EU AI Act: product compliance for manufacturers

Hugues Orgitelloupdated 16 Oct 202621 min read

When a manufacturer adds a learning model to an already-regulated product, a vision sensor that classifies parts, a predictive controller, a diagnostic algorithm in a medical device, the question is rarely "is this AI good enough". It is "what does this do to my CE file". Regulation 2024/1689 answers it through the New Legislative Framework: for most CE-marked products the AI requirements ride the conformity procedure the product already follows. Since 27 July 2026 the answer also depends on Regulation (EU) 2026/1744, the Digital Omnibus on AI, which moved the high-risk dates to 2027 and 2028 and took machinery out of the direct scope of the high-risk requirements. This page reads the consolidated text the way a product engineering office reads any product regulation: by article, by role and by what changes in the technical file.

What the AI Act is, in product terms

The Artificial Intelligence Act, formally Regulation 2024/1689, is a horizontal regulation. Like the CRA or the IoT baseline of EN 303 645, it cuts across sectors instead of governing one product family. It does not replace the Machinery Regulation, the MDR or the radio rules. For products listed in Section A of Annex I, it adds requirements for the AI part and routes their assessment through the conformity procedure of the sectoral act (Article 43(3)). For products listed in Section B, it works through amendments to the sectoral acts themselves (Articles 102 to 110 and, for machinery, Article 3 of Regulation (EU) 2026/1744).

The practical reading is short. First, decide whether the feature is an AI system at all. Second, classify it: prohibited, high-risk, subject to transparency duties, or none of these. Third, if it is high-risk through Annex I Section A, fold the requirements of Chapter III, Section 2, into the technical documentation you already maintain.

The legal definition of an AI system

Article 3(1) defines an AI system as "a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments". Adaptiveness is optional ("may exhibit"); the capacity to infer is the decisive element.

The Commission guidelines on the AI system definition (first published on 6 February 2025, formally adopted as C(2025) 5053 on 29 July 2025) give the exclusions that matter for embedded products. They place outside the definition basic data processing that follows fixed, human-programmed rules, classical heuristics, simple prediction systems whose performance a basic statistical rule could achieve, and machine learning used only to improve or accelerate well-established optimisation methods (the guidelines cite physics-based simulation and satellite bandwidth allocation as examples). A deterministic control law or a hand-tuned PID loop is therefore not an AI system; a trained classifier deciding whether a part is defective usually is. The guidelines are not binding, so record the reasoning in the design file.

How the Regulation sorts AI systems

The Regulation itself does not use the "four tiers" labels found in most summaries; it sets out prohibited practices (Article 5), high-risk systems (Article 6 and Chapter III), transparency obligations for certain systems (Article 50) and the AI literacy duty that applies to every provider and deployer (Article 4). General-purpose AI models have their own chapter (Chapter V).

Category	Where in the text	What it means for a product
Prohibited	Article 5(1), points (a) to (h), plus (ba) and (bb) added by 2026/1744	The practice may not be placed on the market, put into service or used
High-risk	Article 6(1) with Annex I, Article 6(2) with Annex III	Chapter III requirements (Articles 8 to 15), provider obligations (Articles 16 to 22), conformity assessment, declaration, CE marking
Transparency	Article 50(1) to (4)	Tell people they interact with AI; mark synthetic output; deployers inform about emotion recognition and disclose deep fakes
Everything else	Article 4	No conformity procedure, but providers and deployers take measures to support AI literacy of their staff

Most embedded features (predictive maintenance on a drive, anomaly detection on a sensor stream, vision inspection on a line) are neither prohibited nor high-risk unless the host product falls under Article 6(1). Article 6(1a), added by Regulation (EU) 2026/1744, confirms that an AI system used solely for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation, convenience or quality control is not a safety component, while Article 6(1b) keeps any AI system whose failure would endanger health and safety inside that notion.

