EU AI Act Compliance for Manufacturing: Machinery, Robots, and the Two Routes to High-Risk

Most factory AI falls outside the EU AI Act's high-risk obligations. Predictive maintenance, quality-control vision, demand forecasting, process optimisation — these are operational tools. The regulation does not regulate them in any meaningful sense. What it does regulate, with real precision, is AI that performs a safety function inside a product already covered by EU product safety law, or AI that manages safety in critical infrastructure. Getting that line right matters because the obligations on either side of it are very different.

The Majority of Manufacturing AI Is Minimal-Risk

Start here, because the opposite assumption is widespread and expensive.

The EU AI Act under Regulation (EU) 2024/1689 classifies AI systems into four risk tiers. The bottom tier — minimal risk — carries no mandatory obligations. It covers everything not captured by the prohibited-practices list (Article 5), the high-risk classifications (Article 6), or the limited-risk transparency rules (Article 50 for chatbots and synthetic content). Most manufacturing AI lives in this tier.

Predictive maintenance AI that monitors vibration signatures and schedules a maintenance window is a minimal-risk system. Computer vision that checks weld quality at line speed is minimal-risk. Supply-chain algorithms that optimise procurement or delivery routing are minimal-risk. None of these appear in Annex III (the eight-category high-risk list) and none of them function as safety components of regulated products. Voluntary codes of conduct can apply, but there is no mandatory compliance stack.

The practical implication: do not treat the EU AI Act as a sweeping industrial regulation. It is a targeted one. The question to ask of every system is whether it fits a specific high-risk route — and there are exactly two of them for manufacturing.

Two Routes to High-Risk in Manufacturing

Route 1 — Article 6(1) + Annex I: The Product Safety Route

This is the route most relevant to manufacturing companies that build machinery and industrial equipment.

Under Article 6(1), an AI system is high-risk if it is a safety component of a product covered by EU harmonised legislation listed in Annex I of the AI Act, and that product requires third-party conformity assessment under that Annex I legislation.

The Machinery Regulation (EU) 2023/1230 — which replaced the old Machinery Directive and applies to the full scope of industrial machinery, including robots and cobots — is an Annex I instrument. So are the Low Voltage Directive, the Radio Equipment Directive, the Pressure Equipment Directive, and several others relevant to industrial production.

What counts as a safety component? The concept refers to an AI system whose failure or malfunction could endanger the health or safety of persons. In a manufacturing context, the clearest cases are:

• AI that controls emergency stop logic or guards in an industrial robot
• AI that enforces safety zones between collaborative robots and human operators — detecting proximity, commanding speed reduction or stop
• AI that governs pressure, temperature, or chemical dosing in a process where exceedance causes a hazard
• Vision AI that is the primary means of preventing a machine from operating when a guard is open

By contrast, AI that optimises a tool path for surface finish, schedules preventive maintenance based on sensor data, or adjusts production throughput for energy efficiency is not performing a safety function. It is performing an operational function. The same physical sensor data feeding two separate AI outputs can produce a minimal-risk operational prediction and a high-risk safety command simultaneously — the classification follows the function, not the hardware.

Who bears the obligation? The equipment manufacturer — the OEM who builds the machine containing the AI — is the provider under Article 16 of the AI Act. The factory buying and operating that machine is the deployer under Article 26. This maps cleanly onto the Machinery Regulation's existing structure, where the machinery manufacturer holds the technical file and CE marking responsibility.

The deadline for this route is 2 August 2028. Under the Digital Omnibus agreement reached in May 2026, high-risk AI systems that are safety components of Annex I products must comply with the AI Act's high-risk obligations by 2 August 2028.

Route 2 — Annex III, Points 2 and 4: Infrastructure and Workforce

Annex III of the AI Act lists eight high-risk categories. Two are directly relevant to manufacturing.

