(5) Deployers shall monitor the operation of the high-risk AI system on the basis of the instructions of use and when relevant, inform providers in accordance with Article 61.When they have reasons to consider that the use in accordance with the instructions of use may result in the AI system presenting a risk within the meaning of Article 65(1) they shall, without undue delay, inform the provider or distributor and relevant market surveillance authority and suspend the use of the system. They shall also immediately inform first the provider, and then the importer or distributor and relevant market surveillance authorities when they have identified any serious incident. If the deployer is not able to reach the provider, Article 62 shall apply mutatis mutandis. This obligation shall not cover sensitive operational data of deployers of AI systems which are law enforcement authorities. For deployers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services legislation, the monitoring obligation set out in the first subparagraph shall be deemed to be fulfilled by complying with the rules on internal governance arrangements, processes and mechanisms pursuant to the relevant financial service legislation. (10) Without prejudice to Directive (EU) 2016/680, in the framework of an investigation for the targeted search of a person convicted or suspected of having committed a criminal offence the deployer of an AI system for post-remote biometric identification shall request an authorisation, prior, or without undue delay and no later than 48 hours, by a judicial authority or an administrative authority whose decision is binding and subject to judicial review, for the use of the system, except when the system is used for the initial identification of a potential suspect based on objective and verifiable facts directly linked to the offence. Each use shall be limited to what is strictly necessary for the investigation of a specific criminal offence. If the requested authorisation provided for in the first subparagraph of this paragraph is rejected, the use of the post remote biometric identification system linked to that authorisation shall be stopped with immediate effect and the personal data linked to the use of the system for which the authorisation was requested shall be deleted. In no case shall such high-risk AI system for post-remote biometric identification be used for law enforcement purposes in an untargeted way, without any link to a criminal offence, a criminal proceeding, a genuine and present or genuine and foreseeable threat of a criminal offence, or the search for a specific missing person. It shall be ensured that no decision that produces an adverse legal effect on a person may be taken by the law enforcement authorities based solely on the output of such post-remote biometric identification systems. This paragraph is without prejudice to the provisions of Article 10 of the Directive (EU) 2016/680 and Article 9 of the GDPR for the processing of biometric data. Regardless of the purpose or deployer, each use of these systems shall be documented in the relevant police file and shall be made available to the relevant market surveillance authority and the national data protection authority upon request, excluding the disclosure of sensitive operational data related to law enforcement. This subparagraph shall be without prejudice to the powers conferred by the Directive 2016/680 to supervisory authorities. Deployers shall, in addition, submit annual reports to the relevant market surveillance and national data protection authorities on the uses of post-remote biometric identification systems, excluding the disclosure of sensitive operational data related to law enforcement. The reports can be aggregated to cover several deployments in one operation. Member States may introduce, in accordance with Union law, more restrictive laws on the use of post remote biometric identification systems. (11) Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system. For high risk AI systems used for law enforcement purposes Article 13 of Directive 2016/680 shall apply. (12) Deployers shall cooperate with the relevant national competent authorities on any action those authorities take in relation with the high-risk AI system in order to implement this Regulation.