Prohibited practices

Article 5(1) bans, in points (a) to (h): manipulative or deceptive techniques causing significant harm; exploitation of vulnerabilities due to age, disability or social or economic situation; social scoring leading to detrimental treatment (the text is not limited to public authorities); risk assessment of individuals predicting crime based solely on profiling; untargeted scraping of facial images from the internet or CCTV to build recognition databases; inferring emotions in the workplace and in education institutions, except for medical or safety reasons; biometric categorisation inferring race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; and real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions. The Commission guidelines on prohibited practices (4 February 2025) give worked examples.

Point (f) is the one an engineering team can hit by accident: a camera or wearable that infers operator emotion or stress in a workplace is caught unless its purpose is medical or safety. Regulation (EU) 2026/1744 added points (ba) and (bb), on AI generating non-consensual intimate images of identifiable persons and child sexual abuse material, which apply from 2 December 2026.

Transparency duties

Article 50(1) requires providers to design AI systems that interact directly with people so those people are informed, unless it is obvious. Article 50(2) requires providers of systems generating synthetic audio, image, video or text to mark the output in a machine-readable, detectable way. Article 50(3) and (4) put the duties on deployers of emotion recognition and biometric categorisation systems, and of deep fakes. These apply from 2 August 2026. Under Article 111(4), added by 2026/1744, generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2). A product whose model runs internally with no user-facing dialogue and no generated media usually has no Article 50 duty, but check voice and chat interfaces.

The pivot: AI inside an already-regulated product

Article 6(1) makes an AI system high-risk when two conditions are met: (a) it is a safety component of a product, or is itself a product, covered by the legislation in Annex I; and (b) that product must undergo a third-party conformity assessment under that legislation. Article 6(1c), added by 2026/1744, removes from condition (b) a product that needs a third-party assessment "solely due to risks other than risks to health and safety, in particular risks relating to the distribution of radio spectrum or electromagnetic interference".

The Commission published draft guidelines on high-risk classification, covering both Article 6(1) and Article 6(2), on 19 May 2026 for consultation, and states that the final guidelines will be adopted by the end of 2026.

Annex I has two sections, and the difference decides how the AI Act reaches your product.

Annex I	Acts listed (consolidated text, 27 July 2026)	How the AI Act applies to a high-risk AI system
Section A (New Legislative Framework)	Toys 2009/48/EC, recreational craft 2013/53/EU, lifts 2014/33/EU, ATEX 2014/34/EU, radio equipment 2014/53/EU, pressure equipment 2014/68/EU, cableway installations (EU) 2016/424, PPE (EU) 2016/425, gas appliances (EU) 2016/426, MDR (EU) 2017/745, IVDR (EU) 2017/746	Full Chapter III requirements, assessed within the sectoral conformity procedure (Article 43(3)); single declaration (Article 47(3)); CE marking (Article 48)
Section B (other harmonisation legislation)	Civil aviation security, two- or three-wheel vehicles, agricultural and forestry vehicles, marine equipment, rail interoperability, motor vehicle type-approval (two acts), civil aviation (EU) 2018/1139 and, since 27 July 2026, machinery (EU) 2023/1230	Only Article 6(1), Article 60a and Articles 102 to 112 apply (Article 2(2)); the requirements are written into the sectoral act

For Section A, Article 43(3) as amended says the provider follows the conformity assessment procedure of the sectoral act, the Chapter III, Section 2, requirements are part of that assessment, and the quality management system of Article 17 is assessed too. Notified bodies already notified under the sectoral act may assess the AI requirements if their compliance with Article 31(4), (5), (10) and (11) was checked in their notification, and they must apply for designation under the AI Act by 28 January 2028. Two points in the same paragraph matter for route selection:

