EU AI Act for Industry: AI in Products, Plants and Factories

Under Art. 6(1), an AI system is high-risk where it is intended to be used as a safety component of a product, or is itself a product, covered by the harmonisation legislation in Annex I, and where the product has to undergo a third-party conformity assessment under that legislation. Both conditions must be met.

For products in Section A – such as lifts, equipment for potentially explosive atmospheres, radio equipment, pressure equipment, personal protective equipment, appliances burning gaseous fuels and medical devices – conformity assessment follows the relevant product legislation, which incorporates the AI Act requirements (Art. 43(3)). A single set of technical documentation is drawn up containing the information required by both (Art. 11(2)).

Where a product manufacturer places the product with the AI safety component on the market under its own name, it is considered the provider of the high-risk AI system (Art. 25(3)). After the Digital Omnibus, the obligations for these products apply from 2 August 2028.

Originally, machinery law was listed in Section A, so AI safety functions in machines would have triggered the full high-risk obligations of the AI Act. The Digital Omnibus moved the Machinery Regulation (EU) 2023/1230 to Section B to avoid overlaps between the two sets of rules.

For products in Section B, only a few AI Act provisions apply directly, namely Art. 6(1), Art. 60a and Art. 102 to 112 (Art. 2(2)). The substantive requirements for high-risk AI are instead to be taken into the Machinery Regulation through a delegated act; following the Omnibus amendments, the Commission is to adopt it by 2 August 2028 at the latest. The Machinery Regulation itself applies from 20 January 2027.

For machine builders this means: conformity of AI safety functions is demonstrated through machinery law, not through a second procedure under the AI Act. Recommendation: follow the delegated act and the relevant standards, and document AI safety functions now so you can evidence risk assessment, data and tests later.

AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic or the supply of water, gas, heating or electricity are high-risk. This affects utilities and grid operators as well as industrial companies that manufacture or supply such systems.

The key term is safety component: AI that protects the security of supply, or whose failure can endanger the health and safety of people or property. AI that only optimises energy costs in your own plant usually does not qualify; AI that automatically intervenes in a utility’s grid or plant control may well do.

Point 2 has some particularities: the systems are registered at national level, not in the public EU database (Art. 49(5)). A fundamental rights impact assessment under Art. 27 is not required, and the right to explanation under Art. 86 does not apply to these systems. Conformity assessment is by internal control, as usual for points 2 to 8 (Art. 43).

AI systems for recruiting or selecting people, in particular to place targeted job ads, analyse and filter applications and evaluate candidates, are high-risk (point 4(a)). So are systems for decisions affecting terms of work, promotion and termination, for allocating tasks based on individual behaviour or personal traits and for monitoring and evaluating performance and behaviour (point 4(b)).

In industry this often concerns purchased recruiting and apprenticeship tools, but also shift planning and shop-floor systems that evaluate workers or assign them based on behaviour. As the employer you are the deployer: before putting the system into service in the workplace, you must inform workers’ representatives and the affected workers (Art. 26(7)). Further co-determination rights under national law remain unaffected.

Inferring emotions in the workplace is clearly prohibited, except for medical or safety reasons (Art. 5(1)(f)). Systems that only detect fatigue, for example of drivers to prevent accidents, are not emotion recognition according to recital 18. Recommendation: review such systems carefully anyway, including under data protection and employment law.