What statutory obligations apply to the deployer of high-risk AI systems?

From 2 August 2026, Regulation (EU) 2024/1689 (‘AI Regulation’) will be fully applicable throughout the EU. The AI Regulation is the world’s first source of statutory obligations regarding the development and use of AI systems.

This article explains the statutory obligations that will apply to the deployer of a high-risk AI system.

 

Warning: Changing legal framework

The European AI Regulation is evolving. On 19 November 2025, the European Commission proposed the ‘digital omnibus package’ to simplify digital rules. This led to the adoption of Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI). Although these amendments are already in force, not every proposed change from the Digital Omnibus Package has yet been implemented. Further significant changes to the AI Regulation, such as delays during the phased entry into force, cannot be ruled out. The European Commission aims to make digital regulation less distortive of competition, which may have implications for the entire ‘Digital Rulebook’.

 

Important to note when reading:

This article is based on legislation that may have since been amended. The definitive impact of the simplification agenda (von der Leyen II Commission) is as yet unpredictable. On 26 June 2026, the Social and Economic Council (SER) also expressed serious concerns in a letter to parliamentary committees and government ministers regarding the quality, speed and legitimacy of the European legislative process since the von der Leyen I Commission. At the time of writing, it is not yet clear whether the EU Member States will intervene in this development.

Warning: On 19 November 2025, the European Commission published a proposal for a Digital Omnibus Regulation on AI (‘Digital Omnibus: AI’). The Digital Omnibus contains a series of proposals to simplify the AI Regulation, to reduce the extent of ‘top-down’ intervention in the development and adoption of AI, and to postpone the timeline for the implementation of the AI Regulation. At the time of writing, it is not yet possible to predict what the outcome of the simplification agenda will be. This article is based on the current text of the legislation prior to the implementation of any simplifications.

 

1.    Statutory definitions

The AI Regulation contains the world’s first statutory definitions for ‘artificial intelligence’, which is itself an umbrella term covering a range of technologies. European directives and regulations, such as the AI Regulation, have their own definitions. The autonomous definitional framework is independent of the national legal definitions of EU Member States.

 

AI system

According to the AI Regulation, an AI system is: “a machine-based system designed to operate with varying levels of autonomy and capable of demonstrating adaptability following its deployment, and which, for explicit or implicit purposes, derives from the input received how to generate output such as predictions, content, recommendations or decisions that may affect physical or virtual environments.”

An AI system is not the same as an AI model: “an AI model, even when trained on a large volume of data using large-scale self-supervision, which exhibits a significant degree of generality and is capable of competently performing a wide range of different tasks, regardless of how the model is placed on the market, and which can be integrated into a variety of systems further down the AI value chain or applications further down the AI value chain, with the exception of AI models used for research, development or prototyping activities prior to their being placed on the market.”

An example: the AI chat assistant ‘Claude’ as an app on your smartphone is an AI system from the AI systems provider, Anthropic PBC. The large language model on which the chat assistant runs, for example Claude 5: Opus, is an AI model.

 

Deployer

The AI Regulation defines a ‘deployer’ as: “a natural or legal person, public authority, agency or other body that uses an AI system under its own responsibility, unless the AI system is used in the context of a personal, non-professional activity.”

A deployer of an AI system is therefore not the same as the provider of an AI system. For example, if your company or organisation uses the AI system, the chat assistant ‘ChatGPT’, for certain work processes, then OpenAI Ireland Ltd is the provider of the AI system. Depending in part on the nature and severity of the risk posed by your use of the AI system, your company or organisation may now be subject to new statutory obligations.

 

High-risk AI system

The classification of an AI system as a ‘high-risk AI system’ is set out in Annex I and Annex III to the AI Regulation, which the European Commission will maintain by means of delegated acts. For the time being, high-risk AI systems relate, in any event, to use in the context of the following purposes:

• biometrics
• critical infrastructure
• education and vocational training
• employment
• human resources management and access to self-employment
• access to and use of essential private and public services and benefits
• law enforcement, migration, asylum and border control management
• the administration of justice and democratic processes.

An AI system referred to in Annex III shall not be considered a high-risk AI system where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, inter alia because it does not substantially influence the outcome of decision-making. Notwithstanding that exception, an AI system referred to in Annex III is always considered a high-risk AI system if it carries out profiling of natural persons. The new AI Office will also be empowered to advise on classification.