Question	Article 43(3) answer
Does adding a high-risk AI safety component force a notified body route?	No. Manufacturers "are not required to choose a conformity assessment procedure involving third-party conformity assessment only because the product includes a high-risk AI system as a safety component"
Can I keep a self-assessment route the sectoral act offers when harmonised standards are applied?	Only if harmonised standards or common specifications covering all Chapter III, Section 2, requirements are also applied
How many declarations?	One EU declaration of conformity for all applicable Union law (Article 47(3))
Who is the provider?	The product manufacturer, when the AI system is placed on the market or put into service with the product under its name or trademark (Article 25(3))

Where a notified body already handles the sectoral assessment, it is the natural body to assess the AI requirements, once designated. The Regulation 2024/1689 requirements are then read together with the sectoral presumption of conformity machinery.

Machinery: from Section A to Section B

Regulation (EU) 2026/1744 deleted point 1 (Directive 2006/42/EC) from Section A of Annex I and added Regulation 2023/1230 as point 21 of Section B. Article 3 of the omnibus amends the Machinery Regulation itself:

• Article 8 of Regulation (EU) 2023/1230 now obliges the Commission to adopt delegated acts adding to its Annex III health and safety requirements for AI systems that are high-risk under Article 6(1) of the AI Act, reflecting Chapter III, Section 2, and Articles 17, 19, 72 and 73. Those delegated acts "shall apply by 2 August 2028".
• New Article 20(10): until harmonised standards or common specifications for high-risk AI exist under the Machinery Regulation, compliance with those referenced or adopted under Articles 40 and 41 of the AI Act gives a presumption of conformity with the Annex III requirements on high-risk AI.

The Machinery Regulation already has its own machine learning provisions, and it applies from 20 January 2027. Annex I Part A, points 5 and 6, lists safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions, and machinery with such embedded systems not placed independently on the market; these categories need a notified body route under Article 25(2). Recital 55 limits that to systems that learn or evolve, not software "programmed only to execute certain automated functions". Annex III adds requirements for self-evolving behaviour in the general principles on risk assessment, in section 1.1.6 (ergonomics and human-machine interface) and in section 1.2.1 (control systems must not act beyond their defined task and movement space, must record safety-related decision data and keep it for one year, and must remain correctable). See the machinery guide and the functional safety guide.

The second route to high-risk: Annex III

Article 6(2) makes high-risk the systems listed in Annex III, regardless of any host product. Annex III has eight areas: biometrics; critical infrastructure; education and vocational training; employment and workers management; access to essential private and public services and benefits; law enforcement; migration, asylum and border control; administration of justice and democratic processes. Article 6(3) lets a provider conclude that an Annex III system is not high-risk when it performs a narrow procedural task, improves a completed human activity, detects decision-making patterns without replacing human assessment, or performs a preparatory task, except where it profiles natural persons. That conclusion must be documented (Article 6(4)) and registered (Article 49(2)).

For hardware makers, two Annex III points are the usual contact. Point 1(a) covers remote biometric identification but expressly excludes "biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be", so a one-to-one fingerprint or face unlock is not caught by it; point 1(c) covers emotion recognition. Point 2 covers AI used as a safety component in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.

Requirements for high-risk AI systems

Chapter III, Section 2, sets the requirements; Section 3 the obligations of providers and others. Read as engineering requirements:

Article	Requirement	What it means in design terms
9	Risk management system	Continuous, iterative process over the lifecycle, run alongside the product risk analysis
10	Data and data governance	Training, validation and test data with quality criteria, examined for bias; Article 4a (added by 2026/1744) allows exceptional processing of special categories of personal data for bias detection
11 and Annex IV	Technical documentation	One set of technical documentation; SMEs and small mid-caps may use a simplified Commission form
12	Record-keeping	Automatic logging of events over the lifetime of the system
13	Transparency and instructions for use	Instructions that let the deployer interpret output and use the system appropriately
14	Human oversight	Measures that let a person understand, monitor and, where needed, override or stop the system
15	Accuracy, robustness, cybersecurity	Accuracy levels and metrics declared in the instructions for use (Article 15(3)); resilience to errors, faults and attacks such as data poisoning and model evasion
17	Quality management system	Documented policies and procedures; EN 18286:2026 addresses this article
72 and 73	Post-market monitoring, serious incident reporting	A monitoring plan in the technical documentation; serious incidents reported to market surveillance authorities no later than 15 days after awareness, sooner in specified cases

