AI Act Requirements for AI in Machinery

Since July 27, 2026, artificial intelligence in machinery has been governed by a different legal act. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the Machinery Regulation from Section A to Section B of Annex I to the AI Act. As a result, little of the AI Act still applies to machinery with AI. The substantive requirements are to move into the Machinery Regulation by August 2, 2028.

The AI Act (Regulation (EU) 2024/1689) is the EU regulation that grades requirements for artificial intelligence by risk. It bans some uses outright. For high-risk AI systems, it requires risk management, data quality, documentation, and human oversight. For other systems, it mostly sets transparency obligations. Providers and deployers must take measures to support the AI literacy of their staff; since the Digital Omnibus, they no longer have to ensure a particular level. This obligation does not apply to high-risk AI systems in machinery, because only a few AI Act provisions still apply to them.

Contents

1. At a glance
2. Where the Digital Omnibus comes from
3. What the AI Act covers and who it applies to
4. Risk classes at a glance
5. When AI in a machine counts as high-risk
6. Why the Machinery Regulation is now responsible
7. The new deadlines
8. What manufacturers can do while the delegated act is missing
9. Requirements for high-risk AI systems
   1. Technical documentation and logging
   2. Data quality
   3. Transparency toward the deployer
   4. Human oversight
10. Conformity assessment and penalties
11. Does AI-based quality control need a conformity assessment under the AI Act?
12. Does the AI Act change the CE marking of a machine?

At a glance

• The AI Act sorts AI systems by risk: prohibited practices, high-risk AI systems, systems with transparency obligations, and everything else. There are two routes into the high-risk class: through the product and through a list of use cases.
• Through the product route, an AI function in a machine is high-risk only if it is a safety component and the product needs a third-party conformity assessment. The list of use cases also covers certain safety components directly.
• Since July 2026, functions for user assistance, efficiency, or quality control are expressly not safety components, as long as their failure does not put health and safety at risk.
• Since the move, only three parts of the AI Act still apply to AI in machinery. These are the classification rule, one provision on testing in real-world conditions, and almost all final provisions. The rules on AI regulatory sandboxes apply to the extent that the Machinery Regulation takes over the requirements.
• The requirements apply from August 2, 2028. Until then, a delegated act is to write them into the Machinery Regulation. As of October 2026, the Commission has neither published a draft nor adopted the act.

Where the Digital Omnibus comes from

The AI Act entered into force on August 1, 2024. Its provisions have been applying step by step since then. Originally, all of them were to apply from August 2, 2027. The EU legislator gained experience with the parts that already apply, and the cost of compliance turned out higher than expected.

The recitals name two causes. First, the standards that are meant to give providers of high-risk AI systems technical solutions were delayed. Second, the national governance and conformity assessment frameworks were set up late. Consultations with stakeholders showed a further need for measures that make implementation easier and clearer, without lowering the protection of health, safety, and fundamental rights.

The result is the Digital Omnibus on AI, Regulation (EU) 2026/1744 of July 8, 2026. It was published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026. It describes itself as a targeted amendment for an effective, simple, and uniform application. It amends three acts: the AI Act, the Machinery Regulation, and the civil aviation regulation, Regulation (EU) 2018/1139.

What the AI Act covers and who it applies to

Article 3, point (1), of the AI Act defines an AI system as “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments”.

This definition does not name any technology. Many explanations of the AI Act still list machine learning, logic- and knowledge-based approaches, and statistical methods. The regulation in force does not. You need to check two features: whether your system infers from its inputs how to generate its outputs, and whether it pursues explicit or implicit objectives in doing so.

The AI Act focuses on two roles. The provider develops an AI system and places it on the market. The deployer uses it. Product manufacturers are expressly covered when they place an AI system on the market or put it into service together with their product and under their own name or trademark. Importers, distributors, and authorized representatives have their own obligations, which can also lead to fines.

You know this split from the rest of EU regulation. There, the Cyber Resilience Act addresses the product side and the NIS2 Directive the operator side. In the AI Act, both roles sit side by side, so a machinery manufacturer can take on both.

The regulation reaches beyond the EU. It covers providers wherever they are established once they place an AI system on the market in the Union. It also covers providers and deployers in third countries if the output of the system is used in the Union. Pure scientific research is excluded, as are research, development, and testing before placing on the market. Testing in real-world conditions is not part of that exclusion.

