Article 26 sets duties for deployers of high-risk AI systems. VINCHY supports human oversight and traceability for actions routed through its gate. An approval, audit log or model label alone does not establish compliance.
Legal reference checked 27 October 2026: Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. Under Article 113, Chapter III Sections 1-3 apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to Article 111 transitional rules. These dates do not postpone every AI Act obligation.
Article 26 of the EU AI Act lists the obligations of deployers of high-risk AI systems. Here are the core duties, each mapped to a VINCHY capability.
VINCHY holds routed actions at a human-approval gate when required by its rules. A named owner supports accountability. The deployer must separately establish the reviewer’s competence, training, authority and support; a click alone does not establish meaningful oversight.
A policy engine encodes per-action rules and organisational guardrails. Actions outside policy are blocked or escalated to a human — so the agent is used the way it is meant to be.
A live dashboard shows every agent, its pending actions and an overturn-rate governance metric. Spot a problem and pause or disable any agent instantly.
Events routed through VINCHY are written to a tamper-evident, cryptographically signed (Ed25519) hash-chained audit trail, retained for at least six months. If a record is altered, verification breaks — so the log is provable, not just present.
Because every action carries who proposed it, who approved it and when, you can reconstruct exactly what happened and report it to the provider or authorities without guesswork.
Per-action records — the action, its justification and the human decision behind it — give you the basis to inform people affected by an AI-assisted decision.
One click exports an EU AI Act gap report, a Trust report and a human-readable audit timeline as PDF — the evidence an authority or auditor asks for, ready to hand over.
VINCHY records supplied model metadata for routed actions (Mistral, Claude, GPT-4o, Gemini, Llama, GLM…) and a region classification. Supplier evidence and deployment details still need verification before they support a data protection impact assessment.
Most AI compliance tools record what an agent did, after the fact — a flight recorder for the system's builder. Useful, but it cannot stop a wrong action.
VINCHY governs what an agent is allowed to do: a human approves risky actions before they run, and every decision is sealed in a tamper-evident record. Prevention, not just a recording.
Connect an agent, route its risky actions through VINCHY, and watch a clean audit trail build itself.
Article 26 sets out the obligations of deployers of high-risk AI systems. A deployer is any organisation that uses an AI system under its own authority. The duties include assigning competent human oversight, using the system according to the provider's instructions, monitoring its operation, keeping the automatically generated logs for at least six months, informing affected persons and workers, and cooperating with authorities.
A deployer is the person or company that uses an AI system in its business — as opposed to the provider, who builds it or places it on the market. If your company runs AI agents to get work done, you are the deployer, and Article 26 obligations can apply to you.
The EU AI Act entered into force in August 2024. Chapter III Sections 1-3, including Article 26, apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to Article 111 transitional rules. See Article 113 as amended by Regulation (EU) 2026/1744; other obligations have different dates.
Article 12 is a provider duty — the builder must enable automatic event logging. Article 26 is a deployer duty — the user must provide human oversight, monitor the system, keep logs and stay accountable. Different parties, different responsibilities. VINCHY focuses on the deployer side.
Under Article 26(6), deployers must keep the logs automatically generated by a high-risk AI system, where those logs are under their control, for a period appropriate to the purpose and at least six months, unless other law says otherwise.
The Act's maximum penalties reach €35 million or 7% of worldwide annual turnover for prohibited practices. Breaches of deployer obligations are subject to fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, subject to the SME/start-up lower-cap rule in Article 99(6) and the specific SMC rule in Article 99(6a).
VINCHY is a control layer for AI agents. It holds risky actions for human approval before they run, records every action on a tamper-evident, signed audit trail kept for at least six months, lets you monitor and pause agents, and exports auditor-ready reports. It works with agents from Zapier, n8n, Make and custom tools when the relevant actions are routed through VINCHY.
No. Article 26 applies to deployers of high-risk AI systems as defined by the Act. Whether a given agent is high-risk depends on its use case. VINCHY's control-and-evidence posture is useful either way — but it does not by itself satisfy all high-risk duties or replace the required assessment.
Article 50 distinguishes AI interaction notices, machine-readable synthetic-content marking and specific deployer disclosures. A generic email footer is not a complete implementation of every case. EU core hosting does not mean every optional delivery provider processes data only in the EU: review the subprocessor list. VINCHY supports evidence and controls; it does not issue an AI Act certificate.
See, approve and prove every action your AI agents take — and meet your Article 26 deployer obligations.
Create free account