C3 AI Under the EU AI Act: Classified by the Application, Not by C3

C3 AI has no EU AI Act risk tier of its own. Each application you run or build on it is classified by what it does.

C3 AI is an enterprise AI provider with two faces: the C3 AI Platform, on which you develop and operate AI applications, and a catalogue of 40-plus turnkey applications across manufacturing, financial services, oil and gas, and — prominently — utilities and energy. Under Regulation (EU) 2024/1689, the regulated object is the AI system behind each application, classified by its intended purpose under Article 6 — not "C3 AI" as a single label.

That matters more here than for a generic data platform, because C3 AI's centre of gravity is critical infrastructure: grid management, fault detection, energy forecasting. Most of those applications are minimal-risk operational tools — but a system acting as a safety component in the management or operation of critical infrastructure can be high-risk under Annex III point 2. This page classifies by use, draws that line, and walks one worked example.

---

Classify the application, not C3 AI

Running a C3 AI forecasting app, building a custom app on the platform, or monitoring an asset fleet carries no mandatory tier for C3 AI itself. Classification turns on: what does this specific application do, and could it act on the safety of critical infrastructure or on a person's rights?

Apply Article 6 per application:

The decisive concept is Annex III point 2: AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating and electricity. The test is whether the system is a safety component under Article 3(14), as rewritten by the Digital Omnibus: it fulfils a safety function — preventing or mitigating risks to the health and safety of persons or property — or its failure or malfunction endangers health and safety. A forecasting dashboard that an operator reads and acts on is generally not a safety component; an automated protection or control function whose output directly governs safe grid operation can be. Draw that line deliberately, application by application.

Note the Annex I alternative: where AI is a safety component of a product already covered by EU product law (machinery, certain energy equipment), it routes through that sectoral legislation under Article 6(1) at the 2 August 2028 deadline rather than the Annex III route. Machinery is now an Annex I Section B product, so the AI requirements reach it through delegated acts under the Machinery Regulation (EU) 2023/1230. And AI used solely for performance optimisation, efficiency or quality control is not a safety component on this route unless its failure would endanger health and safety.

Most C3 AI applications — forecasting, optimisation, maintenance triage that a human acts on — sit at minimal risk, with no obligation beyond Article 4 AI literacy, in force since 2 February 2025. Apply the Article 6(3) filter to anything that looks borderline: a narrow procedural task or a human-reviewed advisory output can fall out of high-risk, unless it profiles natural persons.

---

Who is the provider, who the deployer

Under Article 3(3), a provider develops an AI system (or has it developed) and places it on the market or puts it into service under its own name or trademark; a deployer (Article 26) uses a system in its own operations.

• Run a turnkey C3 AI application in your operations and you are typically the deployer.
• Build a custom application on the C3 AI Platform and run it yourself — still usually a deployer, of a system you assembled.
• Build an application on the platform and ship it to others under your own name — you become its provider under Article 16, and the Article 25 value-chain flip applies if you substantially modify a system or repurpose it into a high-risk use.

If the application is high-risk (e.g. a grid safety-component system), the provider owes the full stack — risk management (Article 9), data governance (Article 10), technical documentation (Article 11 / Annex IV), logging (Article 12), transparency to deployers (Article 13), human oversight (Article 14), accuracy and robustness (Article 15), conformity assessment (Article 43), Declaration of Conformity (Article 47) and registration (Article 49). The deployer of a high-risk system owes the Article 26 duties: use per instructions, human oversight, logging.

And the usual clarification: where an application is built on a third-party general-purpose AI model, the Chapter V obligations for that model (Article 53) stay with the model's provider — not with you and not with C3 AI as the application platform.

---

What each role owes

---

The deadline

If an application is stand-alone Annex III high-risk — including a grid safety-component system under point 2 — its obligations apply from 2 December 2027 (originally 2 August 2026) under the Digital Omnibus — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Where the AI is a safety component of an Annex I product, the deadline is 2 August 2028. Article 4 literacy and the Article 5 prohibitions are in force now; Article 50 transparency has applied since 2 August 2026.

---

Worked example: Rheinkraft Netz GmbH

Rheinkraft Netz GmbH, a regional German grid operator with ~340 employees and ~€90M turnover, runs three C3 AI applications:

• Load forecasting feeding its planning team a day-ahead demand curve that schedulers review. An advisory input a human acts on — not a safety component: minimal risk, Article 4 literacy only.
• Predictive maintenance flagging transformers for inspection. It triages a maintenance backlog; an engineer decides: minimal risk.
• An automated grid-fault protection function built on the C3 AI Platform whose output directly governs real-time isolation of faulted line segments. This is a safety component in the operation of electricity supply — Annex III point 2 high-risk. Because Rheinkraft built and operates it in-house under its own name, Rheinkraft is both provider (Article 16) and deployer (Article 26) of that system, owing the full provider stack plus the deployer duties, and registration (Art 49). Deadline: 2 December 2027.

Same vendor, three verdicts — two minimal operational tools, one high-risk safety component, set entirely by the role each system plays in keeping the lights on.

---

How Confir helps

Register each C3 AI application separately — not "C3 AI" as one line — and Confir's rule-based engine classifies each by intended purpose, applies the Annex III point 2 safety-component test for critical-infrastructure use, and derives your role (deployer, or provider via the Article 25 flip). A forecasting or maintenance app returns a short minimal-risk checklist; a grid safety-component system returns the high-risk provider obligation set and the Article 11 / Annex IV documentation scaffold. The logic is deterministic: same intake, same finding, the rule that fired shown in plain language.

---

Related guides

• Article 6 high-risk classification
• Annex III high-risk use cases
• is critical-infrastructure AI high-risk?
• provider obligations under Article 16
• provider vs deployer explained
• EU AI Act for manufacturing
• is my AI high-risk?