Article 15 is where the AI Act meets the rest of the product file: accuracy is a declared performance figure, robustness is fault tolerance, and cybersecurity is resistance to attempts to alter the use, outputs or performance of the system. They belong in the same verification campaign as functional safety and EMC.

Harmonised standards: where JTC 21 stands

The Commission asked CEN and CENELEC for AI Act standards in Implementing Decision C(2023) 3215 of 22 May 2023 (M/593), with a delivery date of 30 April 2025 that was missed. Implementing Decision C(2025) 3871 of 23 June 2025 (amendment M/613) repealed and replaced it; under Article 5 it remains valid until 28 February 2027. In October 2025 the CEN and CENELEC Technical Boards adopted exceptional measures, including direct publication after a positive Enquiry vote, so that the standards would be available by the fourth quarter of 2026.

Deliverable (CEN-CLC/JTC 21)	Subject	Status as reported
EN 18286:2026	Quality management system for EU AI Act regulatory purposes (Article 17)	Published by CEN-CENELEC in July 2026; cited in the Official Journal on 14 October 2026 by Implementing Decision (EU) 2026/2274, the first AI Act harmonised standard
prEN 18228	AI risk management	In development (Intertek, 1 October 2026)
prEN 18282	Cybersecurity for AI systems	In development (Intertek, 1 October 2026)
prEN 18229 series	Trustworthiness framework	In development (Intertek, 1 October 2026)
prEN 18284, prEN 18285	Dataset quality and governance; conformity assessment	In drafting (Intertek, 1 October 2026)

A standard gives a presumption of conformity under Article 40 only once its reference is published in the Official Journal. EN 18286:2026, the quality management system standard, has had that reference since 14 October 2026. The presumption reaches only what the standard covers, as its Annex ZA maps it, and Article 40(1) words it around the requirements of Chapter III, Section 2, while Article 17 sits in Section 3 (see the news article on the citation). The other deliverables are not cited yet: a manufacturer can use them as state of the art but must argue conformity requirement by requirement. Article 40(2), as amended, also asks for deliverables supporting joint compliance with the AI Act and Annex I sectoral legislation. See the harmonised standards guide for the citation mechanism.

Providers, deployers and the value chain

Role	Definition (Article 3)	Main obligations
Provider	Develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, for payment or free of charge (point 3)	Article 16: conformity with Section 2, QMS, documentation, logs, conformity assessment, declaration, CE marking, registration where required, corrective action
Deployer	Uses an AI system under its authority, except in a personal non-professional activity (point 4)	Article 26: use per instructions, assign human oversight, monitor operation, keep logs, inform the provider of risks
Importer / distributor	Places on the market an AI system bearing the name of a person established outside the Union / makes it available (points 6 and 7)	Articles 23 and 24: verify conformity assessment, documentation, marking and instructions

Article 25(1) turns a distributor, importer, deployer or other third party into the provider of a high-risk AI system when it puts its name or trademark on it, makes a substantial modification, or changes the intended purpose of a non-high-risk system so that it becomes high-risk. The initial provider must then cooperate and hand over documentation and technical access (Article 25(2), extended by 2026/1744). Article 25(4) requires a written agreement between the provider of a high-risk system and the third party supplying an AI system, model, tools or components integrated in it. For an Annex I Section A product, Article 25(3) makes the product manufacturer the provider when the AI system is placed on the market with the product under the name or trademark of the manufacturer. Map each AI component to a role and an agreement before the design freeze.

General-purpose AI models

Chapter V sets obligations for providers of general-purpose AI models (Article 53), with additional duties for models with systemic risk (Article 55); a model is presumed to have high-impact capabilities when its cumulative training compute exceeds 10^25 floating point operations (Article 51(2)). These obligations apply from 2 August 2025, and models placed on the market before that date have until 2 August 2027 (Article 111(3)). A product team integrating such a model is normally a downstream provider of an AI system, not the model provider; the Commission published guidelines on the scope of the general-purpose model obligations in July 2025. As an economic operator integrating such a model, secure the documentation you need for your own technical file in the supply contract.

The phased timeline

Date	What applies	Legal basis
1 August 2024	Entry into force	Article 113, first paragraph
2 February 2025	Chapters I and II: definitions, AI literacy (Article 4), prohibited practices (Article 5)	Article 113(a)
2 August 2025	Notified bodies (Chapter III, Section 4), general-purpose AI models (Chapter V), governance (Chapter VII), penalties (Chapter XII except Article 101), confidentiality (Article 78)	Article 113(b)
27 July 2026	Regulation (EU) 2026/1744 in force; Articles 102 to 110 (amendments to sectoral acts) apply	Article 4 of 2026/1744; Article 113(d)
2 August 2026	General date of application, including Article 50 transparency duties	Article 113, second paragraph
2 December 2026	New prohibitions in Article 5(1)(ba) and (bb); Article 50(2) for generative systems placed on the market before 2 August 2026	Article 113(a) and Article 111(4) as amended
2 December 2027	Chapter III, Sections 1 to 3, for high-risk systems under Article 6(2) and Annex III	Article 113(c)(i) as amended
11 December 2027	Cyber Resilience Act fully applicable (its reporting obligations apply from 11 September 2026)	Regulation (EU) 2024/2847
28 January 2028	Deadline for Section A notified bodies to apply for designation under the AI Act	Article 43(3) as amended
2 August 2028	Chapter III, Sections 1 to 3, for high-risk systems under Article 6(1) and Annex I; machinery delegated acts to apply by this date	Article 113(c)(ii) as amended; Article 8 of Regulation (EU) 2023/1230 as amended

High-risk systems placed on the market before the applicable Chapter III date are caught only if their design changes significantly after that date (Article 111(2) as amended), except systems for public authorities, which must comply by 2 August 2030. Read the consolidated text on EUR-Lex: the Official Journal version of 12 July 2024 still shows 2 August 2027 for Article 6(1).

From proposal to law

The Commission tabled the Digital Omnibus on AI on 19 November 2025 as COM(2025) 836. The proposal would have tied the high-risk dates to a Commission decision confirming that standards and support tools were available (6 months after it for Annex III, 12 months for Annex I), with 2 December 2027 and 2 August 2028 as long-stop dates, and gave generative systems until 2 February 2027 for Article 50(2). The Commission reports a political agreement on 7 May 2026. The adopted Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July 2026, fixed the two high-risk dates outright, shortened the Article 50(2) grace to 2 December 2026, and added the move of machinery to Section B and the amendments to Regulation (EU) 2023/1230, which the proposal did not contain.

Interaction with other product regulations

Cyber Resilience Act

The CRA, Regulation 2024/2847, sets horizontal cybersecurity requirements for products with digital elements. Under Article 42(3) of the AI Act, added by 2026/1744, a high-risk AI system within the scope of the CRA that fulfils the conditions of Article 12(1) of the CRA is deemed to comply with the cybersecurity requirements of Article 15 of the AI Act. Build one threat model and one body of evidence for both, then add what Article 15 needs beyond cybersecurity: declared accuracy and robustness.

Medical Device Regulation

For a medical device with AI, the MDR (or IVDR) and the AI Act apply together. An AI system that is itself a device, or a safety component of one, is high-risk under Article 6(1) when the device needs a notified body under the MDR (class IIa and above, and class I with a measuring function, sterile, or reusable surgical instruments for those aspects). The AI requirements are assessed in the MDR procedure, by a notified body that also holds AI Act designation, and documented in the MDR technical documentation. The risk management of EN ISO 14971 and the Article 9 risk management system can be run as one process: Article 9(10) allows the AI risk management to be part of, or combined with, the procedures under sectoral law.

Radio equipment

Radio equipment under Directive 2014/53/EU stays in Section A. A radio product reaches high-risk under Article 6(1) only if its AI is a safety component, or the product itself, and the product needs a third-party assessment for health and safety reasons; Article 6(1c) rules out a notified body route driven solely by spectrum or electromagnetic interference concerns. Document which RED essential requirement drove any notified body involvement.

A practical sequence for manufacturers

1. Decide whether it is an AI system. Article 3(1) and the Commission guidelines; record the reasoning.
2. Screen Article 5. Especially point (f) on emotion inference at work and in education, and the new points (ba) and (bb) for generative features.
3. Find the host act and its Annex I section. Section A: Chapter III applies through the sectoral procedure. Section B (now including machinery): follow the sectoral act and its delegated acts.
4. Test Article 6(1). Is the AI a safety component (Article 3(14) as amended, Article 6(1a) and (1b))? Does the product need a third-party assessment for health and safety reasons (Article 6(1c))?
5. Check Annex III for biometrics, emotion recognition and critical infrastructure uses, and document any Article 6(3) derogation.
6. Map roles and contracts under Article 25, including model suppliers.
7. Fold Articles 9 to 15 and 17 into the existing file, using EN 18286:2026 for the quality management system of Article 17, now cited, within what its Annex ZA maps, and the JTC 21 drafts as state of the art for the other articles until they are cited.
8. Ask your notified body whether it has applied for AI Act designation; the deadline is 28 January 2028.
9. Issue one declaration under Article 47(3) and affix the CE marking.
10. Plan post-market monitoring and incident reporting under Articles 72 and 73.

See the CE pillar for the underlying conformity machinery.

Claims the texts contradict

Common claim	What the text says
"High-risk obligations for Annex I products start on 2 August 2027."	That was the original Article 113(c). Regulation (EU) 2026/1744 replaced it: 2 August 2028 for Annex I, 2 December 2027 for Annex III.
"The Digital Omnibus is only a proposal."	It was adopted as Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July 2026 and in force since 27 July 2026.
"The new dates float with the availability of standards."	That was the proposal COM(2025) 836. The adopted text fixed the dates.
"AI in a machine is assessed under the AI Act like a medical device."	Since 27 July 2026, machinery is in Section B; only Article 6(1), Article 60a and Articles 102 to 112 apply. Requirements arrive through delegated acts under Regulation (EU) 2023/1230, to apply by 2 August 2028.
"Adding AI to a product forces a notified body."	Article 43(3): no third-party route is required only because the product contains a high-risk AI safety component.
"Any notified body route under the RED makes the AI high-risk."	Article 6(1c) excludes third-party routes driven solely by risks other than health and safety, naming radio spectrum and electromagnetic interference.
"Biometric access control is an Annex III high-risk system."	Annex III, point 1(a), excludes biometric verification whose sole purpose is to confirm a claimed identity.
"Social scoring is banned only for public authorities."	Article 5(1)(c) is not limited by actor.
"Meeting the CRA covers Article 15 entirely."	Article 42(3) presumes compliance with the cybersecurity requirements of Article 15 only; accuracy and robustness remain.
"Products already sold must be retrofitted."	Article 111(2): systems placed on the market before the Chapter III date are caught only after significant design changes (public authority systems: 2 August 2030).
"Harmonised AI Act standards give presumption of conformity today."	Presumption needs an Official Journal reference. Only EN 18286:2026 has one, since 14 October 2026 (Decision (EU) 2026/2274), and it is the quality management system standard: no standard for the Section 2 requirements (Articles 9 to 15) is cited.
"The four risk tiers are defined in the Regulation."	The Regulation sets Article 5, Article 6, Article 50 and Article 4 duties; "limited risk" and "minimal risk" are summary labels, not legal categories.

