
Related guides
Risk classification
The Article 6 assessment that decides which obligations a system carries, and why the reasoning matters as much as the result.
Compliance checklists
How Articles 9 to 15 become tracked, owned, evidenced work rather than a document nobody reads.
Evidence vault & audit trail
Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial