EU AI Act Article 13: What Your Instructions for Use Must Contain, and What Deployers Should Demand From Vendors
EU AI Act Article 13: What Instructions for Use Must Contain, and What Deployers Should Demand
If you buy a high-risk AI system, the document you will lean on hardest is the one most buyers never read closely: the instructions for use. Article 13 makes that document a legal requirement, and Article 26 makes the deployer's compliance depend on it. This guide sets out what the instructions must contain and how to test a vendor's version.
The design duty comes first
Article 13(1) is not only about paperwork. High-risk systems must be designed and developed so that their operation is sufficiently transparent for deployers to interpret the output and use it appropriately[1]. The level of transparency has to support the provider's and deployer's own compliance duties. A black box with a thick manual does not satisfy that.
What Article 13(3) requires
The instructions for use must contain at least the following[1]:
| Required content | What a deployer should ask to see |
|---|---|
| (a) Provider identity, contact details and EU authorised representative | Named legal entity and a working contact route for incidents |
| (b) Capabilities and limits: intended purpose; accuracy, robustness and cybersecurity levels; foreseeable misuse; explainability; performance for specific groups; input data specs; training, validation and testing data information | Test reports with metrics, subgroup results, known failure modes, input format requirements |
| (c) Pre-determined changes assessed at conformity assessment | A list of changes the vendor may make without a new assessment |
| (d) Human oversight measures under Article 14 and technical aids for interpreting outputs | Screens or tools for operators, override procedures, training requirements |
| (e) Computational and hardware resources, expected lifetime, maintenance and update frequency | Support period, patch cadence, hosting requirements |
| (f) How to collect, store and interpret logs | Log schema, retention guidance and export method |
Item (b) carries most of the weight. Look for specifics: a stated accuracy figure with the dataset and conditions it was measured under, and subgroup performance where discrimination risk is relevant. A claim such as "highly accurate" is not a metric.
Compare the instructions against your own use case. If your deployment differs from the stated intended purpose, you may be changing what the system is for, which can shift provider duties onto you under Article 25.
Why deployers should care
Deployers must use high-risk systems in accordance with the instructions. Article 26 puts this duty on deployers, and obligations for Annex III systems now apply from 2 December 2027 following the Digital Omnibus[2][3]. That gives buyers roughly a year to find out whether vendors can actually produce a compliant document. The instructions also feed other deployer tasks: the oversight design (see our Article 14 guide), log handling (Articles 12 and 19) and, for some deployers, the fundamental rights impact assessment under Article 27.
Where standards stand
Harmonised standards would give providers a presumption of conformity for Article 13. The picture is thin. EN 18286:2026, the quality management system standard, was cited in the Official Journal on 14 October 2026 through Commission Implementing Decision (EU) 2026/2274[4], but it covers quality management, not transparency. Standards for other requirements, such as risk management and accuracy and robustness, are still in development[4]. Also note that ISO/IEC 42001 does not create a presumption of conformity[4]. For now, a vendor's own structured instructions are the main evidence you will get.
A skeleton for providers
Providers can use the Article 13(3) list as a table of contents and add three things buyers value: a version history tied to the conformity assessment, a plain-language summary of limits for end operators, and a section stating which deployments are out of scope.
One section per lettered item, so a reviewer can tick each one off.
Link metrics to test reports and datasets rather than quoting numbers alone.
Have a customer try to configure oversight and log export from the document alone.
Update the instructions with every change that affects performance or intended use, and tell customers.
Do instructions for use have to be a separate document?
The Act requires them to accompany the system in an appropriate digital or other format. What matters is that they contain the Article 13(3) information and are accessible to deployers.
Does Article 13 apply to limited-risk chatbots?
No. Article 13 covers high-risk systems. Chatbot disclosure duties sit in Article 50.
Can a vendor refuse to share training data details?
Article 13(3)(b) requires relevant information about training, validation and testing data sets, where relevant. Ask what is provided and how it supports your own duties.
Is there an official template?
Not at the time of writing. Use the Article 13(3) list as the structure.
When does this apply?
For Annex III high-risk systems, from 2 December 2027 after the Digital Omnibus.
This article is general information, not legal advice.
Sources: Article 13, AI Act; Article 26, AI Act; ActuIA on Omnibus 2026/1744; Alethexis on harmonised standards.
Related reading
Article 14 EU AI Act: Engineering Human Oversight That Actually Works
Article 14 is a design obligation, not an HR policy. Here's how to engineer the five oversight capabilities, split provider vs deployer duties, handle the biometric two-person rule, and build an audit-ready evidence trail.
GPAI Models With Systemic Risk: The Safety and Security Chapter of the Code of Practice, Explained
Providers of the most capable general-purpose AI models carry extra duties. Here is what the Safety and Security chapter of the GPAI Code of Practice asks for, the incident timelines, and the dates that matter now the AI Office can enforce.
EU AI Act Article 4 AI Literacy: National Enforcement Has Started - What Evidence Regulators Will Actually Ask For
Article 4 has applied since February 2025, and national authorities gained enforcement powers on 2 August 2026. Here is what counts as sufficient AI literacy, what the Digital Omnibus changed, and the evidence file regulators will expect.