EU AI Act for Aviation: The Product Route, Not the Self-Assessment Route

It depends on whether the AI is a safety component — and if it is, you take the product route, not the route most compliance guides describe. AI that is a safety component of an aircraft or air-traffic-management system is high-risk under Article 6(1) of Regulation (EU) 2024/1689 because aviation sits in Annex I — the list of EU product-safety law that includes Regulation (EU) 2018/1139, the EASA Basic Regulation. That means integrated, sectoral conformity through the EASA framework, with a deadline of 2 August 2028 — not the stand-alone Annex III self-assessment route that lands on 2 December 2027. Non-safety aviation AI — booking, scheduling, maintenance optimisation, demand forecasting — is generally minimal-risk.

This is the single most consequential classification call in the sector, and the one most often got wrong. Get the route right first, because it changes which articles apply, which body assesses conformity, and which deadline you are working to. Start with how Article 6 classification splits the two routes.

---

Two routes into high-risk — and aviation takes the first

The EU AI Act has two distinct doors into the high-risk regime, and they are not interchangeable.

• Article 6(1) — the product route (Annex I). A system is high-risk if it is itself a product, or a safety component of a product, covered by the EU harmonisation legislation listed in Annex I, and that product must undergo third-party conformity assessment under the sectoral law. Aviation is here.
• Article 6(2) — the stand-alone route (Annex III). A system is high-risk if its intended purpose falls within one of the eight Annex III use-case areas — biometrics, critical infrastructure, employment, essential services, and so on. This is the self-assessment route most SMB guides describe.

Aviation safety AI goes through Article 6(1), because Regulation (EU) 2018/1139 — the EASA Basic Regulation — is listed in Annex I, Section B (that listing directly covers unmanned aircraft; for manned aviation and air-traffic management the AI Act's high-risk requirements are integrated via Article 108, which requires future EASA acts under 2018/1139 to embed them). Section B gathers the product regimes that already have their own type-certification, certification or market-surveillance machinery: civil aviation, motor-vehicle type-approval, marine equipment, rail. For these, the AI Act does not bolt a parallel conformity assessment on top; it grafts onto the existing sectoral regime.

Why the route matters in practice

Because aviation is a Section B product, the AI Act's high-risk requirements are integrated into the EASA certification process rather than imposed as a separate AI Act conformity assessment. The practical consequences are concrete: your assessor is the existing aviation framework (EASA and its certification machinery), not an AI Act notified body; the deadline is 2 August 2028, the date for Annex I product-embedded high-risk AI under Article 6(1), not 2 December 2027; and the documentation lives inside your type-certification file, not a free-standing Annex IV pack assembled from scratch. The safety component definition is the gate: a component that performs a safety function for the aircraft or system, or whose failure or malfunction endangers health and safety.

---

What counts as aviation safety AI — and what does not

The classification turns on whether the AI performs a safety function in a certified product. Two buckets, drawn carefully.

High-risk via Article 6(1) — safety components

These are AI systems whose failure could endanger flight safety, embedded in products certified under the EASA framework:

• Flight-control and avionics AI — systems contributing to control, stability or navigation of the aircraft.
• Air-traffic-management AI — automation supporting separation, sequencing or conflict detection where it performs a safety function.
• Detect-and-avoid and collision-avoidance AI in aircraft, including unmanned systems certified under the EASA regime.
• Safety-critical onboard decision support where the output drives or constrains a safety action.

Where AI is a safety component of a certified aircraft, engine, or ATM system, it is high-risk under Article 6(1) and follows the EASA route to the 2 August 2028 deadline.

Generally minimal-risk — non-safety aviation AI

Most of an airline's or airport's AI estate is not a safety component and is not in Annex III either:

• Booking, pricing and revenue management — dynamic fares, overbooking models, demand forecasting.
• Crew and fleet scheduling, gate allocation, turnaround optimisation.
• Predictive maintenance that flags components for human-led inspection without itself performing an airworthiness-determining safety function.
• Passenger chatbots and customer service — limited-risk, carrying the Article 50(1) disclosure.

These are minimal- or limited-risk, with no high-risk conformity duty. The one cross-cutting exception is hiring: AI used to recruit or evaluate pilots, cabin crew or staff is high-risk under Annex III point 4, on the stand-alone route — the same as for any employer.

