EU AI Act for Manufacturers: Inventory, Classify and Assign Oversight
List every AI system you use, decide your role and risk class, and name the people who oversee each one.
In Short
- Most rules apply from 2 Aug 2026.
- Worker monitoring AI can be high-risk.
- Keep deployer logs 6+ months.
Regulation (EU) 2024/1689, the AI Act, sets rules for AI systems placed on the market or used in the EU. Most of it applies from 2 August 2026, but its first chapters applied from 2 February 2025 and Article 6(1) obligations from 2 August 2027. For a manufacturer the first jobs are to list where AI is used, decide each system's role and risk class, and give named people oversight. This guide summarises the Regulation's original Official Journal text; it is orientation, not legal advice. Sources checked 4 Oct 2026.
Which dates apply
Article 113 sets the timetable. The Regulation applies from 2 August 2026.
More on which dates apply
Chapters I and II, which include the AI literacy duty in Article 4 and the prohibited practices in Article 5, have applied since 2 February 2025. Rules for general-purpose AI models, governance and penalties applied from 2 August 2025. Article 6(1) and its obligations, covering AI that is a safety component of products under Annex I legislation, apply from 2 August 2027. Amendments to these dates have been proposed; this guide did not open any amending act, so check EUR-Lex before relying on a date.
Start with an AI inventory
You cannot classify what you have not listed. Record each AI system in use: the supplier, what it is intended to do, which process it touches, who uses its output and whether your company is the provider (you develop it or have it developed and place it on the market under your name) or the deployer (you use it under your authority).
Worked Example: AI Register Extract
| System | Our role | Initial view | Owner |
|---|---|---|---|
| AI-01 vision check on fill line | Deployer | Check Annex I route with vendor | Quality lead |
| AI-02 shift task allocation | Deployer | Annex III point 4(b) candidate | HR and legal |
| AI-03 in-house drafting assistant | Deployer | Not high-risk; AI literacy applies | IT lead |
- AI-01 vision check on fill line
- Our role
- Deployer
- Initial view
- Check Annex I route with vendor
- Owner
- Quality lead
- AI-02 shift task allocation
- Our role
- Deployer
- Initial view
- Annex III point 4(b) candidate
- Owner
- HR and legal
- AI-03 in-house drafting assistant
- Our role
- Deployer
- Initial view
- Not high-risk; AI literacy applies
- Owner
- IT lead
More on start with an AI inventory
A vision inspection model bought from a vendor makes you a deployer; a model you build and sell inside equipment can make you a provider. The role decides which chapter of the Regulation you read next.
Is it high-risk?
Article 6 gives two routes. Under Article 6(1), an AI system is high-risk where it is a safety component of a product, or is itself a product, covered by the Union legislation in Annex I and that product needs third-party conformity assessment; Annex I includes machinery, medical devices and in vitro diagnostics.
More on is it high-risk?
Under Article 6(2), systems listed in Annex III are high-risk. For most plants the relevant Annex III entry is point 4, employment and workers' management, which covers AI used to allocate tasks based on personal traits or to monitor and evaluate workers' performance. Article 6(3) allows narrow exceptions that must be assessed and documented.
Deployer Duties for High-Risk Systems
Article 26 lists what deployers of high-risk AI must do. Use the system according to the provider's instructions.
Deployer checklist for a high-risk system (Article 26)
More on deployer Duties for High-Risk Systems
Assign human oversight to people with the competence, training and authority to act. Where you control input data, make sure it is relevant and sufficiently representative. Monitor operation, inform the provider and authorities of risks and serious incidents, and suspend use where the Article requires it. Keep the logs the system generates, where they are under your control, for at least six months unless other law says otherwise. Before using such a system at work, employers must inform workers' representatives and affected workers.
AI Literacy and GxP Records
Article 4 requires providers and deployers to take measures to ensure, to their best extent, sufficient AI literacy among staff who operate or use AI systems, taking account of their experience and the context of use. In regulated manufacturing this sits alongside existing obligations: computerised system validation, data integrity, change control and training records still apply under GMP or quality system rules.
More on aI Literacy and GxP Records
The AI Act does not replace them. A practical approach is one register that links each AI system to its risk classification, intended use, validation status, oversight owner and training evidence, reviewed by quality and legal people.
Questions
When does the EU AI Act apply?
Generally from 2 August 2026. Chapters I and II applied from 2 February 2025, and Article 6(1) obligations apply from 2 August 2027, under Article 113 of the original text.
Is AI visual inspection on a production line high-risk?
Not necessarily. It depends on whether it is a safety component of an Annex I product needing third-party assessment, or falls in Annex III. Your legal team decides.
Does monitoring operator performance with AI matter?
Yes. Annex III point 4(b) lists AI used to monitor and evaluate the performance and behaviour of workers as high-risk, subject to the Article 6(3) exceptions.
How long must deployers keep high-risk AI logs?
Article 26(6) requires at least six months for logs under the deployer's control, unless other Union or national law, including data protection law, provides otherwise.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
Agentic AI in Regulated Manufacturing: Where Autonomy Stops
AI in Manufacturing Execution: What It Does Today, and What It Doesn't
EU GMP Annex 1 Guide: Contamination Control Strategy, APS and PUPSIT
EU Acrylamide Regulation 2017/2158: Mitigation, Sampling and Benchmark Levels
AI and 21 CFR Part 11: Where AI Fits in Regulated Records
Predetermined Change Control Plans (21 U.S.C. 360e-4) for Medical Devices