In short, it can probably be said that a particular AI system, in the context of your business or organisation, will be a ‘high-risk system’ if it poses a significant risk of harm to the health, safety or fundamental rights of natural persons, including because it substantially influences the outcome of decision-making

The AI Regulation defines risk as: the combination of the likelihood of harm and the severity of that harm.

 

2.    Statutory obligations for deployers of high-risk AI systems

Under Article 26 of the AI Regulation, the following obligations apply to the controller of a high-risk AI system:

• Appropriate use:
  • Use the system strictly in accordance with the user manual, employing appropriate technical and organisational measures.
• Human oversight:
  • Assign this task to competent, trained and supported individuals.
• Data quality:
  • Ensure that input data under your control is relevant and representative.
• Monitoring & incidents:
  • Monitor the system’s operation. Cease use in the event of product safety risks and report incidents immediately to the supply chain and the supervisory authority (financial institutions are subject to their own sector-specific legislation).
• Log files:
  • Retain automatic logs for at least 6 months, in accordance with the GDPR (financial institutions must comply with their own sector-specific legislation).
• Employees:
  • Inform employees (or their representatives) in advance about use in the workplace in accordance with applicable procedures.
• Government bodies:
  • Register the use in the EU database; do not use an unregistered system and report this lack of registration.
• DPIA:
  • Carry out a Data Protection Impact Assessment in accordance with the GDPR.
• Biometrics:
  • For remote biometric identification in the context of a criminal investigation, obtain prior (or within 48 hours) authorisation from the court or relevant authority.
• Duty to inform natural persons:
  • Inform natural persons that they are subject to AI-driven (or AI-supported) decision-making.
• Obligation to cooperate:
  • You must cooperate with the competent authorities in the implementation of the Regulation.

 

3.    The deployer of AI systems that are not high-risk AI systems

Given that the state of the art from which AI systems arise is very new and changing very rapidly, it is not yet possible to predict to what extent the statutory obligations imposed on deployers of high-risk AI systems will, by analogy, also give rise to relevant social (behavioural) standards with legal consequences. 

It is, however, clear that, under the AI Regulation, voluntary compliance with the standards that are mandatory for high-risk AI systems is explicitly encouraged for all other AI systems. For example, by taking into account the ethical principles for the development of voluntary best practices and standards in ‘codes of conduct’, whether sector-specific or not. These ethical principles are: human oversight and control, technical robustness and safety, privacy and data governance, transparency; diversity, non-discrimination and fairness, social and environmental well-being, and accountability.

We have previously written about drawing up AI policy:

https://www.wisemen.nl/nl/artikelen/deel-ii-ai-recht-hoe-maak-ik-ai-beleid-voor-mijn-eigen-bedrijf-of-organisatie-/ 

In other words, even if the statutory obligations under Article 26 of the AI Regulation do not apply, it may, depending on the circumstances, be prudent to align with these principles, for example when interpreting open statutory norms.

 

4.    Consequences of non-compliance with the AI Regulation

Under the AI Regulation, the penalty for a breach of Article 26 of the AI Regulation, pursuant to Article 99(4)(e) of the AI Regulation, is administrative fines of up to €15,000,000 or, if the offender is an undertaking, up to 3 percent of its total worldwide annual turnover for the preceding financial year, whichever is higher. The EU Member States determine the penalties within these maximum limits, in accordance with their own national legislation on administrative fines.

At national level, it remains to be seen which competent supervisory authority may be granted the power to impose sanctions by the national legislature. At the time of writing, a bill for the ‘Implementing Act for the AI Regulation (UAIV)’ is before the Dutch Parliament, which may provide clarity. It is also possible that, for the time being, the Ministry of Economic Affairs (EZ) will be responsible for supervising compliance with the new statutory obligations in the Netherlands.

The AI Office at the European Commission will have far-reaching powers from 2 August 2026, particularly with regard to providers of AI systems and developers of AI models. In general, in addition to providing general education on the AI Regulation, the AI Office is likely to focus its attention primarily on large multinational (AI) tech companies wishing to offer their services within the European single market.

 

5.    Any questions?

Does your company or organisation use AI systems? Are you seeking legal advice on how your organisation can manage the use of AI within the bounds of Dutch law? 

Get in touch with our IT lawyers today. They will be happy to assist you.