EU AI Act Deployer Evidence Gaps: SME Checklist

Image: Unsplash.

TL;DR: Since August 2, 2026, Article 50 transparency duties apply to deployers of emotion recognition, biometric categorisation and deepfake systems. The high-risk deployer duties (Article 26 oversight and monitoring, the Article 27 fundamental rights impact assessment) now apply from December 2, 2027 for Annex III systems, after the AI Omnibus moved the date. The five evidence gaps below take months to close, so start them now. Each section includes a copy-paste documentation template.

August 2, 2026 is the date the EU AI Act became generally applicable, but it isn't the date every deployer duty started. The AI Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) moved the rules for Annex III high-risk systems to December 2, 2027 and for high-risk AI embedded in products (Annex I) to August 2, 2028.

So the honest picture for a small deployer is this: a few transparency duties are live now, and the heavier high-risk file (oversight procedure, monitoring, impact assessment) is due in a little over a year. If you're building that file from nothing, a year isn't much.

This article covers who counts as a deployer, what applies now versus December 2027, and five documents a deployer file needs, with a copy-paste template for each.

Who is a "deployer" under the EU AI Act

Article 3(4) of the EU AI Act defines a deployer as a natural or legal person, public authority, agency or other body using an AI system under its authority, except where the system is used in a personal non-professional activity.

In practice, you are a deployer if your business:

• Uses a vendor-supplied AI tool in your operations (hiring software, customer service AI, AI-generated content tools, scoring or recommendation systems)
• Makes that AI tool available to end users or uses it to make decisions affecting people
• Operates under your own brand or authority, even if the AI was built entirely by a vendor

Most businesses using third-party AI tools in production are deployers. The definition does not require building the AI yourself. It does not require being large. And it does not grant an exemption for using a well-known vendor's product.

For the full picture of what applies to your team right now versus what is still being phased in, see what's delayed vs what applies, EU AI Act August 2026.

What applies now and what waits for December 2027

Article 113 of the consolidated AI Act (version of July 27, 2026) sets the dates that matter to deployers:

1. Prohibited AI practices (Article 5): applied from February 2, 2025. Two new bans added by the Omnibus (non-consensual intimate deepfakes and child sexual abuse material) apply from December 2, 2026.
2. GPAI model obligations: on providers of general-purpose AI models, applied from August 2, 2025.
3. Article 50 transparency obligations: applied from August 2, 2026. Machine-readable marking under Article 50(2) has until December 2, 2026 for systems placed on the market before August 2, 2026.
4. High-risk rules (Chapter III, Sections 1 to 3, which hold Article 14, Article 26 and Article 27): from December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems.

Deployers are directly in scope for Article 50(3) and 50(4), and for Article 5 if they deploy a system that falls into a prohibited category. Gaps 1, 2, 3 and 5 below are high-risk deployer duties that start in December 2027; Gap 4 is live now.

Use the five gaps below as a checklist: tick the documents you already have and start on the rest.

Image: Unsplash.

Gap 1: No fundamental rights impact assessment (Article 27)

What the law requires (from December 2, 2027): Article 27 requires a fundamental rights impact assessment before first use of an Annex III high-risk system by deployers that are bodies governed by public law or private entities providing public services, and by deployers of systems for credit scoring (Annex III point 5(b)) or life and health insurance risk pricing (point 5(c)). Critical infrastructure systems (point 2) are excluded.

Who this applies to: Public bodies and public-service providers using any Annex III system, and any business using AI to score creditworthiness or price life or health insurance. A private employer using an HR screening tool is not on the Article 27 list, though the tool is still high-risk and the Article 26 duties below apply. If you're outside Article 27, the template still works as an internal record.

Screenshot: Article 27, consolidated text of Regulation (EU) 2024/1689 as of July 27, 2026, EUR-Lex.

What most SMEs are missing: No documentation that an assessment was conducted, no record of findings, and no evidence that the results were considered before deployment.

Copy-paste template: Fundamental rights impact assessment record

Document title: Fundamental Rights Impact Assessment AI system name: [System name and vendor] Date of assessment: [Date] Assessed by: [Name, role]

System description: [One paragraph describing what the AI system does, what decisions it informs or makes, and which individuals are affected.]

