High-Risk AI System Deployer Checklist

How to use this document

• What it is for. This is a checklist for an organization that uses, under its authority, a high-risk AI system bought or contracted from a vendor (the "deployer" under Regulation (EU) 2024/1689). It walks through each paragraph of Art. 26, the Art. 27 fundamental rights impact assessment trigger and the Art. 86 right to explanation, and for each one states what to do, what evidence to keep and which document the work is done in.
• What it does not cover. If the organization develops the system, places it on the market under its own name or trademark, makes a substantial modification or changes its intended purpose, it takes on provider obligations (Art. 25): use the "High-Risk AI Technical File and Quality Management System" instead.
• Who should own it. The system owner completes one checklist per system; the AI lead reviews it and the AI committee approves use. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to make first. Confirm that the system is high-risk and in which category (section 2), whether the organization is a public body or provides public services, and whether the use is creditworthiness assessment or life and health insurance (section 4).
• Fields to complete. Fill in the header, the "Status" column and the "Evidence location" column in section 3. Mark "Not applicable" with the reason when a paragraph does not apply.
• Country variants. It has no variants: it is a document for systems used in the European Union. Each Member State's market surveillance authorities and the application dates appear in "Related regulatory references".
• Review. Ask Legal to confirm the system's classification and whether a FRIA applies, and the Data protection officer to review paragraphs 26(9) and 26(11).
• Approval. The AI committee decides using the common vocabulary (Approve, Approve with conditions, Reject, Escalate) in section 7, and the decision is recorded in the "AI System Inventory".

High-Risk AI System Deployer Checklist

Field	Value
Organization	[LEGAL ENTITY NAME]
AI system	[AI SYSTEM]
Vendor and version	[VENDOR] / [COMPLETE]
Intended purpose per the instructions for use	[COMPLETE]
High-risk category	[COMPLETE: Annex III point, or Annex I product]
Internal risk level	High
Deployment profiles	[COMPLETE: P1 to P5]
System owner	[OWNER]
Checklist date	[DATE]
Next review	[DATE]

1. Purpose and scope

1.1 [ORGANIZATION NAME] uses this checklist to document, before first use and at each review, how it addresses the obligations of a deployer of a high-risk AI system, and where the evidence for each one is kept.

1.2 One checklist is completed per high-risk AI system. High-risk systems always have the internal risk level High and follow the Red approval lane: they are approved by the AI committee, or by Management in a small organization, and reviewed at least every three months.

1.3 The obligations in this checklist apply from the date the Regulation sets for each category of system (see Related regulatory references). Before that date, the checklist serves to prepare the deployment.

2. Preliminary checks

No.	Check	Answer	If the answer is "yes" or "don't know"	Document
2.1	Does the use match any prohibited practice?	Yes / No / Don't know	Stop; level Unacceptable	Prohibited AI Practices Checklist
2.2	Is the system in an Annex III category or a safety component of an Annex I product?	Yes / No / Don't know	Continue with this checklist; confirm the category with Legal	AI Risk Classification Matrix
2.3	Has the vendor documented that its Annex III system is not high-risk (Art. 6(3))?	Yes / No	Request and file its analysis; check whether actual use matches the use analyzed	AI Vendor Due Diligence Checklist
2.4	Does the organization put its name or trademark on it, substantially modify it or use it for a purpose other than the intended one?	Yes / No	It takes on provider obligations (Art. 25)	High-Risk AI Technical File and Quality Management System
2.5	Are current instructions for use from the vendor available?	Yes / No	If not, do not put into service until they are	AI Vendor Management Policy