Your vendor’s compliance certificate doesn’t satisfy your Article 26 obligations

Most organisations using third-party AI systems assume their vendor’s certifications cover their own compliance position. They don’t.

Article 26 of the EU AI Act gives deployers independent obligations, covering inventory, classification rationale, human oversight documentation, log retention, and incident escalation, that run parallel to, and cannot be satisfied by, provider-side documentation.

With August 2, 2026 still the operative deadline pending a formal political agreement on any delay, deployers who haven’t started building their evidence base are running out of runway.

Full analysis on The First Stride