EU AI Act for Logistics and Supply Chain: What Is Actually High-Risk (and What Is Not)
Most logistics AI — route optimisation, demand forecasting, ETA — is minimal or limited-risk under the EU AI Act. The 3 exceptions that bite, and the deadlines.
Most of it is not. A 3PL running route optimisation, demand forecasting, ETA prediction, and warehouse picking algorithms is running minimal-risk AI under the EU AI Act — no conformity assessment, no technical file, no obligation stack. The regulation is targeted, not sweeping, and operating in a regulated sector does not make your AI regulated. This page identifies the three exceptions that genuinely bite in logistics, and the one obligation that touches everyone regardless of risk tier.
Most Logistics and Supply-Chain AI Is Minimal or Limited-Risk — Say It Plainly
The assumption that a safety-conscious, heavily-regulated sector must face heavy AI regulation is widespread and expensive. It is also wrong. The EU AI Act under Regulation (EU) 2024/1689 classifies systems by what they do, not by the industry running them.
The four risk tiers in one pass
Four tiers. Prohibited practices under Article 5 are banned outright. High-risk systems under Article 6 carry the full obligation stack. Limited-risk systems under Article 50 carry transparency duties only. Minimal-risk is everything else and carries no mandatory obligations. Most logistics AI lives in the bottom tier.
What counts as minimal-risk logistics AI
Route optimisation, demand forecasting, inventory and replenishment planning, ETA prediction, dynamic freight pricing, and load-planning algorithms are operational tools. None appears in Annex III — the eight-category high-risk list — and none is a safety component of a regulated product. They are minimal-risk. Building a high-risk compliance programme around the algorithm that finds the cheapest multi-drop sequence wastes money that belongs on the systems that trigger obligations.
The one obligation that still applies everywhere: Article 4 AI literacy
One baseline duty reaches almost everyone. Article 4 requires that staff who operate AI systems have an adequate level of AI literacy, regardless of risk tier. It has been in force since 2 February 2025. Planners, dispatchers, and agents supervising a chatbot are all covered. It is a competence and training duty, not a documentation regime — but it is the one thing a minimal-risk operator owes.
The rest of this page isolates the narrow exceptions — three, plus a fourth edge case worth ruling out.
Exception 1 — Customer-Facing Transparency Duties (Article 50)
Limited-risk is not no-risk. Article 50 imposes transparency duties even where a system is nowhere near high-risk. For logistics operators this is the exception most likely to apply, because almost every carrier and 3PL runs customer-facing automation.
Chatbots and AI interaction disclosure
A customer-service chatbot on a carrier or 3PL portal — the one answering "where is my shipment" or rescheduling a delivery — must disclose to the user that they are interacting with an AI system, unless that is already obvious from the context (Article 50(1)). A clear line of interface copy stating the assistant is automated discharges it. No technical file, no notified body, no CE mark.
Synthetic content marking and the 2 December 2026 date
Where logistics marketing or customer communications generate synthetic image, audio, or video content, Article 50 requires it to be marked as artificially generated or manipulated. These content-marking and watermarking obligations land on 2 December 2026, alongside a new prohibition added to Article 5 covering CSAM-generation and "nudifier" tooling.
Article 50 is a transparency duty — disclosure and labelling, not the risk-management, data-governance, and documentation stack high-risk classification triggers. Do not over-engineer it.
Exception 2 — AI as a Safety Component of a Vehicle or Machine (Annex I Product Route)
This is the Article 6(1) product-embedded route. An AI system is high-risk if it is a safety component of a product covered by Annex I harmonised legislation that requires third-party conformity assessment. Classification attaches to the product, not the office software.
Annex I Section B: vehicle type-approval and the Machinery Regulation
Annex I Section B is the logistics-relevant cluster. It includes motor-vehicle type-approval under Regulation (EU) 2018/858, plus the aviation, rail, and marine-equipment regimes — covering autonomous and semi-autonomous trucks, automated guided vehicles (AGVs), and autonomous mobile robots (AMRs) where the AI performs a safety function.
Warehouse robotics sit on the same product route through a different instrument: the Machinery Regulation (EU) 2023/1230, which replaced the old Machinery Directive. An AGV, AMR, or autonomous forklift performing a safety function — collision avoidance, proximity detection that commands a stop, navigation that prevents striking a worker in a shared aisle — is a safety component of machinery, and high-risk via Annex I. The full derivation lives in the manufacturing guide.
