What does Article 13 of the EU AI Act require?

Article 13 requires providers to design high-risk AI systems so that deployers can interpret the output and use it appropriately, and to supply instructions for use. Telling people about the system is a separate deployer duty: under Article 26(11), deployers of Annex III systems that make or help make decisions about natural persons must inform them.

What must the Article 13 instructions for use contain?

The instructions for use must include: the identity and contact details of the provider, the system's intended purpose and limitations, the level of accuracy and applicable fairness metrics, the expected lifetime and maintenance requirements, a description of input data requirements, information about circumstances where outputs may be unreliable or require human review, and the human.

Who bears the transparency obligation under Article 13, the provider or the deployer?

Article 13 itself binds the provider, who must produce instructions for use with enough transparency information. The deployer's matching duties are in Article 26: use the system in accordance with those instructions (26(1)) and, for Annex III systems that make or help make decisions about people, inform those people (26(11)).

Does Article 13 apply to deployers using GPAI models in high-risk contexts?

If a deployer uses a GPAI model in a way that brings it within the scope of Annex III high-risk AI categories, the full Article 13 obligations apply. This means the deployer effectively takes on provider-equivalent transparency obligations for the specific high-risk application, because the GPAI provider's generic instructions for use will not address the specific high-risk use case.

What is the standard for adequate user notification?

Article 26(11) does not set a format for the notice. The separate Article 50 disclosures, such as telling people they are talking to a chatbot, must be given "in a clear and distinguishable manner" at the latest at the first interaction (Article 50(5)).

EU AI Act Article 13: What Deployers Must Tell Users

Q: How does Article 13 interact with GDPR Article 22?

GDPR Article 22 requires organizations to provide meaningful information about the logic of automated decision-making when a decision produces legal or similarly significant effects on an individual. EU AI Act Article 26(11) requires deployers of Annex III systems to tell people that a high-risk AI system is used. Both can apply to the same interaction.

TL;DR: Article 13 is a provider duty: a high-risk AI system must be transparent enough for deployers to interpret its output and use it appropriately, and must come with instructions for use covering capabilities, limitations and accuracy. Deployers must use the system in accordance with those instructions (Article 26(1)), and deployers of Annex III systems that make or help make decisions about people must tell those people (Article 26(11)). After the Digital Omnibus, Regulation (EU) 2026/1744, these rules apply from December 2, 2027 for Annex III systems and from August 2, 2028 for high-risk AI in Annex I products.

Article 13 of the EU AI Act is the transparency provision for high-risk AI systems. It sits with the other requirements providers must build into a high-risk system (the risk management system in Article 9, the data governance requirements in Article 10, human oversight in Article 14, accuracy and robustness in Article 15). The deployer's own duties are in Article 26. Understanding Article 13 requires understanding both sides of the supply chain, because the information runs in sequence: provider to deployer, deployer to the people affected.

This guide explains both levels of the obligation, what the instructions for use document must contain, how transparency requirements interact with GDPR Article 22, and what adequate user notification looks like in practice.

Article 13 overview: two levels of transparency

Article 13 establishes a two-level transparency structure for high-risk AI systems.

At the first level, providers must design and develop their systems so that "their operation is sufficiently transparent to enable deployers to interpret a system's output and use it appropriately" (Article 13(1)). This is a design obligation, not just a documentation one. A system that cannot produce usable transparency information is non-compliant with Article 13 regardless of what paperwork accompanies it.

The second level comes from Article 26(11), not Article 13: deployers of Annex III high-risk systems that make or help make decisions about natural persons must inform those people that they are subject to the use of the system. For law enforcement uses, Article 13 of Directive (EU) 2016/680 applies instead.

The two levels are separately enforceable. A provider with deficient instructions violates Article 13 even if the deployer handles notification correctly. A deployer who fails to notify people breaches Article 26(11) even if the provider's documentation is complete.

Provider obligations: the instructions for use

The instructions for use are the primary Article 13 deliverable for providers. Every high-risk AI system must be accompanied by instructions for use that meet the content requirements of Article 13(3).