---

The obligation stack on the product route

When aviation AI is a safety component under Article 6(1), the high-risk requirements of the Act apply — but delivered through the EASA conformity machinery. The substantive duties still bite:

• Risk management (Article 9) — a continuous risk-management system across the lifecycle, integrated with the safety assessment already required for certification.
• Data governance (Article 10) — training, validation and testing data quality, relevant where the AI is data-driven.
• Technical documentation (Article 11 / Annex IV) — folded into the type-certification documentation.
• Logging (Article 12) and transparency to deployers (Article 13).
• Human oversight (Article 14) — the system must allow effective oversight by qualified personnel, which in aviation aligns with crew and controller authority.
• Accuracy, robustness and cybersecurity (Article 15).

The provider — typically the aircraft, avionics or ATM-system manufacturer — carries the bulk of these under Article 16, demonstrated through the EASA certification process. The airline or air-navigation service provider operating the system is the deployer under Article 26: use the system per instructions, ensure human oversight, monitor operation, and keep logs. See the conformity-assessment route for how the product and stand-alone paths differ.

---

Worked example: a regional ATM-tech provider classifies its systems

Consider Aerolytik GmbH, an Austrian aviation-technology company of about 220 employees and roughly €45M turnover. It supplies three products: an AI-assisted conflict-detection module sold into air-traffic-management systems, a predictive-maintenance analytics tool sold to regional airlines, and a passenger-facing booking-and-rebooking chatbot licensed to airports. It also runs an AI CV-screening tool internally to hire engineers.

Walking each system to a route and tier

The conflict-detection module is a safety component of an ATM system certified under the EASA framework, so it is high-risk via Article 6(1) — the product route, EASA conformity, deadline 2 August 2028. Aerolytik is the provider under Article 16, demonstrating the Article 9–15 requirements inside the certification file. The predictive-maintenance tool flags parts for human-led inspection without itself making the airworthiness determination — minimal-risk, no high-risk duty, though Aerolytik documents that reasoning. The booking chatbot is limited-risk, carrying the Article 50(1) disclosure for the airports that deploy it. The internal CV-screener is high-risk via the stand-alone route — Annex III point 4 — and that one runs to the 2 December 2027 Annex III deadline, not 2028.

The outcome — two routes, two deadlines

Aerolytik ends up straddling both doors: one product-route high-risk system (conflict detection, 2 Aug 2028, EASA conformity), one stand-alone-route high-risk system (hiring, 2 Dec 2027), one limited-risk chatbot, and one minimal-risk maintenance tool. The lesson is that aviation companies rarely sit on a single route — the safety products go via Annex I and EASA, while back-office Annex III systems like hiring follow the ordinary self-assessment path. As an SME-scale provider, any fine is capped under Article 99(6) at the lower of the percentage or the fixed amount, and Aerolytik benefits from proportionate conformity-assessment fees under Article 62.

---

The aviation AI route-and-tier map

The defining split: safety components go Article 6(1) → EASA → 2 August 2028; only the back-office hiring use takes the Annex III self-assessment route.

Penalties, with the SME cap

High-risk obligation breaches — including aviation safety-AI duties — sit at up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). Article 5 prohibited practices carry up to €35,000,000 or 7% under Article 99(3). Supplying incorrect or misleading information to authorities is up to €7,500,000 or 1% under Article 99(5). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the two. See the Article 99 penalties.

---

Deadlines and how Confir helps

The dates that govern aviation AI

For aviation safety components under Article 6(1), the high-risk obligations apply from 2 August 2028 — the fixed deadline for Annex I product-embedded high-risk AI. This date was set by the Digital Omnibus deferral, which moved the product-embedded high-risk regime from the original 2 August 2027. The Digital Omnibus is now adopted — the European Parliament passed it on 16 June 2026, the Council on 29 June 2026 — so the date is settled; only publication in the Official Journal, expected before 2 August 2026, remains outstanding, as a formality. The dates are fixed calendar dates; the standards-contingent "stop the clock" variant was rejected.

