Critical Infrastructure AI Under the EU AI Act: Annex III Point 2
AI used as a safety component in managing critical infrastructure — water, gas, electricity, road traffic — is high-risk under Annex III point 2.
AI that helps run essential utilities is one of the clearer high-risk categories — but it is narrower than it sounds. Annex III point 2 of the EU AI Act, Regulation (EU) 2024/1689, makes high-risk the AI used as a safety component in the management and operation of critical infrastructure. The phrase "safety component" is the whole test.
What Annex III point 2 covers
Point 2 lists AI intended to be used as a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating and electricity. The system is high-risk when its failure or malfunctioning would endanger the life and health of persons or cause significant disruption to the supply.
The operative concept is safety component: AI that performs a safety function, or whose failure endangers safety. A model that optimises energy trading or forecasts demand for planning is generally not a safety component; a model that controls grid balancing or manages water-treatment safety parameters is.
The line that decides it
Ask whether the AI's failure would directly endanger people or the continuity of the essential supply. Back-office, planning, billing and optimisation AI in a utility is typically minimal-risk. Real-time control and safety-critical AI is the high-risk part. Two systems in the same utility can sit in different tiers — classify each on its function.
What high-risk infrastructure AI owes
Where a system is a safety component under point 2, the full provider/deployer regime applies: risk management (Article 9), data governance (Article 10), technical documentation (Article 11, Annex IV), logging (Article 12), human oversight (Article 14), accuracy, robustness and cybersecurity (Article 15), conformity assessment via the Annex VI internal-control route (Article 43), the Declaration of Conformity (Article 47), CE marking (Article 48) and — as point-2 systems — national-level registration (Article 49(5)), not the public EU database. Deployers carry the Article 26 duties, including oversight and log retention. Note also the overlap with sectoral and NIS2 cybersecurity obligations, which run in parallel.
Worked example: a regional water utility
Aquaflux, a regional water utility, runs two AI systems. One forecasts consumption for capacity planning — not a safety component, so minimal-risk. The other adjusts dosing and pressure as part of treatment safety control — a safety component under Annex III point 2, hence high-risk. Aquaflux scopes the high-risk stack for the control system, builds in human oversight and robust cybersecurity (Article 15), and leaves the forecasting tool as the minimal-risk system it is.
How Confir helps
Confir applies the safety-component test to each infrastructure AI use, separating minimal-risk planning and optimisation from high-risk safety control, and assembles the provider/deployer obligations for the systems that qualify — with the Article 15 robustness and cybersecurity emphasis these systems demand. The engine is deterministic and rule-based.
Frequently asked questions
Is all AI in critical infrastructure high-risk?
No. Annex III point 2 makes high-risk only the AI used as a safety component in managing or operating critical infrastructure — water, gas, heating, electricity, road traffic, critical digital infrastructure. Back-office, planning, billing and optimisation AI is generally minimal-risk. The safety-component function is the test.
What is a safety component here?
AI that performs a safety function or whose failure would endanger the life and health of persons or cause significant supply disruption. Real-time control and safety-critical systems qualify; forecasting and optimisation usually do not.
What obligations apply to high-risk infrastructure AI?
The full provider stack (Articles 9–15, 43 via Annex VI, 47, 48, 49) and deployer duties under Article 26, with particular weight on Article 15 robustness and cybersecurity. NIS2 and sectoral obligations also apply in parallel.
Which conformity route applies?
The Annex VI internal-control (self-assessment) route under Article 43, as for most Annex III categories outside biometrics. A notified body is not generally required for critical-infrastructure AI.
When does the obligation apply?
Stand-alone high-risk Annex III obligations originally read 2 August 2026 in the statute; the Digital Omnibus, adopted by the European Parliament and Council in June 2026, defers this to 2 December 2027; it has been in force since 27 July 2026. Plan against 2 December 2027.
Related guides
- Annex III high-risk use cases
- How Article 6 classifies high-risk AI
- Human oversight protocol template
- EU AI Act for energy and utilities
- How AI risk classification works
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →