EU AI Act: what the law imposes on industrial AI systems

The EU AI Act redefines the rules for deploying artificial intelligence in industrial environments. The Digital Omnibus, published in the EU Official Journal on July 24, 2026, moved high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (AI embedded in regulated products, Annex I). The substance has not changed: companies must turn their legal obligations into tangible technical evidence. As the European Business Review points out, preparatory obligations are already in force and engage the responsibility of operators today. This guide translates the requirements of the European regulation into concrete actions for technical, quality, and integration teams.

What is a "high-risk" AI system according to the EU AI Act?

An AI system is classified as high-risk if it belongs to the categories listed in Annex III of EU Regulation 2024/1689. This classification automatically triggers the documentary obligations of Articles 9 to 17.

Annex III: the list that concerns you

The categories in Annex III directly relevant to manufacturers include:

• Computer vision systems used for quality control or robotic guidance

• Industrial robotics integrating decision-making AI components

• Video surveillance in public spaces with behavioral analysis

• Biometric access control for sensitive sites

• Critical infrastructure management relying on predictive algorithms

Conversely, an inspection camera that records a video stream without any algorithmic layer remains out of scope. It functions as a simple visual sensor, without automated decision-making.

Are you within the scope?

Your system is concerned if:

• You are developing an AI model for a robot cell with vision (Marc, CTO)

• You supervise the quality perimeter of an in-line inspection camera (Sophie, Quality)

• You are deploying an urban video protection system or a biometric access control system (Laurent, Integrator)

These rules apply to large companies as well as SMEs as long as the system falls into an Annex III category. As highlighted by Tech Policy Press, EU AI Act compliance is becoming the default path for any AI deployment in Europe.

The special case of integrators

An integrator deploying a high-risk AI system is considered a "deployer" under the EU AI Act. They bear their own documentary obligations, independent of those of the AI provider. These responsibilities are in addition to those already imposed on them by the Machinery Directive 2023/1230 on delivered cells integrating artificial intelligence.

Key message for Laurent: you are delivering a machine that must know when it does not know, and you must be able to prove it to your client.

What the law concretely requires (Articles 9 to 17)

For an AI system classified as high-risk under Annex III of the EU AI Act, the concrete obligations are: (1) a documented and continuously updated risk management system (Art. 9), (2) governed and traceable training data (Art. 10), (3) comprehensive technical documentation (Art. 11 + Annex IV), (4) automatic monitoring logs enabled by default (Art. 12), (5) documented transparency towards the end-user (Art. 13), (6) a proven human oversight mechanism (Art. 14), and (7) a formalized AI quality management system (Art. 17).

Article 9: Continuous risk management

Article 9 requires an iterative process maintained throughout the life cycle of the system. An aggregated global performance is insufficient: the law imposes an assessment based on the real deployment context. TrustalAI provides the prediction-based reliability required by this article by measuring risk in real-time, before each decision.

Article 10: Data quality

Article 10 imposes governance and traceability of training data: provenance, collection methods, analysis of potential biases, and documentation of preparation practices. For Sophie, this is the foundation of the AI quality file. A model trained on ungoverned data cannot be documented in accordance with Annex IV. Compliance starts before the model, not after.

Article 11 and Annex IV: Technical documentation

The technical documentation must be detailed enough to allow national authorities to assess compliance. Expected content: model architecture and design logic, training data and bias analysis, performances measured in actual deployment context (weather, lighting, terrain variability).

Critical point: model drift. A model that performs well under test conditions can significantly degrade under real industrial conditions. Technical documentation must anticipate this risk and describe how performance is measured continuously.

Article 12: Automatic logs: the most ignored point

Article 12 requires event logs generated at each inference, with the associated level of confidence at the exact moment of the decision. As detailed by Datenschutz-Notizen, the concrete compliance infrastructure for high-risk systems relies on this granular logging, trace-by-prediction, data retention, and complete auditability. TrustalAI automatically generates these prediction-based confidence logs, ensuring actionable traceability during an audit.

Article 13: Transparency

The end-user must understand the limits of the system and the conditions under which its reliability decreases. TrustalAI provides the documented confidence metrics required by Article 13, making it possible to identify low-certainty situations before they impact operations.

Article 14: Proven human oversight

100% automated decisions without proof of reliability are not compliant. Article 14 requires a documented escalation process. TrustalAI allows the definition of escalation thresholds compliant with this article: the system triggers human intervention when confidence drops below a predefined level.

Article 17: AI Quality Management System (AI QMS)

Article 17 imposes a formalized AI quality management system, covering the entire life cycle: design, development, testing, deployment, and post-deployment monitoring. As a priority section for Sophie, it is the organizational framework that overarches all other obligations.

The ISO 42001 standard serves as a complementary reference framework for structuring this QMS. TrustalAI contributes to the technical aspects of this obligation, but the QMS remains an organizational framework that goes beyond the scope of a single tool.

What "documenting" actually means

Let’s break a misconception: documenting under the EU AI Act does not mean producing an annual performance report. Documenting means producing granular, prediction-by-prediction, real-time evidence throughout the life cycle. It is not an ex-post compliance exercise. It is an ongoing operational obligation.

Global metrics vs prediction-based reliability

The prediction-based reliability measures the system's confidence on each individual decision, in real-time, before action. Global metrics measure an aggregated result on a test dataset. The EU AI Act requires the former.

Let’s use the pilot metaphor: a pilot does not fly using the average weather of the month. They need the exact conditions in real-time, for every decision. For industrial AI, the EU AI Act imposes the same logic.