Identity and contact details. The instructions must identify the provider by name and provide contact information for technical support and compliance inquiries. For systems distributed through intermediaries, the provider's identity must still be clearly stated.

System capabilities and limitations. The instructions must describe what the system is designed to do and what it is not. Limitations include: the population on which the system was validated, the data types it processes, the decision contexts for which it is appropriate, and contexts for which it has not been validated.

Input data requirements. The instructions must specify what input data the system requires, what format and quality standards apply, and what happens to output quality when inputs deviate from the required specification.

Accuracy, robustness, and cybersecurity metrics. Article 13(3)(b)(ii) requires the level of accuracy, "including its metrics", robustness and cybersecurity against which the system was tested and validated, and point (v) adds its performance on specific persons or groups "when appropriate". Vague statements like "high accuracy" do not satisfy the requirement.

Human oversight measures. The instructions must describe what oversight the system requires and what indicators suggest a human should review or override an AI output.

Circumstances where outputs may be unreliable. If the system performs differently on certain demographic groups, in certain data environments, or under certain operational conditions, those circumstances must be disclosed. Failure to disclose known reliability limitations is one of the most likely sources of Article 13 enforcement action.

Expected lifetime and maintenance requirements. The instructions must cover how long the system is expected to remain accurate and what maintenance or retraining is required.

Team reviewing AI system documentation and transparency requirements

Deployer obligations: using the system and notifying users

Deployers have two distinct obligations under Article 26 that build on Article 13.

Obligation 1: Use the system as the instructions say. Article 26(1) requires deployers to take appropriate technical and organisational measures to use high-risk systems "in accordance with the instructions for use". A deployer that makes a substantial modification to a high-risk system, or changes a system's intended purpose so that it becomes high-risk, becomes its provider under Article 25(1), with the full provider obligations including Article 9, technical documentation, and conformity assessment. Review the instructions for use carefully before deployment.

Obligation 2: Tell the people affected. Article 26(11) requires deployers of Annex III high-risk systems that make or help make decisions about natural persons to inform them that they are subject to the use of the system. For law enforcement uses, Article 13 of Directive (EU) 2016/680 applies instead.

The notification obligation is the most visible part of this chain for end users, and the most likely to generate complaints if missing.

The "meaningful information" standard

Article 26(11) does not set a format for the notice. A notice that actually helps the person goes beyond a checkbox; we use "meaningful information" as the working standard.

Meaningful notification tells the end user four things:

That an AI system is involved in a decision or assessment that affects them.
What the AI system is doing (screening their application, assessing their creditworthiness, analyzing their medical images).
What the outputs of the AI system will be used for (whether the output will be the sole basis for a decision, or one input among several).
Who to contact to ask questions about the AI system's role in the decision.

A privacy policy disclosure that mentions AI in general terms, buried on page 12 of a terms of service, does not satisfy this standard. The notification must be specific to the system, specific to the use case, and delivered at or before the point at which the AI system begins processing data about the individual.

Practical scenarios: what notice looks like in three high-risk contexts

AI hiring tool. An employer using an AI system to screen CVs must notify candidates before or at the time of application that their application will be assessed by an AI system. The notice should describe what the system evaluates, confirm that a human will review cases before any final decision, and provide contact information for questions. Under GDPR Article 22, if screening produces a legal effect such as rejection, the candidate is also entitled to a meaningful explanation of the logic used.

AI credit scoring. A lender must notify applicants at the point of application that an AI system is used in the assessment process. The notice should explain that the AI system produces a risk score that is one input into the credit decision, identify the data types used (transaction history, declared income), and confirm that a human decision-maker reviews applications before a final decision. GDPR Article 22 rights apply independently.

AI medical diagnostic tool. AI in a medical device is high-risk through Article 6(1) and Annex I when the device needs third-party conformity assessment, not through Annex III, so Article 26(11) does not apply to it. From August 2, 2028 the clinic, as deployer, must still use the tool in accordance with the instructions for use and assign human oversight to competent staff (Article 26(1) and (2)). Telling patients that an AI system reads their images and that a clinician reviews the output remains good practice.

