Is Water Supply AI High-Risk Under the EU AI Act? Annex III Point 2

It turns on what the AI controls. AI used as a safety component in the supply of water — the systems that govern treatment chemistry or hold distribution within safe limits — is high-risk under Annex III point 2 of the EU AI Act, Regulation (EU) 2024/1689. AI that reads meters, sends bills, or flags a probable leak for an engineer to investigate is minimal-risk. Both can live at the same water utility. The phrase that splits them is "safety component."

What Annex III point 2 covers — and the water-specific part

Point 2 makes high-risk the AI intended to be used as a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating and electricity. The supply of water is named in the text. But the trigger is not "water-company AI" in general — it is AI whose failure or malfunctioning would endanger the life and health of persons or cause significant disruption to the water supply.

For water, the stakes are unusually direct: getting chemical dosing wrong, or losing pressure control, has immediate public-health consequences. That is exactly why the safety component concept — a component performing a safety function, or one whose failure endangers people's health and safety, as unsafe water or a lost supply does — maps so cleanly onto treatment and distribution control. If the model sits in the loop that keeps drinking water safe and flowing, point 2 applies.

The line that decides it

The test is one question: could this AI, by failing, make the water unsafe or cut the supply?

The instinct to put leak-analytics in the high-risk box is the common error. A leak-detection model that surfaces anomalies for a human to investigate is advisory — it does not itself control the network, and a wrong flag means a wasted truck roll, not contaminated water. That is minimal-risk. If the same analytics were wired into an automated shut-off that closes valves without human control, the shut-off function becomes a safety component, and you re-classify that function — not the whole analytics suite.

Billing and consumption analytics are the clearest non-safety case. They optimise revenue and planning. A wrong bill is a customer-service problem, not a public-health one. Minimal-risk, every time. The Digital Omnibus reinforced the line: the rewritten Article 3(14) limits a safety component to one that fulfils a safety function or whose failure endangers health and safety, so AI whose only job is efficiency or optimisation does not qualify unless its failure would itself endanger health and safety.

What a high-risk water system owes

Where a water-control system is a safety component under point 2, the full regime applies to provider and deployer:

• Risk management across the lifecycle (Article 9)
• Data governance (Article 10), technical documentation to Annex IV (Article 11), event logging (Article 12)
• Transparency / instructions for use (Article 13) and human oversight (Article 14)
• Accuracy, robustness and cybersecurity (Article 15) — central for any process-control AI
• Conformity assessment via the Annex VI internal-control route (Article 43), the declaration of conformity (Article 47), CE marking (Article 48), and national-level registration (Article 49(5) — point-2 critical-infrastructure systems are excepted from the public EU database)
• Deployer duties under Article 26, including oversight and log retention

As with all critical-infrastructure AI, two parallel regimes bite: NIS2 cybersecurity duties (water is an essential sector) and sectoral drinking-water-quality law. The Article 15 cybersecurity requirement and NIS2 overlap and should be handled together. The conformity route is the Annex VI internal self-assessment — no notified body is generally required, unlike Annex III biometrics.

Worked example: a regional water utility's two systems

Trinkwasser Süd GmbH, a regional water utility with about 160 employees and roughly €34M turnover, runs two AI systems.

The first is a leak-detection model that scores network telemetry and raises tickets for field engineers to investigate. It controls nothing; a false positive sends a crew to the wrong street. Advisory, not a safety component → minimal-risk. Trinkwasser Süd records the classification and applies no high-risk obligations to it.

The second is an automated dosing controller that adjusts disinfectant levels to keep treated water within safe limits. Its failure could make water unsafe — a clear safety component under Annex III point 2 → high-risk. Trinkwasser Süd, as deployer (with its control-systems vendor as provider), scopes the full regime: risk management (Article 9), human oversight so an operator can intervene (Article 14), and a heavy Article 15 robustness-and-cybersecurity build aligned with its NIS2 duties. Conformity runs through the Annex VI internal route (Article 43); the system is registered at national level (Article 49(5)), not in the public EU database. One utility, two systems, two tiers — the safety-component test does the sorting.

How Confir helps

Confir applies the safety-component test to each water-utility AI use, separating minimal-risk leak analytics, forecasting and billing from the high-risk treatment and distribution control that sits in the safety loop — then assembles the provider/deployer obligations for the systems that qualify, with the Article 15 emphasis process-control AI demands and a NIS2 cross-map. The engine is deterministic and rule-based, so the same intake yields the same classification each time.

Related guides

• Critical infrastructure AI: Annex III point 2
• Is electricity grid AI high-risk?
• How Article 6 classifies high-risk AI
• Article 15 accuracy, robustness and cybersecurity
• What a safety component is
• How AI risk classification works