Risk classes at a glance

Class	What falls under it	What follows
Prohibited practices	Social scoring, subliminal manipulation, exploiting vulnerabilities, untargeted scraping of facial images, emotion recognition in the workplace	Ban; for emotion recognition, an exception for medical or safety reasons
High-risk AI, route 1: through the product	AI as a safety component of a product that needs a third-party conformity assessment, or AI that is itself such a product	Risk management, data quality, documentation, human oversight, from August 2, 2028; for machinery through the Machinery Regulation
High-risk AI, route 2: through the list of use cases	Biometrics, critical infrastructure, education, and other areas listed in the AI Act	The same requirements, directly from the AI Act, from December 2, 2027
Systems with transparency obligations	Direct interaction with people, emotion recognition, biometric categorization, synthetic content, deepfakes	Disclosure to the people affected, machine-readable marking of generated content
Everything else	AI without these features, for example predictive maintenance without a safety function	No product requirements from the AI Act; the obligation to support staff AI literacy remains

One row of this table is easy to miss in machinery manufacturing. If you supply safety components for the operation of water, gas, heating, or electricity supply, the listed use cases bring you directly under the AI Act. The earlier deadline of December 2, 2027, then applies.

When AI in a machine counts as high-risk

Under Article 6(1) of the AI Act, two conditions must both be met. First, the AI system must be used as a safety component of a product covered by the product legislation listed in the AI Act, or be such a product itself. Second, that product must undergo a third-party conformity assessment involving a notified body.

The Digital Omnibus redefined the term safety component and added three clarifications:

• AI systems used exclusively for non-safety-related aspects of user assistance, performance optimization, performance efficiency, automation, usability, or quality control are not safety components.
• Conversely, any AI system whose failure or malfunction would put health and safety at risk is a safety component.
• The second condition is not met if a product undergoes third-party conformity assessment only because of risks other than those to health and safety. The AI Act gives the example of radiated radio frequencies that do not affect health and safety.

An AI-based vision system that removes rejected parts from a conveyor serves quality control only. It is therefore not a safety component. The same camera technology is a safety component when it detects a person in the danger zone and stops an axis, because its failure puts people at risk. Classification depends on the consequence of a failure. What the function is called in the requirements specification makes no difference.

This logic becomes uncomfortable for manufacturers who later integrate an assistance function into the safety circuit. Whether the second condition is met is then decided by the Machinery Regulation.

Why the Machinery Regulation is now responsible

Annex I to the AI Act lists, in two sections, the product legislation on which the classification as a high-risk AI system depends. Until July 2026, Section A included the Machinery Directive (Directive 2006/42/EC). The Machinery Regulation only replaces that directive on January 20, 2027. The Digital Omnibus deleted this reference and added the Machinery Regulation to Section B as new point 21. The AI Act now points to the act that applies to machinery from January 2027 anyway.

Article 2(2) of the AI Act sets out what separates the two sections. For high-risk AI systems related to products in Section B, only three parts of the AI Act still apply. These are the classification rule, a new provision on testing in real-world conditions, and almost all final provisions. The rules on AI regulatory sandboxes are added to the extent that the Machinery Regulation takes over the requirements of the AI Act. The AI Act's requirements, provider obligations, conformity assessment procedures, CE marking, and penalties do not apply to these systems.

The Machinery Regulation is to fill the gap. The Digital Omnibus requires the Commission to supplement Annex III to the Machinery Regulation by delegated act with health and safety requirements for AI. These must take into account the AI Act's requirements for high-risk AI systems. They must also take into account its rules on quality management, retention of automatically generated logs, post-market monitoring, and reporting of serious incidents. The change is justified by the specific characteristics of the machinery sector and by the aim of avoiding overlaps.

The Digital Omnibus shifts responsibility. The substantive requirements remain. They will be found in a different act, in a structure that machinery manufacturers know, and assessed by the same bodies that already assess their machines.

The new deadlines

Date	What applies
July 27, 2026	The Digital Omnibus enters into force. Since then, the AI Act refers to the Machinery Regulation for machinery
December 2, 2027	The requirements for high-risk AI systems from the listed use cases apply. Originally, August 2, 2026, was planned
August 2, 2028	The requirements for high-risk AI systems in products apply. The delegated acts under the Machinery Regulation must apply by the same day

The postponement is justified by missing standards, missing common specifications, and national authorities that are not yet in place.

For systems already on the market, the Digital Omnibus clarified the transitional rule. The regulation covers them only if their design is significantly changed afterward. The recitals explain this through type and model. What counts is the day on which the first unit of a given type and model was lawfully placed on the market. Further units of the same type may then be made available without additional requirements and without certification.

For series machinery, this clarification is worth more than the postponed deadlines. It answers whether a product line running since 2025 must stop in 2028 or can continue. The price is a term that has not been defined so far. What counts as a significant change in design will be judged differently for a learning system than for control software.

What manufacturers can do while the delegated act is missing

The calendar shows how far the Commission can be with the delegated act. It has only had the power to adopt it since July 27, 2026. Such an act can only enter into force if neither Parliament nor the Council objects within two months of notification, or if both inform the Commission earlier that they will not object. As of October 2026, three things are known: the mandate, the target date of August 2, 2028, and the requirement of an equivalent level of protection. The text of the requirements is not known.

A transitional rule covers the time in between. Until harmonized standards for AI under the Machinery Regulation are available, manufacturers can rely on the harmonized standards or common specifications under the AI Act. They then benefit from the presumption of conformity.

This transitional rule helps less than it seems. It presupposes harmonized standards under the AI Act, and their delayed availability is one of the reasons the deadlines were postponed. The second route is to rely on common specifications, if the Commission adopts them for the relevant requirements. If you build a technical file for an AI function today, you are working toward a target that nobody has described yet.

What you can rely on today is the classification. The AI Act's classification rule still applies to machinery. Its result determines whether the delegated act affects your product at all.

As of October 2026, we expect the delegated act to stay close to the requirements of the AI Act. We expect it to translate them into the structure of the essential health and safety requirements. The Commission's mandate leaves little room. It requires an equivalent level of protection and names each of the provisions to be taken into account.

Requirements for high-risk AI systems

The AI Act sets the following requirements for high-risk AI systems. For AI in machinery, they will reach manufacturers through the Machinery Regulation and are the benchmark for the delegated act. Accuracy, robustness, and cybersecurity must also be maintained throughout the lifecycle. The AI Act names AI-specific attacks, such as manipulating training data or inputs to make the model fail.

Technical documentation and logging

A high-risk AI system needs technical documentation and logging capabilities that make its operation traceable to a degree appropriate to its intended purpose. The logs should make risk situations and substantial modifications visible, enable post-market monitoring, and allow the deployer to monitor operation.

In its structure, this documentation is the same exercise as the obligations of manufacturers under the Cyber Resilience Act. If you set up both separately, you keep two files for the same product, with two chains of evidence that point to the same artifacts.

Data quality

If an AI model is trained with data, the training, validation, and testing data sets must meet quality criteria and be subject to data governance. This covers design choices, the origin of the data, preparation steps such as annotation and cleaning, and assumptions about what the data is meant to represent. Since the Digital Omnibus, this obligation applies only if such data sets are used.

Transparency toward the deployer

The system must operate transparently enough for the deployer to interpret its output appropriately. For this purpose, the instructions for use state the intended purpose and the level of accuracy, including metrics, robustness, and cybersecurity. They also state the known and foreseeable circumstances that can affect these values.

Human oversight

The people assigned to oversight must understand the capabilities and limits of the system and detect anomalies and malfunctions. They must remain aware of the tendency to rely too much on its output. They must be able to disregard, override, or reverse the output. They must also be able to interrupt operation with a stop button so that the system comes to a halt in a safe state.

Conformity assessment and penalties

Under the AI Act, internal control is enough for most of the listed use cases. A notified body is needed for biometric systems. Even there, it is only needed if there are neither harmonized standards nor common specifications, or if the provider has not fully applied existing standards.

For machinery, the procedure follows the Machinery Regulation, because the AI Act's conformity assessment rules no longer apply to AI in machinery. Classification as a high-risk AI system does not trigger an additional third-party assessment, because the classification already presupposes one. If machinery law does not require a notified body for a product, classification through the product route does not arise at all.

Which machinery needs a notified body is decided by the lists of categories in the Machinery Regulation. For some of the listed categories, an EU-type examination or an equivalent procedure is mandatory. Outside the lists, internal production control is enough.

The AI Act's administrative fines have three levels:

• Infringements of the prohibited practices: up to €35 million or 7% of total worldwide annual turnover for the preceding financial year.
• Infringements of the obligations of operators and of the transparency obligations: up to €15 million or 3%.
• Incorrect, incomplete, or misleading information in reply to a request from authorities or notified bodies: up to €7.5 million or 1%.

For undertakings, the higher amount applies. For small and medium-sized enterprises, including start-ups, the lower amount applies. The Digital Omnibus introduced a similar cap for small mid-cap enterprises, but only for the two lower levels.

For AI in machinery, these amounts do not apply, because the AI Act's penalty provisions have not applied to machinery since July 2026. The penalty rules of the Machinery Regulation apply instead, and they leave penalties to the Member States. Penalties must be effective, proportionate, and dissuasive, and may be criminal for serious infringements. There is no EU-wide range of fines. If you put the €35 million into a management presentation anyway, you are working with the wrong figure and the wrong kind of framework.

Does AI-based quality control need a conformity assessment under the AI Act?

No, as long as the function is not safety-related. Since July 2026, the AI Act makes clear that AI systems are not safety components if they serve exclusively non-safety-related aspects of quality control or automation. The first of the two conditions is then not met.

Two caveats remain. As soon as the failure of the inspection function would put health and safety at risk, it is a safety component. An example is an inspection station whose release decides whether a safety-relevant part goes into assembly. Even then, classification only follows if the Machinery Regulation requires a third-party conformity assessment for this product.

Does the AI Act change the CE marking of a machine?

Machinery keeps one CE marking under the Machinery Regulation. The AI Act's provisions on CE marking are not on the short list of provisions that still apply to high-risk AI systems in machinery.

The regulation does not state this practical consequence of the move in a separate sentence. For manufacturers, it means one declaration and one procedure. From August 2, 2028, the AI function becomes part of that procedure with the future requirements of the Machinery Regulation.