Let’s talk about the law that just made the person who uses the machine answer for what it does.
Eleven days ago, the EU AI Act’s high-risk rules went live for the systems still coming to market. And almost all the coverage went to the builders. Risk management. Technical documentation. Conformity assessments. The whole compliance circus. Fair enough. That’s where the press releases live.
But buried in the same text there’s a part aimed at somebody else entirely. Article 26. The obligations of deployers.
Not the company that builds the model. The company that buys it. The bank that runs it over your loan. The clinic that screens your scans. The recruiter that ranks your application. From the second of August, the people who use a high-risk system carry legal duties most of them have never read.
Use it according to the provider’s instructions. Keep human oversight on it — real oversight, assigned to a person, not a rubber stamp. Monitor how it actually behaves, and report it when it starts doing something wrong. Keep logs. And in the cases that matter most — when the machine is judging you for a job, a loan, insurance, a border — tell the person that a machine was part of it.
Now here’s what nobody is covering.
The law just made the buyer responsible for a machine they didn’t build. They can’t see inside it. They can’t explain why it said what it said. The only map they have is the instructions — written by the company that sold it to them, in the language the seller chose, with the failure modes the seller left out.
That’s the catch. Responsibility without authority. The deployer answers for the machine’s behaviour. The deployer does not own the machine’s reasoning. The person signing the paperwork carries the liability. The person selling the model holds the explanation.
Picture the human scene. A small lending company buys an AI scoring tool to handle applications. The sales deck says it reduces risk. The contract says the model is just a tool and final decisions are theirs. Six months in, the model starts flagging people in one district at three times the rate. The company only notices because someone complains. Under the new rules, that company had duties. They were supposed to be monitoring. They were supposed to have a human looking at the output. They were supposed to keep logs. The machine made the mistake. The deployer eats the consequence.
And that’s exactly why the deployer obligations are the most important part of this law — and the most ignored. The builders got the lobbyists and the headlines. The buyers got a paragraph most of them will discover the hard way.
The thing people are missing: this law turns “the algorithm did it” into a defence that no longer works. The bank can’t say the model rejected you. The clinic can’t say the software misread it. The law looks at the deployer and says: you chose to run it. You watched it. You answer for it.
Which is right. And which is terrifying, because it puts legal weight on people who have almost no leverage over the thing they’re now responsible for.
So here’s the operator lesson, and it applies whether you’re in Europe or selling into it. Before you buy a high-risk AI system, ask what you’re actually buying. Not the features. The visibility. Can you see the model’s reasoning? Can you audit what it did last quarter? If you can’t, can you switch it off without breaking the business? If the answer to any of those is no, you haven’t bought a tool. You’ve bought a liability with a subscription.
And the moment that model makes a mistake, the provider’s instructions become your excuse or your trap. Read them like a contract. That’s what they are now.
Eleven days in, most deployers still think compliance is the builder’s problem. It isn’t. The builder sold the capability. The buyer owns the consequence.
The law finally put a name on the responsibility. Now the buyers have to catch up.
If you run a system that decides about people, go read the part of the law you skipped. Article 26 is eleven days old, and it’s already older than most companies’ risk policies. You bought the machine. You answer for it. Make sure that’s a position you can actually defend.