The function-not-hardware classification test
The test is functional, not physical. AI that plans an AGV's most efficient picking route is operational and minimal-risk. AI that stops the same AGV when a worker steps into its path is a safety component and high-risk. One vehicle, two AI outputs, two classifications. The hardware is irrelevant; what matters is whether the function could endanger a person if it failed.
Provider vs deployer, and the deadline
The vehicle or equipment manufacturer — the OEM that builds the AGV, truck, or robot — is the provider under Article 16 and carries the full obligation stack. The logistics operator running the fleet is the deployer under Article 26, with the lighter operational-use, oversight, and incident-reporting duties.
The deadline carries a mandatory caveat. The Annex I product-embedded statute originally read 2 August 2027; the adopted Digital Omnibus now sets 2 August 2028. The Digital Omnibus, adopted in June 2026 — the European Parliament passed it in plenary on 16 June 2026 and the Council formally adopted it on 29 June 2026 — sets this date at 2 August 2028. Only publication in the Official Journal remains — expected before 2 August 2026 — a formality that does not affect the dates. The 2 August 2028 deadline is now settled for Annex I product-embedded high-risk AI.
Exception 3 — Warehouse and Driver Worker-Monitoring AI (Annex III Point 4, High-Risk)
This is the exception logistics operators actually trip over, because here they are the deployer, not a buyer of someone else's regulated vehicle. The tool comes from a vendor, but the obligation lands on the operator running it on its workforce.
Annex III point 4(b): in-employment decisions in the warehouse
Annex III point 4 covers employment and worker management. Point 4(a) is recruitment and selection. Point 4(b) covers decisions affecting work-related relationships — task allocation, performance monitoring and evaluation, promotion and termination. The warehouse-relevant cases sit in 4(b): AI that ranks pickers by productivity to drive discipline, AI that allocates shifts on automated performance scoring, and AI that feeds driver-behaviour monitoring into promotion or termination decisions. Any of these is high-risk.
The hard prohibition: emotion recognition and driver monitoring (Article 5)
There is a harder line above high-risk. Article 5(1)(f) prohibits emotion-recognition AI in the workplace outright. A driver-facing system that infers fatigue, attentiveness, or emotional state — framed as emotion inference — is prohibited, not merely high-risk, and has applied since 2 February 2025. The fine ceiling is €35 million or 7% of total worldwide annual turnover, whichever is higher, under Article 99(3). A vendor pitching "fatigue and emotion detection" for your fleet is pitching a system you cannot deploy.
Deployer obligations, role-shift, and the deadline
The deployer carries the Annex III point 4 obligations even though a vendor built the tool. Article 26 duties apply, and a deployer using a high-risk system in the workplace must inform worker representatives and affected workers before putting it into service. If the operator substantially modifies the tool or repurposes it beyond its intended use, Article 25 can shift it into the provider role and the full stack with it.
The deadline carries the same caveat as Exception 2. The stand-alone Annex III high-risk statute originally read 2 August 2026; the adopted Digital Omnibus now sets 2 December 2027. The Digital Omnibus, adopted in June 2026 (European Parliament 16 June, Council 29 June), sets the operative stand-alone Annex III deadline at 2 December 2027. The standards-contingent "stop the clock" variant was rejected, so the deferral, once enacted, will be fixed calendar dates. The 2 December 2027 deadline is now settled law for stand-alone Annex III high-risk obligations.
Where Logistics Touches Critical Transport Infrastructure (Annex III Point 2)
A narrow edge case for most operators. The short version: you are probably not in scope, and the full obligations stack lives in the dedicated guide.
Road traffic and the narrow scope of point 2
Annex III point 2 covers AI used as a safety component in the management and operation of critical infrastructure, including road traffic and the supply of water, gas, heating, and electricity. The road-traffic limb is the one a logistics operator might brush against — but it covers the entity running the traffic-management, port-control, or rail-scheduling system with a safety function, not the entity consuming its data.
When a logistics operator is and is not in scope
Most freight and warehouse operators are not critical-infrastructure operators. A 3PL pulling a road-traffic data feed into its routing engine is not the same as the authority managing the traffic-control system itself. The test mirrors Exception 2's: is the AI in the control or decision loop such that failure could endanger persons or essential-service integrity, or does it merely report and schedule? If point 2 genuinely applies, the Annex VI self-assessment route and obligations are in the critical-infrastructure guide.
Classification Reference Table for Logistics and Supply-Chain AI
How to read the table
Each row maps a common logistics AI system to its likely risk classification, governing Article or Annex, responsible role, and deadline. "None" means no mandatory deadline beyond the Article 4 literacy baseline.
| Logistics AI system | Risk classification | Governing Article / Annex | Responsible role | Operative deadline |
|---|---|---|---|---|
| Route optimisation | Minimal | — | — | None |
| Demand forecasting / inventory planning | Minimal | — | — | None |
| ETA prediction | Minimal | — | — | None |
| Customer-service chatbot | Limited | Article 50(1) transparency | Provider / deployer | Disclosure now; content-marking 2 Dec 2026 |
| AGV/AMR efficiency routing | Minimal | — | — | None |
| AGV/AMR safety-stop function | High | Article 6(1) + Annex I (Machinery Reg.) | Provider (OEM) | 2 Aug 2028¹ |
| Autonomous-truck driving function | High | Article 6(1) + Annex I Section B (Reg. 2018/858) | Provider (OEM) | 2 Aug 2028¹ |
| Warehouse worker performance / discipline scoring | High | Annex III point 4(b) | Deployer | 2 Dec 2027¹ |
| Emotion / fatigue recognition of workers | Prohibited | Article 5(1)(f) | — | In force 2 Feb 2025 |
The deadline caveat footnote
¹ These dates are set by the Digital Omnibus, adopted in June 2026: the European Parliament passed it in plenary on 16 June 2026 and the Council formally adopted it on 29 June 2026. Only publication in the Official Journal remains — expected before 2 August 2026 — a formality that does not affect the dates. Stand-alone Annex III obligations were originally set for 2 August 2026 and Annex I product-embedded obligations for 2 August 2027; the adopted Digital Omnibus now defers these to 2 December 2027 and 2 August 2028 respectively. Plan against the statutory dates.
Penalties run in three tiers under Article 99: €35 million or 7% of total worldwide annual turnover, whichever is higher, for a prohibited practice (Article 99(3)); €15 million or 3% for a high-risk breach (Article 99(4)); €7.5 million or 1% for incorrect or misleading information to authorities (Article 99(5)). Article 99(6) caps SMEs and start-ups at the lower figure.
Worked Example: A Mid-Sized Freight Firm's AI Portfolio
Meridian Freight Group is a fictional logistics and warehousing operator with roughly 1,400 employees, 12 distribution centres, and a 600-vehicle road fleet across the EU. A mid-cap, large enough that turnover-based penalties dominate any fixed-amount cap, but small enough to fear over-compliance. Walk its AI portfolio item by item.
The portfolio, system by system
1. Route-optimisation and demand-forecasting engines. Minimal-risk. No mandatory stack. Article 4 AI literacy applies to the planners and dispatchers operating them — the entire compliance footprint.
2. Customer-tracking chatbot on the shipper portal. Limited-risk. Article 50(1) requires Meridian to disclose that customers are interacting with an AI system; any synthetic media triggers the content-marking duty from 2 December 2026.
3. AGV fleet in the distribution centres with collision-avoidance safety stop. High-risk via Article 6(1) and Annex I through the Machinery Regulation (EU) 2023/1230. But Meridian is the deployer under Article 26 — the AGV manufacturer is the provider holding the technical documentation and conformity assessment. Meridian's duties are operational: use per instructions, assign oversight, monitor, report serious incidents.
4. Pilot of a workforce-productivity tool that ranks pickers for performance management. High-risk under Annex III point 4(b). Meridian is the deployer and carries Article 26 duties, plus the duty to inform worker representatives and affected workers before deployment. A vendor built it; the obligation is Meridian's.
5. A driver-cam vendor pitching "fatigue and emotion detection." Prohibited under Article 5(1)(f). Do not deploy. The €35 million or 7% ceiling under Article 99(3) attaches, and the prohibition has applied since 2 February 2025.
Meridian's actual obligation surface and exposure
The surface is far smaller than the headline fear. Of five system categories, two are high-risk by deployment (the AGV safety stop and the worker-monitoring pilot), one is prohibited and rejected, and the rest are minimal or limited-risk. As a mid-cap, Article 99(6) caps any fine at the lower of the percentage or the fixed amount — relief, not an exemption. The lesson is the one this page opened with: catch the narrow exceptions, and leave the operational AI the regulation does not touch alone.
