High-Risk AI: Deployer Obligations

What Is High-Risk AI: Deployer Obligations?

A high-risk AI system has to meet seven requirement areas before launch, and most of them are the provider's to prove. You'll run a deployer's review of a system used on employee performance reviews, check the vendor's evidence area by area, and find the gaps that block launch. You'll leave knowing which duties are yours as the deployer, such as informing workers and assigning human oversight.

What You'll Learn in High-Risk AI: Deployer Obligations

• Identify the seven requirement areas for high-risk AI systems under the EU AI Act
• Conduct a compliance assessment for a high-risk AI deployment
• Recognize that human oversight cannot be replaced by accuracy metrics
• Understand that an employer must inform workers before using high-risk AI at work
• Respond correctly when compliance gaps are discovered before deployment

High-Risk AI: Deployer Obligations — Training Steps

1. High-Risk AI Requirements

   High-risk AI systems carry the strictest obligations under the EU AI Act. The system must meet seven requirements (Articles 9-15), and that is the provider's job (Article 16). As the deployer, check the provider's evidence for each before use, then meet your own duties under Article 26: Risk management across the lifecycle Data governance - relevant, representative, unbiased training data Technical documentation of design and function Record-keeping - automatic logging and audit trails Transparency - clear instructions for use to deployers Human oversight - humans can effectively supervise Accuracy, robustness, and cybersecurity This exercise walks through a deployer's review: checking the provider's evidence and closing your own gaps.

2. Email from the CISO

   An email arrives from James Morton, Pinnacle Group's CISO. The AI vendor has delivered the employee performance review system, and Alice must complete the compliance review before it goes live. The email links directly to the AI Systems Registry on the governance portal.

3. AI Systems Registry

   The AI Systems Registry loads with three entries: PerformanceAI (the new high-risk system flagged for review), plus two already-compliant systems (EmailGuard and ChatAssist). The registry tracks risk tier, compliance status, and audit history for every AI system at Pinnacle Group.

4. Compliance Assessment

   The PerformanceAI system has clear gaps in its compliance status: a FRIA is not required for a private employer, but the affected workers have not yet been informed, no human reviewer has been assigned, and data governance is still pending review. Alice clicks Run Compliance Assessment inside the PerformanceAI entry to open the detailed checklist for this system.

5. Flag the Gaps

   Alice works through each requirement section and flags only the items that are NOT satisfied. Data Governance has an unaddressed gap: training data representativeness across employee demographics has never been assessed. Human Oversight has another: no qualified human reviewer has been assigned with override authority. The remaining sections are in good shape and need nothing flagged. During the review, Alice encounters a note from the vendor: 'Human oversight is not needed because the algorithm has 99.2% accuracy in performance scoring.' This claim needs to be evaluated against what the EU AI Act actually requires.

6. Human Oversight Requirement

7. Critical Gaps Identified

   The review found three gaps to fix before PerformanceAI goes live: Workers not informed - Article 27's FRIA does not apply to a private employer, but Article 26(7) requires informing workers' representatives and affected workers before use at work. No designated human reviewer - nobody has the authority and training to override scores. Article 26(2) requires assigning oversight to competent, trained people with authority (Article 14). Data representativeness not assessed - Article 10 is the provider's duty, so Pinnacle must request PerformanceAI Inc.'s data governance documentation before launch. The system cannot be deployed until all three are resolved.

8. Remediation Email

   Alice drafts an email back to the CISO detailing the compliance gaps and recommending that the launch be postponed until all issues are resolved.

9. Compliance Before Deployment

   High-risk AI deployment is not just 'install and configure.' It is a structured compliance process with ongoing obligations. The seven requirement areas are not checkboxes to rush through - they protect people affected by AI decisions. Key takeaways: All seven requirement areas must be independently satisfied before deployment, and the deployer should see the provider's evidence for each: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy/robustness/cybersecurity. Inform workers first. Before using high-risk AI at work, the employer must inform workers' representatives and the affected workers (Article 26(7)). A FRIA is mandatory only for public bodies, public-service providers and credit-scoring and life and health insurance deployers (Article 27). Human oversight cannot be replaced by accuracy . Even a 99.9% accurate system requires a designated human with override authority. If your compliance review finds gaps, the correct response is to delay deployment until they are resolved - not to deploy and fix later.