Annex III, point 2 — Critical infrastructure safety. AI constituting a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating, and electricity falls here. This is a narrow category. A standard manufacturing plant that supplies into the general market is not critical infrastructure. But a plant that provides essential outputs to energy grids, water treatment, or strategically critical supply chains may qualify, if the AI performs a safety management function within that facility. An AI system that manages emergency shutdowns across a gas-processing facility is a different proposition from a scheduling tool at a consumer goods plant.

Annex III, point 4 — Employment, worker management. AI used by manufacturers in HR functions — screening job applicants for factory positions, monitoring employee performance metrics to drive promotion or termination decisions, or allocating shift tasks through an automated system — falls under Annex III point 4 of the AI Act. These are worker-facing uses, not machine-facing, and they trigger the full high-risk stack regardless of what the rest of the factory's AI does.

Also directly relevant here: Article 5(1)(f) of the AI Act prohibits emotion recognition in the workplace. A system that infers the emotional states of workers on a production line — whether framed as wellbeing monitoring, safety attentiveness checking, or fatigue detection — is prohibited outright, not high-risk. It has applied since 2 February 2025. The fine ceiling for violations is €35,000,000 or 7% of total worldwide annual turnover under Article 99(3), whichever is higher.

The deadline for Annex III stand-alone systems is 2 December 2027, under the same Digital Omnibus agreement.

The Machinery Regulation Overlap

Manufacturers familiar with CE marking under the Machinery Regulation (EU) 2023/1230 have a practical head start on AI Act compliance, but they should not assume the two frameworks are the same or fully substitutable.

The Machinery Regulation already requires a technical file, risk assessment, and — for the higher-risk machinery categories listed in its Annex I — third-party examination by a notified body before CE marking. When an AI system is embedded in such machinery as a safety component, the AI Act's Article 6(1) high-risk classification is triggered, and the Article 43 conformity assessment must be completed before the system is placed on the market.

The practical architecture is an integrated conformity assessment. The AI system's compliance evidence — the Article 9 risk management system, the Article 11 / Annex IV technical documentation, the Article 14 human oversight design, the Article 15 accuracy and robustness records — sits within the same technical file as the Machinery Regulation documentation. The CE mark on the finished machine reflects conformity with both instruments. Article 47 requires a separate EU Declaration of Conformity for the AI Act purposes, and Article 48 governs the CE marking that follows.

One distinction to maintain: the Machinery Regulation's essential health and safety requirements and the AI Act's technical requirements for high-risk AI are complementary, not substitutes. Satisfying one does not discharge the other. Document both.

Provider and Deployer Obligations

If your company manufactures equipment containing AI safety components, you are the provider. Article 16 sets the full obligation stack: quality management system (Article 17), risk management system (Article 9), data governance (Article 10), technical documentation (Article 11 / Annex IV), logging (Article 12), transparency and instructions for the deployer (Article 13), human oversight design (Article 14), accuracy and robustness (Article 15). You must complete conformity assessment under Article 43 before placing the system on the market, draw up a Declaration of Conformity under Article 47, and affix CE marking under Article 48. After market placement, Article 72 requires a post-market monitoring system.

If your company operates AI systems purchased from a vendor, you are the deployer. Article 26 applies: use the system in accordance with the provider's instructions, assign personnel with the competence and authority for human oversight, monitor for risks, and document and report serious incidents. If the AI system is used for a purpose within Annex III — for example, you deploy a vendor-supplied AI for workforce scheduling or applicant screening — the deployer obligations apply to you even though the provider holds the technical documentation.

A manufacturer who develops AI in-house, substantially modifies a procured AI system, or deploys a procured system for a purpose outside its original intended use may be reclassified as the provider under Article 25. This role-shift obligation is worth auditing carefully before an AI procurement is operationalised.

Obligations Table for Manufacturing

How Confir Helps Manufacturing Companies

Manufacturing organisations face a compliance decision that is more nuanced than the headline coverage suggests: most of their AI is minimal-risk, a subset may be high-risk via the product safety route, and a small number of workforce-facing systems may be high-risk via Annex III — with emotion recognition prohibited outright.