How Confir Helps Logistics and Supply-Chain Teams
Confir's classification engine is deterministic and rule-based — no model inference, no hallucination. The same inputs produce the same documented classification rationale every time, which is what an auditor needs to follow and challenge.
It walks each system through the routes in sequence. Is it a safety component of a vehicle or machine under Article 6(1) and Annex I? Is it used for worker decisions under Annex III point 4? Does it trigger Article 50 transparency? For the high-risk minority, Confir generates the Annex IV technical-documentation structure and the Article 47 Declaration of Conformity template, and the Risk Register tracks role, classification, and deadline across a mixed portfolio in one place.
The value is in not over-complying on minimal-risk operational AI while catching the narrow high-risk exceptions. (GPAI provider workflow under Articles 51–55 remains partial and on the roadmap; Confir does not market it as complete.)
Frequently asked questions
Is route optimisation or demand forecasting AI high-risk under the EU AI Act? Generally no. Route optimisation, demand forecasting, inventory planning, and ETA prediction are operational tools. They do not appear in Annex III and are not safety components of regulated products, so they sit in the minimal-risk tier with no mandatory obligations. The one duty that still applies is Article 4 AI literacy. Do not build a high-risk programme around AI the regulation does not regulate.
When is warehouse robotics AI high-risk? Only when the AI performs a safety function. An AGV whose AI plans the most efficient picking route is minimal-risk. The same vehicle becomes high-risk under Article 6(1) and Annex I when its AI is a safety component — collision avoidance or proximity detection that commands a stop — because the robot is covered by the Machinery Regulation (EU) 2023/1230. Classification follows the function, not the hardware. The manufacturer is the provider; the operator, the deployer.
Does warehouse worker-monitoring AI trigger EU AI Act obligations? Yes, and this is the exception logistics operators most often miss. AI that monitors and evaluates picker or driver performance to drive task allocation, promotion, or termination is high-risk under Annex III point 4(b). The deployer carries Article 26 obligations, including informing worker representatives before deployment, even though a vendor built it. Separately, any system inferring workers' emotions — driver fatigue framed as emotion recognition — is prohibited under Article 5(1)(f), not merely high-risk, since 2 February 2025.
What are the deadlines for high-risk logistics AI, and are they final? Not yet final. The statute sets 2 August 2026 for stand-alone Annex III high-risk systems (worker-monitoring AI) and 2 August 2027 for Annex I product-embedded systems (vehicle and machinery safety functions). The Digital Omnibus agreed on 6–7 May 2026 to defer these to 2 December 2027 and 2 August 2028 (COREPER confirmed around 13 May 2026) — and is now adopted. Plan against the statutory dates until enacted.
Do customer-service chatbots and synthetic marketing content need labelling? Yes, under the limited-risk transparency rules in Article 50. A customer-service chatbot on a carrier or 3PL portal must disclose that the user is interacting with an AI system unless that is obvious. Synthetic image, audio, or video content used in logistics marketing must be marked as artificially generated or manipulated, with content-marking obligations applying from 2 December 2026. This is a transparency duty only — not the full high-risk conformity assessment stack.
Is my logistics company a critical-infrastructure operator under Annex III point 2? Almost certainly not, in most cases. Annex III point 2 covers AI used as a safety component in the management and operation of critical infrastructure, including road traffic. A freight operator consuming a road-traffic data feed is not the same as an authority managing the traffic-control system itself. The trigger is whether your AI is in the control loop such that failure could endanger persons or essential-service integrity. If so, the obligations and the Annex VI self-assessment route are in the critical-infrastructure guide.
What are the penalties if logistics AI breaches the EU AI Act? Three tiers under Article 99. Prohibited practices — such as workplace emotion recognition — carry up to €35 million or 7% of total worldwide annual turnover under Article 99(3). Breaching high-risk obligations carries up to €15 million or 3% under Article 99(4). Incorrect or misleading information to authorities carries up to €7.5 million or 1% under Article 99(5). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage and the fixed amount.
Related guides
- Machinery Regulation and the product-safety route for robotics
- AI in critical transport infrastructure (Annex III point 2)
- worker-monitoring AI under Annex III point 4
- Article 6 high-risk classification
- what minimal-risk AI means in practice
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →