You deploy the system. You did not build it. What do you owe?
Most published guidance on the AI Act is written for providers — the organisations that build and place systems on the market. If you bought a CV-screening tool or a credit-scoring model, you are a deployer, and a different and shorter list applies to you.
Provider or deployer — the distinction that decides everything
The AI Act assigns duties by role, not by company size. A provider develops a system or places it on the market under its own name. A deployer uses a system under its own authority. Buying a tool and configuring it for your recruitment process makes you a deployer.
The distinction matters because the heavy machinery of the AI Act — conformity assessment, technical documentation, CE marking, registration — sits with the provider. What reaches you is the operational layer.
One caution: putting your own name on a bought system, or substantially modifying it, can make you a provider for that system. That is worth checking before you assume the shorter list applies.
The full list
Quelle: Regulation (EU) 2024/1689 (AI Act), Article 26. Log retention is paragraph 6 and the duty to inform workers is paragraph 7 in the official numbering — several widely-used mirrors of the regulation shift these numbers by one. Obligations for Annex III high-risk systems apply from 2 December 2027, for Annex I systems from 2 August 2028. · Stand October 2026
The four that bite before go-live
1. Use it the way the instructions say
Appropriate technical and organisational measures to ensure the system is used in accordance with its instructions for use. In practice this is the duty that quietly fails: the system is procured for one purpose and then applied to a second one that the instructions never contemplated.
2. Assign human oversight to named people
Oversight must be given to natural persons who have the necessary competence, training, authority and support. All four words carry weight. Someone without authority to overrule the system is not exercising oversight, and neither is someone who was never trained on what the system can get wrong.
3. Inform workers before you switch it on
Where a high-risk system is used at the workplace, deployers who are employers must inform worker representatives and the affected workers before putting it into service. In Germany this runs alongside — not instead of — the co-determination rights under the Works Constitution Act, which for most monitoring-capable tools require an agreement, not just notice.
4. Carry out the data protection impact assessment
Article 26 points at GDPR Article 35 and tells you to use the information the provider supplied under Article 13 to do it. The assessment is a GDPR duty; what the AI Act adds is the obligation to actually use the provider documentation as input.
The running duties
- Input data. Where you control it, ensure it is relevant and sufficiently representative for the intended purpose.
- Monitoring and escalation. Monitor operation and inform the provider. If the system presents a risk, inform provider or distributor and the market surveillance authority without delay, and suspend use.
- Log retention. At least six months for logs you control.
- Notify affected people. Tell natural persons when they are subject to an Annex III high-risk system that makes or assists decisions about them.
- Cooperate with competent authorities on measures concerning the system.
Two further paragraphs are narrow: registration checks apply to public authorities, and the authorisation regime for post-remote biometric identification applies to law enforcement.
Why December 2027 is not a reason to wait
The fifteen-month postponement moved the date the obligations bite. It did not move the work. Human oversight has to be assigned to real people who have been trained; worker representatives have to be informed before go-live, which in a German works-council setting is a negotiation, not a memo.
Starting in November 2027 does not give you fifteen months. It gives you one.
And the duty that already applies is unaffected by the postponement: Article 4 requires sufficient AI literacy of your staff since February 2025, regardless of risk class.
What Regovio does
To be explicit: Regovio does not classify systems for you and produces no regulatory filings. Whether something falls under Annex III is a legal question with real consequences. What Regovio covers is the record underneath it.
| Requirement | Regovio | Status |
|---|---|---|
| Which systems are in use | Register with type, context and provider | heute verfügbar |
| Human oversight per system | Explicit role assignment, not a text field | heute verfügbar |
| Structured assessment | Personal data, automated decisions, criticality, oversight | heute verfügbar |
| Evidence with validity and versions | Linked to the asset it belongs to | heute verfügbar |
| Show what was true on a date | Append-only audit log with actor and timestamp | heute verfügbar |
| Annex III point mapping | Not yet mapped to individual annex points | auf der Roadmap — heute nicht enthalten |
| Log capture from the AI system itself | Not included — that is the system's own job | auf der Roadmap — heute nicht enthalten |
A note on language
Regovio is built for the European mid-market and most of this site is in German, including the contact form. The companion English page is AI Inventory Template. In German, the Annex III question is treated at Hochrisiko-KI-System.