Why traditional monitoring tools are not enough

Traditional monitoring tools measure aggregated metrics over time windows (week, month). They analyze after the incident, not during it. Article 12 requires logs enabled by default on each inference, with the associated level of confidence at the exact moment of the decision. This prediction-by-prediction, real-time granularity is structurally absent from classic monitoring tools.

What an auditor will look at first

The exact question the auditor will ask during a compliance check: "Can you show me the confidence level of your system on this specific decision, taken on March 14 at 11:47 PM?" If the answer is an aggregated monthly accuracy rate: non-compliant.

The 3 mistakes manufacturers make

These mistakes are common even among teams that have taken the subject seriously. Each targets a specific profile and ends with a concrete corrective action.

Mistake 1: Waiting for delivery to document

The most common mistake: treating documentation as a final validation step rather than an ongoing process. Article 9 imposes an iterative risk management system maintained throughout the life cycle, not a report produced at the end of the project.

Corrective action: integrate reliability documentation starting from the development phase, not during production deployment.

Mistake 2: Confusing global performance with individual reliability

A model with 97% overall accuracy can produce 3% of errors concentrated on the most critical cases. This is precisely what Article 9 seeks to prevent. The EU AI Act does not validate an average: it requires risk management by real-world deployment context and by individual prediction.

Corrective action: shift from monthly aggregated reporting to inference-based reliability measurement.

Mistake 3: Believing that compliance falls solely on the supplier

The integrator deploying a high-risk AI system bears their own obligations under the EU AI Act (Articles 16, 17, and 26 for deployers), regardless of what the AI supplier delivered to them. Compliance is not transferred by contract. It is acquired through documentation.

Corrective action: distinguish between what the AI supplier documents and what the integrator must document themselves on the deployment.

EU AI Act timeline: what changes and for whom

Systems already in production do not benefit from a permanent exemption. They are subject to reliability and monitoring obligations as soon as they enter into force.

Regulatory timeline

For video surveillance and other Annex III systems, the deadline is now December 2, 2027. For computer vision and robotics embedded in machinery (Annex I), it is August 2, 2028. Preparatory work (risk management, identifying documentation gaps) should start now: a technical compliance file takes months to build.

Fines and penalties

For prohibited practices, fines can reach 35 million euros or 7% of annual global turnover (Art. 99). Breaching other obligations, including those for high-risk systems, can lead to penalties of up to 15 million euros or 3% of turnover.

Beyond the financial risk, the operational risk is immediate: a non-compliant system cannot be placed on the market or must be withdrawn. We recommend consulting a specialized legal counsel for an assessment tailored to your situation.

How TrustalAI supports your compliance process

TrustalAI automatically handles three core technical obligations of Annex III:

• Timestamped prediction logs (Art. 12): each inference is traced with its level of confidence at the exact moment of the decision

• Confidence metrics for the transparency notice (Art. 13): automatic documentation of reliability and uncertainty conditions

• Confidence thresholds for escalation to human oversight (Art. 14): automatic triggering of human intervention under a defined threshold

In the PoC run with Institut VEDECOM on cooperative perception, the approach cut false positives by 83%. The solution is plug-and-play, black-box compatible, and operates in real-time with latency under 100ms (20ms at the edge), without modifying the existing model. First documentary elements are generated in 2 weeks.

TrustalAI is not a certification, it is the technical layer that produces the evidence that your file is compliant.

Conclusion: anticipating the EU AI Act to secure your industrial AI systems

The EU AI Act imposes seven strict obligations: continuous risk management, data governance, technical documentation, automatic logs, transparency, human oversight, and an AI quality management system. Systems already in production are not exempt. Even with the Digital Omnibus delay, building your technical compliance file remains a priority. TrustalAI supports compliance by generating the required technical evidence. Documentary responsibility remains with the operator.

FAQ: EU AI Act: high-risk AI systems

What is a high-risk AI system?

An AI system is high-risk if it belongs to the categories listed in Annex III of EU Regulation 2024/1689. Examples in scope for manufacturers include a robot cell with AI vision, an in-line inspection system, or a video surveillance camera with behavioral analysis. An out-of-scope example: a camera that records without an algorithmic layer, functioning as a simple sensor.

When does the obligation for manufacturers enter into force?

It depends on the type of system. Since the Digital Omnibus (published in the Official Journal on July 24, 2026), high-risk systems listed in Annex III must comply by December 2, 2027. AI embedded as a safety component in machinery or other regulated products (Annex I) must comply by August 2, 2028.

What is the fine for non-compliance?

Up to 35 million euros or 7% of global turnover for prohibited practices, and 15 million euros or 3% of turnover for breaches of other obligations, including those for high-risk systems (Art. 99). The operational risk is also immediate: a non-compliant system cannot be placed on the market. Consult a specialized counsel to analyze the specific risks of your situation.

Is an integrator subject to the EU AI Act?

Yes. An integrator deploying a high-risk AI system is considered a "deployer" under the EU AI Act and bears their own documentary obligations (Art. 16, 17, 26), in addition to the responsibility already imposed on them by the Machinery Directive 2023/1230. This responsibility is independent of what the AI supplier delivered to them. It is not transferred by contract.

Are global metrics enough to prove compliance?

No. Article 9 imposes a continuous and prediction-based risk management system. Aggregated post-mortem metrics (monthly accuracy, mAP on test dataset) are not enough to prove the real-time operational reliability required by law. This is the central distinction between global performance and prediction-based reliability: the EU AI Act requires the latter.