Penalties

Article 99 sets maximum administrative fines: up to EUR 35 000 000 or 7 % of worldwide annual turnover for prohibited practices; up to EUR 15 000 000 or 3 % for breaches of operator obligations, notified body requirements and Article 50; up to EUR 7 500 000 or 1 % for incorrect or misleading information to notified bodies or authorities. The higher amount applies for undertakings in general; for SMEs, and since 2026/1744 for small mid-caps, the lower one applies.

Common pitfalls

• Planning around 2 August 2027. That Annex I date no longer exists; use the consolidated text.
• Assuming a second marking. There is no separate AI marking: one declaration covering all applicable Union law, one CE marking.
• Treating machinery like a Section A product. Machinery AI requirements will come through Regulation (EU) 2023/1230 and its delegated acts, alongside the self-evolving ML provisions already in Annex I Part A and Annex III of that regulation.
• Overlooking emotion inference. Article 5(1)(f) is a prohibition, not a transparency duty, for workplace and education uses.
• Misclassifying the role. Integrating a supplier model under your own product name usually makes you the provider; put the Article 25(4) agreement in place.
• Leaving data governance to the end. Article 10 data criteria are design inputs.

See also

• Which EU directives apply to my product?
• Conformity assessment bodies and accreditation
• Substantial modification: when to re-certify in the EU
• AI Act: applicable, but high-risk duties are deferred
• Harmonised standards and presumption of conformity
• EU declaration of conformity

Working on folding EU AI Act requirements into an existing CE technical file for a real product? AESTECHNO can audit your design and certification plan. Get in touch

Sources & references

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal version, EUR-Lex eur-lex.europa.eu/eli/reg/2024/1689/oj
2. Regulation (EU) 2024/1689, consolidated text of 27 July 2026, EUR-Lex eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727
3. Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230, EUR-Lex eur-lex.europa.eu/eli/reg/2026/1744/oj
4. COM(2025) 836, proposal for the Digital Omnibus on AI (19 November 2025), EUR-Lex eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0836
5. Regulation (EU) 2023/1230 on machinery, EUR-Lex eur-lex.europa.eu/eli/reg/2023/1230/oj
6. Cyber Resilience Act, Regulation (EU) 2024/2847, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
7. AI Act, European Commission policy page (timeline, omnibus, guidelines), European Commission digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
8. Commission guidelines on the definition of an AI system, European Commission digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-ai-system-definition-facilitate-first-ai-acts-rules-application
9. Commission guidelines on prohibited AI practices, European Commission digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
10. Draft Commission guidelines on the classification of high-risk AI systems (May 2026), European Commission digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems
11. Implementing Decision C(2025) 3871, standardisation request for high-risk AI systems (M/613, replacing M/593), European Commission ec.europa.eu/transparency/documents-register/api/files/C(2025)3871_0/de00000001072818?rendition=false
12. CEN and CENELEC decision to accelerate AI standards (October 2025), CEN-CENELEC www.cencenelec.eu/news-events/news/2025/brief-news/2025-10-23-ai-standardization/
13. EN 18286 in the spotlight: supporting compliance with the AI Act, CEN-CENELEC www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/
14. EN 18286 is published (secondary source: JTC 21 deliverable status, OJ citation status), Intertek www.intertek.com/blog/2026/10-01-en-18286-first-eu-ai-act-standards-puzzle-piece-is-on-the-table/
15. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems (OJ L, 14 October 2026), Official Journal of the European Union data.europa.eu/eli/dec_impl/2026/2274/oj
16. Blue Guide on the implementation of EU product rules, European Commission eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629(04)