What The EU AI Act Is, And Is Not
The EU AI Act is a risk-based product safety law for AI systems, separate from personal-data rules like GDPR. It can apply even when no personal data is processed. Think of GDPR as governing data, and the AI Act governing the AI system itself. The Commission explains the risk tiers and governance on its AI policy page (European Commission, 2026). Many manufacturing AI assistants touch mostly product data, not people data, which keeps GDPR overhead lower in practice (GDPR overview).
The AI Act’s Timeline You Can Plan Around
The regulation entered into force on 1 August 2024 (Commission news). Key application dates are fixed on the Commission’s timeline: prohibited practices and AI literacy from 2 February 2025, general‑purpose AI model obligations from 2 August 2025, most rules from 2 August 2026, and high‑risk rules for AI that is a safety component of regulated products from 2 August 2027 (EU timeline; White & Case summary of Article 113). If a partner tells you dates are “still moving,” they are likely confusing proposals to simplify with the law on the books.
The Risk Tiers In Plain English
Prohibited risk covers a short list such as social scoring and certain biometric uses. Of special note for factories and offices, inferring emotions of workers is banned from 2 February 2025, with narrow health and safety carve‑outs (European Parliament news).
High‑risk AI is either listed in Annex III or is an AI safety component inside a regulated product that needs a third‑party conformity assessment. Annex III includes employment and workers’ management, biometric identification and categorisation, and critical infrastructure, among others (AI Act Service Desk, Annex III).
Limited or “transparency” risk covers things like chatbots and generative AI content that must notify users or label outputs. These transparency duties apply from 2 August 2026 (Article 50 summary, Commission; Commission code of practice work, 2025). Minimal risk has no obligations, which is where most everyday systems sit (Commission overview).
Why Your Technical‑Services Assistants Are Usually Not The Target
Product-intelligence assistants that answer spec questions, match SKUs to requirements, compare products, or draft quote language typically do not fall within Annex III. They are not making employment decisions, managing workers, or acting as safety components of regulated machinery. They also tend to process catalog attributes and standards, not sensitive personal data. This keeps most AI manufacturing workflows in minimal or limited risk with only transparency steps, like telling users they are chatting with AI and labeling any auto‑generated public comms as AI‑made from August 2026 (Article 50, Commission). That is good news for teams that need speed and scale now. It is also a relief for messy data realities that would make full high‑risk compliance onerous.
The Edge Cases That Change Your Obligations
Watch three scenarios that can quickly move you into high‑risk or even prohibited territory. First, worker management and hiring. If your AI screens candidates, allocates shifts based on traits, or evaluates performance, it is Annex III high‑risk and triggers heavier controls (Annex III, point 4). Second, biometric monitoring and emotion recognition. Real‑time worker emotion inference is prohibited from 2 February 2025, and several biometric systems are classed high‑risk even when allowed (Parliament news; Annex III, point 1). Third, AI as a safety component. If your system helps control a lift, a robotic arm, or another regulated product that needs a notified body, the high‑risk rules apply with an extended deadline to 2 August 2027 (Commission timeline).
What High‑Risk Requirements Feel Like Day To Day
High‑risk is manageable, but it is real work. Expect to run a risk‑management system that identifies, tests, and mitigates risks over the lifecycle (Article 9). Build and maintain technical documentation that explains the model, data, and intended use (Article 11). Keep logs for traceability (Article 12). Provide clear information to deployers and set human‑oversight controls so people can understand and intervene appropriately (Articles 13–14). Meet accuracy, robustness, and cybersecurity requirements in line with state of the art (Article 15). None of this requires perfection, but it does require consistency.
A Simple Classification Checklist For Manufacturing Use Cases
Ask five questions before you scale a workflow across plants, brands, or countries.
-
Does the system decide on hiring, promotion, discipline, shift allocation, or performance ratings for individuals. If yes, treat as high‑risk and plan for Annex III controls.
-
Does it use biometric identification, categorisation, or emotion recognition on people in your workplace. If yes, either prohibited or high‑risk depending on the specific use and lawfulness.
-
Is it an AI safety component of a regulated product that needs third‑party conformity assessment. If yes, high‑risk with the 2027 date.
-
Is it a chatbot or generator used with customers or channel partners. If yes, prepare for transparency notices and content labeling from August 2026.
-
Does it process personal data at all. If yes, layer GDPR duties as applicable. If not, the AI Act can still apply because scope is system‑based, not data‑based (Commission overview; GDPR basics).
Where GPAI Models Fit In Your Stack
General‑purpose AI model requirements started in 2025 for providers, with transitional help and codes of practice. As a deployer, you are not the GPAI provider, but you should still expect model documentation and system cards that explain capabilities, limits, and known risks. The Commission has signposted guidance and a code of practice to help operationalize this (Commission GPAI guidance, 2025; draft code process, 2025). This is practical insurance if you later extend into higher‑risk areas like quality control AI at the line or predictive maintenance tied to machinery controls.
Reassurance For 2026 Manufacturing Roadmaps
Most technical‑services AI in manufacturing will classify as minimal or limited risk. These assistants answer product questions, map requirements to SKUs, generate comparisons, or help draft quotes. They can be designed to avoid personal data and still deliver value. You will still need simple notices and labeling for interactive and generative features from August 2026. That is a light lift compared with Annex III programs, and it is entirely compatible with lean teams and messy catalogs. It is definately achievable.
Procurement Guidance So You Can Scale Safely If Scope Expands
Choose providers with a regulatory‑aware posture, even if your first use cases are limited risk. Look for four signals. First, solid documentation of model purpose, data sources, evaluation methods, and update history. Second, change‑management controls that record versions and allow rollback. Third, configurable transparency settings for chat and content marking aligned to Article 50. Fourth, incident handling and logging that your auditors can actually use. If a pilot later moves toward employment, biometrics, or safety‑component territory, these foundations reduce rework and keep momentum while meeting the Act’s practical requirements (Commission overview of high‑risk controls).