For any Annex III stand-alone systems an aviation company runs — hiring being the common one — the statute reads 2 August 2026, deferred to 2 December 2027 under the now-adopted Digital Omnibus. Plan against the adopted 2 December 2027 date. Note that Article 4 AI literacy (since 2 February 2025) and Article 50 transparency (from 2 August 2026) apply regardless of route. See is the AI Act delayed.

What Confir does

Confir registers each aviation AI system and classifies it under Article 6, separating the Article 6(1) product-route safety components — which route through EASA to 2 August 2028 — from the Article 6(2) stand-alone systems and the minimal- and limited-risk back-office estate. It derives the provider or deployer role, flags which deadline each system answers to, and assembles the Article 11 / Annex IV documentation that folds into the certification file.

The engine is deterministic and rule-based: the same intake produces the same finding, with the rule that fired shown, so a classification — including the route decision that drives the whole programme — is reproducible and audit-defensible rather than a judgement call lost in an email thread.

---

Frequently asked questions

Is aviation AI high-risk under the EU AI Act?

Only where the AI is a safety component of a certified aircraft, engine or air-traffic-management system. Those systems are high-risk under Article 6(1) because aviation law — Regulation (EU) 2018/1139, the EASA Basic Regulation — is listed in Annex I. They take the product route, with conformity delivered through the EASA framework and a deadline of 2 August 2028. Non-safety aviation AI, such as booking, scheduling, revenue management and predictive maintenance that only supports human-led inspection, is generally minimal-risk with no high-risk obligation.

Why does aviation AI follow Article 6(1) and not Annex III?

Because aviation already has a dedicated EU product-safety regime. Annex I, Section B, lists Regulation (EU) 2018/1139 (directly for unmanned aircraft; manned aviation and ATM are brought in via Article 108), so an AI safety component in an EASA-certified product is high-risk via the product route under Article 6(1)/Article 108. The AI Act grafts its requirements onto the existing EASA conformity assessment rather than imposing a separate Annex III self-assessment. This changes the assessor (the aviation framework, not an AI Act notified body), the documentation home (the type-certification file), and the deadline (2 August 2028, not 2 December 2027).

When does the EU AI Act apply to aviation safety AI?

The high-risk obligations for Annex I product-embedded AI, which includes aviation safety components under Article 6(1), apply from 2 August 2028. This fixed date was set by the Digital Omnibus deferral, moving the regime from the original 2 August 2027. The Digital Omnibus is now adopted — European Parliament 16 June 2026, Council 29 June 2026 — so the date is settled, pending only Official Journal publication, expected before 2 August 2026, as a formality. Article 4 AI literacy already applies since 2 February 2025, and Article 50 transparency from 2 August 2026.

Who is the provider and who is the deployer for aviation AI?

Usually the aircraft, avionics or ATM-system manufacturer that develops and certifies the AI safety component is the provider under Article 16, demonstrating the Article 9–15 requirements through the EASA certification process. The airline or air-navigation service provider that operates the system is the deployer under Article 26: use it according to instructions, ensure human oversight by qualified crew or controllers, monitor operation, and retain logs. Roles can shift under Article 25 if a deployer substantially modifies a system or markets it under its own name.

Is predictive maintenance AI high-risk in aviation?

Generally no. Predictive-maintenance analytics that flag components for human-led inspection, without themselves making the airworthiness determination, are not a safety component in the Article 6(1) sense and are not listed in Annex III. They are minimal-risk, with no high-risk conformity duty — though you should document that classification. The position changes if the AI itself performs an airworthiness-determining safety function, in which case it can become a safety component and follow the product route. Classify by the specific function, not the product category.

Does the EU AI Act apply to airline booking and chatbot systems?

These are not high-risk. Booking, pricing, revenue management and crew scheduling are not listed in Annex III and are minimal-risk. A passenger chatbot is limited-risk and carries the Article 50(1) duty to tell users they are interacting with an AI system, applying from 2 August 2026. The one back-office system that can be high-risk is AI used to recruit or evaluate staff, which falls under Annex III point 4 on the stand-alone route — separate from the aviation safety products that go through Article 6(1) and EASA.

---

Related guides

• Article 6 high-risk classification
• The conformity-assessment route
• Autonomous vehicles and the AI Act
• Recruitment and selection AI under Annex III
• Article 50 transparency obligations
• Is the EU AI Act delayed?
• Automotive AI compliance