Confir's rule-based, deterministic classification logic works through both high-risk routes in sequence. The intake process surfaces the facts that matter — does this AI perform a safety function within regulated machinery? Is it used for workforce decisions within Annex III point 4? — and produces a documented classification rationale that an internal compliance team or external reviewer can follow and challenge. Same inputs, same output; no inference, no hallucination.

For providers of machinery AI, Confir generates the Article 11 / Annex IV technical documentation structure (the "Conformity Package"), produces the Article 47 Declaration of Conformity, and runs the Article 27 Fundamental Rights Impact Assessment where applicable. The Risk Register lets compliance teams track a mixed portfolio — minimal-risk operational AI and high-risk safety-component AI — in one place, with role (provider/deployer), classification, and deadline visible across systems.

Pricing starts at €600/year. No consultants, no multi-month implementation.

Frequently Asked Questions

Is predictive maintenance AI high-risk under the EU AI Act? Generally not. A system that monitors equipment health indicators and schedules maintenance windows is an operational efficiency tool, not a safety component in the Machinery Regulation sense. It would need to directly control safety-critical functions — triggering a protective shutdown, for example — before the Annex I high-risk route would apply. Most predictive maintenance AI is minimal-risk with no mandatory compliance obligations.

When do EU AI Act obligations apply to manufacturing AI? Article 5 prohibited practices have applied since 2 February 2025 — that includes the prohibition on emotion recognition in the workplace. High-risk AI that is a safety component of Annex I products (the Machinery Regulation route) must comply by 2 August 2028. High-risk AI falling under Annex III stand-alone categories (critical infrastructure safety; HR/workforce uses) must comply by 2 December 2027. Both dates are set by the Digital Omnibus agreement reached in May 2026.

Does CE marking under the Machinery Regulation satisfy the EU AI Act? No. The two frameworks are distinct. CE marking under the Machinery Regulation demonstrates conformity with its essential health and safety requirements; it does not substitute for the Article 43 conformity assessment and Article 47 Declaration of Conformity required under the EU AI Act. Where both apply, both must be satisfied. In practice, the AI Act compliance evidence is integrated into the Machinery Regulation technical file, but they are separate legal requirements.

What makes an AI system a "safety component" for Article 6(1)? A safety component is an AI system whose failure or malfunction could endanger the health or safety of persons. In manufacturing, this covers AI that controls robot motion near human operators, AI that manages emergency stop logic, and AI that governs hazardous process parameters. AI that optimises throughput, predicts demand, or improves product quality without any safety function is not a safety component.

Are collaborative robot (cobot) AI systems high-risk? Almost certainly, if the AI performs safety-critical spatial awareness — detecting human presence in the working envelope, commanding speed reduction or emergency stop, enforcing safety zones. That is a safety function within machinery covered by the Machinery Regulation. The provider (the cobot or AI software manufacturer) must complete Article 43 conformity assessment before market placement, with the 2 August 2028 deadline applying.

Does the AI Act apply to AI embedded in SCADA or MES systems? It depends on the function. SCADA and MES platforms are not inherently high-risk. If a specific AI module within those systems performs a safety management function in critical infrastructure (Annex III point 2), or drives workforce decisions (Annex III point 4), that module's use warrants assessment. General scheduling, reporting, and optimisation functions within SCADA/MES remain minimal-risk.

What happens if we deploy an AI system outside its intended purpose? Under Article 25, a deployer who places an AI system into service for a purpose other than its intended use — or substantially modifies it — may be reclassified as the provider, inheriting the full Article 16 obligation stack. This is a significant risk for manufacturers who adapt procured AI tools for safety-critical applications they were not designed or certified for.

Related guides

• Article 6 risk classification requirements
• responsible AI governance framework
• Article 6 high-risk AI classification