Deployer duties you cannot contract away to your vendor
Procurement teams regularly try to push deployer obligations onto the supplier in the contract. It does not work, and it leaves a gap that only shows up in an audit.
The instinct is reasonable: if the provider built the system, the provider should carry the burden. The Regulation does not work that way. It assigns duties to the operator role, and a clause in a master services agreement does not change which operator you are.
What the contract cannot move
Human oversight sits with the deployer because only the deployer has the people. Monitoring sits with the deployer because only the deployer sees the outputs in their own context. Log retention sits with the deployer because the logs are generated where the system is used. None of these can be performed by a supplier at arm's length, however firmly the contract says otherwise.
What the contract genuinely should do
What procurement can secure is the evidence needed to discharge the duties that stay with you. Ask for the instructions for use in writing, the intended purpose in the Regulation's vocabulary rather than marketing language, the logging the system actually exposes, notice of model or prompt changes, and confirmation of whether customer data is used for training by default.
That is the useful ask. A clause purporting to transfer Art. 26 is not only ineffective, it is worse than nothing, because it creates a recorded belief that the duty was handled elsewhere.
Not legal advice. Contract terms belong with counsel; this is about what the obligation structure makes possible.