Fundamental rights categories reviewed:

Assessment conclusion: [State whether the deployment is approved to proceed, conditionally approved with listed mitigations, or requires further review before deployment.]

Sign-off: [Name, title, date]

Keep this document in your AI governance file. Review and update it before making significant changes to how the system is used.

Gap 2: No human oversight procedure documentation (Article 14)

What the law requires (from December 2, 2027): Article 26 requires deployers of high-risk AI systems to assign human oversight to people with the competence, training and authority to do it, and to implement the oversight measures the provider designed under Article 14. This obligation falls on the deployer, not just the provider, even when the AI system was built by a third party.

Screenshot: Article 26, consolidated text of Regulation (EU) 2024/1689 as of July 27, 2026, EUR-Lex.

What most SMEs are missing: No written procedure describing how humans review, override, or intervene in AI outputs. Many teams rely on informal practices ("we always check before sending") without documenting them.

Copy-paste template: Human oversight procedure

Document title: Human Oversight Procedure for [AI System Name] Version: [Version number] Owner: [Name, role] Last reviewed: [Date]

Scope: This procedure applies to all use of [AI system name] by [company name] employees and contractors.

Oversight requirement: No AI-generated output from this system may be acted upon or communicated to affected individuals without human review by an authorized staff member. The human reviewer must be capable of overriding, modifying, or rejecting the AI output.

Review steps:

1. The AI system produces output (recommendation, score, decision, draft).
2. The designated reviewer examines the output for accuracy, fairness, and appropriateness.
3. The reviewer approves, modifies, or rejects the output and records the action in [logging system or field].
4. Only approved outputs proceed to the next step.

Override authority: Any reviewer may override an AI output without additional approval. Overrides must be logged with a brief reason.

Escalation: If a reviewer is uncertain whether to approve or override, escalate to [name/role] before proceeding.

Record retention: Human review records are retained for [X] years in accordance with our data retention policy.

Gap 3: No instructions-for-use log

What the law requires (from December 2, 2027): Article 26 requires deployers of high-risk systems to use them in accordance with the provider's instructions for use and to monitor their operation on that basis. Keeping evidence that you reviewed and applied those instructions is the simplest way to show you did. Just having the vendor's documentation isn't the same thing.

What most SMEs are missing: No record that the instructions-for-use were reviewed, no log of limitations or prohibited uses noted in the documentation, and no confirmation that staff were trained on those limitations.

Copy-paste template: Instructions-for-use acknowledgment log

Document title: Instructions-for-Use Review Log AI system: [System name and vendor]

Deployment confirmation: I confirm that [company name] has reviewed the above documentation and that our use of [AI system name] is within the scope described by the provider's instructions for use.

Signed: [Name, title, date]

Update this log each time the vendor issues updated instructions or significant product changes.

Gap 4: No transparency disclosure to affected individuals (Article 50)

What the law requires (since August 2, 2026): Article 50 splits the duty. Providers must design chatbots so people know they're talking to an AI unless it's obvious. Deployers must inform people exposed to emotion recognition or biometric categorisation (Article 50(3)) and must disclose deepfakes and AI-generated text published to inform the public on matters of public interest (Article 50(4)). The chatbot template below is still good practice when you put a vendor's assistant in front of customers.

What most SMEs are missing: No disclosure language in their product, website, or customer communications. Many teams assume the vendor handles this. The vendor handles their own disclosure as a provider. The deployer is separately obligated to disclose to affected individuals.

See the EU AI Act Article 50 watermarking and deepfake disclosure article for the full technical requirements.

Copy-paste template: AI interaction disclosure statement

For use at the start of customer interactions involving AI:

"You are interacting with an AI assistant operated by [Company Name]. This system uses artificial intelligence to respond to your messages. A human [is/is not] monitoring this conversation in real time. If you prefer to speak with a human representative, please [action, e.g., type 'human' or call our support line at X]."

For email or written communications that are AI-drafted:

"[Company Name] uses AI tools to assist in drafting communications. This message was [reviewed and approved / generated] with AI assistance."

