Instructions for use: the Art. 13 package

A high-risk system must be designed and developed so that its operation is sufficiently transparent for deployers to interpret its output and use it appropriately, and it must come with instructions for use in an appropriate digital or other format (Art. 13(1)–(2)). The instructions are the hinge between the provider's duties and the deployer's: everything a deployer does under Art. 26 starts from them.

What Art. 13(3) requires

Concise, complete, correct and clear information that is relevant, accessible and comprehensible to deployers, covering:

• (a) the provider's identity and contact details, and its authorised representative's where there is one;
• (b) the system's characteristics, capabilities and limitations of performance — its intended purpose, the accuracy, robustness and cybersecurity levels it was tested against, known or foreseeable circumstances that may lead to risks, its technical capabilities to explain output where relevant, its performance for the specific persons or groups it is intended for, input-data specifications, and information for deployers to interpret the output;
• (c) any changes to the system pre-determined by the provider at the initial conformity assessment;
• (d) the human oversight measures (Art. 14), including the technical measures that help deployers interpret output;
• (e) the computational and hardware resources needed, the expected lifetime, and the maintenance and care measures, including software updates;
• (f) where relevant, a description of the mechanisms that let deployers collect, store and interpret the logs (Art. 12).

In Veritome — the provider's side

The instructions for use is a per-system structured document in Documents, opened in its own editor, the IFU package. Its checklist follows the Art. 13(3) points, and the package shows how complete it is — how many of the required elements are documented, as a percentage. It renders as a printable A4 document, and the page is the one you share with deployers, importers and distributors. The Art. 13 obligation sits in the Build & document stage and, for Annex III systems, applies from 2 December 2027.

In Veritome — the deployer's side

A deployer records receipt of the provider's instructions on its own system, on the Art. 26(1) obligation — Use system per provider's instructions for use, under Received documentation in the system's Obligations: what was received and when. That receipt is where the deployer's duties begin — using the system in accordance with the instructions (Art. 26(1)), assigning oversight on the basis of the measures the instructions describe (Art. 26(2)), monitoring on their basis (Art. 26(5)), and using the information in them to carry out a DPIA under GDPR Art. 35 (Art. 26(9)). That last one is one of the Act's own reuse routes: Veritome shows it on the DPIA obligation and lets you record reliance without changing the status — see DPIA overlap.

Importers and distributors see their verification obligations instead — in the Supply chain domain of the system's Obligations — the checks they owe under Art. 23 and Art. 24, including that the instructions accompany the system.

Where it feeds

The instructions for use are one of the Annex VIII fields the EU-database registration asks for, a component of the Annex IV technical file, and the document an importer must keep for ten years (Art. 23(5)). Producing it once in the editor feeds all three.