GDPR Article 22 gives individuals the right not to be subject to solely automated decisions that produce legal or similarly significant effects, and entitles them to meaningful information about the logic of automated processing when such decisions do occur. EU AI Act Article 26(11) requires that individuals be told when an Annex III high-risk AI system makes or helps make decisions about them.

These obligations stack. Where an AI system makes or significantly influences a decision with legal or similarly significant effects on an individual, the deployer must comply with both:

The GDPR Article 22 right to explanation and the right to contest the decision.
The Article 26(11) duty to inform the people affected.

The two obligations have different triggers and different content requirements. GDPR Article 22 requires explanation of the logic of a specific automated decision after it is made. Article 26(11) requires telling people that the high-risk system is used. Deployers in contexts involving automated decisions (credit, hiring, insurance, welfare benefit assessment) need processes that satisfy both.

GPAI models in high-risk deployment contexts

A growing deployment pattern involves organizations using a general-purpose AI model (a large language model or similar) in a context that constitutes a high-risk application. For example, a law firm using a GPAI model to assess evidence files in a legal context, or an HR department using a GPAI model to score candidate applications.

In these cases, the GPAI provider's instructions for use and transparency documentation will not cover the specific high-risk use case. The GPAI provider has documented the model's general capabilities, not the specific employment screening or legal assessment application.

The deployer in this situation effectively becomes the provider of a new high-risk AI application. This means the deployer must produce their own instructions for use that address the Article 13 content requirements for their specific use case, and must provide the required end-user notification based on those instructions.

This is one of the most frequent compliance gaps in current deployments. Organizations using GPAI models for applications that map to Annex III categories should seek explicit legal advice on whether they have taken on provider-equivalent obligations and how to meet the Article 13 requirements for their specific application.

Instructions for use template structure

A minimal Article 13 instructions for use document that satisfies audit review includes:

Provider identity, address, and contact information for technical and compliance inquiries
System name, version, and intended purpose statement
Annex III category or categories under which the system is classified as high-risk
Capabilities description: what the system does and the output types it produces
Limitations and scope restrictions: what the system is not designed to do, contexts where it has not been validated
Performance metrics: accuracy, robustness, and fairness metrics with methodology description
Input data requirements: format, quality, and population specifications
Circumstances of unreliability: known conditions where output quality decreases
Human oversight requirements: what oversight is required, what indicators trigger human review
User notification guidance: what deployers must communicate to end users and when
Maintenance requirements: expected lifetime, retraining intervals, performance degradation indicators
Cross-reference to Article 9 risk management record (available on request for conformity assessment)

What Article 13 compliance looks like in practice for deployers

For deployers, the practical question is operational: for each Annex III system that makes or helps make decisions about people, do you have a process that tells those people before or at the start of the process?

The notification process needs to be documented. When a regulator asks for evidence that you have met the Article 26(11) notification obligation, you need to show the notification itself (the text, the screen, the form field), evidence of when it is displayed in the user journey, and a record of how you checked that the people receiving it can understand it.

For teams working through the broader deployer compliance picture, the EU AI Act deployer evidence gaps guide covers the most common documentation shortfalls across the full deployer obligation set. For the full high-risk AI documentation stack, the EU AI Act Article 9 risk management system guide covers the upstream documentation that Article 13 transparency obligations depend on.

Correction (October 23, 2026): Earlier versions said these obligations apply "from August 2027". Under Regulation (EU) 2026/1744, the Digital Omnibus, the high-risk rules apply from December 2, 2027 for Annex III systems and from August 2, 2028 for high-risk AI in Annex I products (consolidated AI Act, Article 113). Earlier versions also put the deployer's duty to tell people under Article 13 (it is Article 26(11), and only for Annex III systems that make or help make decisions about people), misquoted Article 13(1), cited point (b)(iii) for accuracy metrics (it is (b)(ii)), and said a clinic must notify patients about a diagnostic AI tool under the same rule.