For AI-assisted decisions affecting individuals (credit, employment, services):

"[Company Name] uses an automated system to assist in evaluating [applications/requests]. You have the right to request human review of this decision. Contact [name/email/phone] to request a review."

Add the appropriate disclosure to every customer-facing touchpoint where AI is active.

Gap 5: No incident monitoring log (Article 73)

What the law requires (from December 2, 2027): Article 73 makes providers report serious incidents to the market surveillance authority, no later than 15 days after the provider or deployer becomes aware. A deployer that identifies a serious incident must immediately inform the provider, then the importer or distributor and the authority (Article 26(5)). To do that, you need to be monitoring for incidents in the first place.

What most SMEs are missing: No log structure for AI-related incidents. No defined threshold for what counts as a serious incident. No designated person responsible for deciding whether an incident meets the reporting threshold.

Copy-paste template: AI incident monitoring log

Document title: AI Incident Monitoring Log System covered: [AI system name] Log owner: [Name, role]

Severity definitions:

• Minor: AI system error or unexpected output with no adverse impact on individuals.
• Serious: Any incident involving death, serious harm to health, serious damage to property, or serious adverse impact on individuals' fundamental rights.

Reporting threshold: Any incident classified as Serious must be passed to the provider immediately and to [national authority] as Article 26(5) requires. Designate [name/role] as the responsible person for this determination.

Log retention: Keep incident entries for the period your records policy sets. Separately, Article 26(6) makes deployers keep the logs a high-risk system generates automatically, where they control them, for at least six months.

Timeline summary: what applies to deployers now vs later

For a more detailed breakdown, the EU AI Act GPAI compliance checklist, August 2 deadline covers the GPAI-specific timeline in full.

How to prioritize if you are starting from zero

If your team has none of the five documents above, start in this order:

1. Article 50 disclosure: the only gap here that's already enforceable. If you publish deepfakes, use emotion recognition or biometric categorisation, or publish AI-generated text on matters of public interest, do this first.
2. Instructions-for-use log: review your vendor's documentation this week and record that you did it. One hour of work.
3. Human oversight procedure: document the review step your team already does informally.
4. Incident monitoring log: create the spreadsheet now, even with zero entries. You need the structure before an incident occurs.
5. Fundamental rights impact assessment: the most substantive effort. If you're a public body or public-service provider, or you score credit or price life or health insurance with AI, it's mandatory from December 2027 and takes the longest to do well.

The AI governance checklist 2026 covers the full set of governance documents a deployer should maintain, and the AI tool register template for small teams gives you the starting point for inventorying which systems you are using.

For broader governance structure, ISO 42001 vs NIST AI RMF for small teams compares the two main frameworks you can use as a foundation for all of this documentation.

Correction (October 19, 2026): Earlier versions said the Article 14, Article 27 and Article 73 duties for high-risk deployers applied from August 2, 2026, listed employment as an Article 27 category, called Article 9 a conformity assessment, and said Article 50 makes deployers disclose every AI chatbot. The AI Omnibus moved the Annex III high-risk rules to December 2, 2027; Article 27 covers public bodies, public-service providers and credit and insurance scoring; Article 9 is risk management; Article 50 splits chatbot disclosure (provider) from deepfake and emotion-recognition disclosure (deployer). Sources: consolidated AI Act, EUR-Lex, European Commission, AI Omnibus enters into force.

Related reading

• EU AI Act Annex IV technical documentation guide: all 9 sections
• EU AI Act compliance guide for small teams
• EU AI Act GPAI compliance checklist, August 2 deadline
• What's delayed vs what applies, EU AI Act August 2026
• AI governance checklist 2026
• AI vendor due diligence checklist 2026
• AI tool register template for small teams
• AI data privacy for small teams, GDPR/CCPA
• GDPR-compliant AI assistants comparison 2026
• EU AI Act Digital Omnibus August 2026: will the deadline hold?
• EU AI Act enforcement starts August 2, 2026: what it means and what to d
• EU AI Act high-risk AI documentation templates for August 2026 (Articles