Artificial Intelligence Act (EU) 2024/1689

Regulation (EU) 2024/1689 distinguishes mainly between providers and deployers. A deployer is anyone who uses an AI system under its own authority, except for personal non-professional use. A service company that uses a language model for reports, a forecasting tool for wear or a document analysis tool is a deployer. A provider is whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark, including free of charge. If you sell your own diagnostic software to customers, you are a provider.

What follows from that depends on the risk class. Certain practices have been prohibited since 2 February 2025. Most tools used in service and maintenance, such as document analysis, ticket sorting or wear forecasts, are generally not high-risk systems. The duty to support AI literacy applies to them and, where relevant, the transparency rules. High-risk obligations concern only AI used as a safety component of a regulated product or in the areas of Annex III.

For classification, the use counts, not the technology. A list of the AI applications in your business, with purpose, provider and place of use, is the basis for everything else. vi itself supports people with documents and makes no safety decisions on plants.

Two rules are already in force. The first is AI literacy under Article 4, which has applied since 2 February 2025. The Digital Omnibus rewrote it in July 2026. Providers and deployers must now take measures to support the development of AI literacy of their staff and of other persons who deal with AI systems on their behalf. They take into account technical knowledge, experience and training and the context of use. They do not have to guarantee a specific level of literacy to anyone. Training and internal guidelines are one way to meet this, and the Commission is to publish practical examples on a central platform.

The second is the transparency duties under Article 50, which have applied since 2 August 2026. Under paragraph 1, providers must ensure that systems interacting directly with people inform them that they are dealing with an AI, unless that is obvious. Under paragraph 2, providers must mark synthetic content in a machine-readable format. For systems placed on the market before 2 August 2026, a transition period until 2 December 2026 applies to the marking under paragraph 2. If you run a chatbot for customer inquiries, you generally depend on the provider for this and should check that the notice about the AI interaction is there.

There are two routes. Under Article 6(1), an AI system is high-risk if it is intended to be used as a safety component of a product covered by the Union harmonization legislation listed in Annex I, and that product must undergo a third-party conformity assessment. Examples are lifts or pressure equipment. Machinery no longer belongs here since the Digital Omnibus (see the next question). Under Article 6(2), the systems listed in Annex III are also high-risk. For plants, point 2 is the relevant one: AI as a safety component in the operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity.

What matters is the term safety component, and the Digital Omnibus has sharpened it. AI systems used solely for non-safety related aspects such as user assistance, performance optimization, efficiency, automation or quality control are not safety components. Conversely, AI systems whose failure or malfunctioning would endanger health and safety qualify as safety components.

For typical service tools this means: a forecast of when a bearing will wear out, or the analysis of service reports, serves maintenance planning and is not a safety component. A camera-based person detection that stops a press is one. The classification is made by the provider, and operators should ask to see the result in the documentation.

Originally the high-risk obligations were to apply from 2 August 2026 to AI systems under Annex III and from 2 August 2027 to AI in products under Annex I. Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July and in force since 27 July, has shifted this. Chapter III, Sections 1 to 3 now apply from 2 December 2027 to systems under Article 6(2) and Annex III and from 2 August 2028 to systems under Article 6(1) and Annex I. Parliament had approved it on 16 June 2026, the Council on 29 June 2026.

For machinery there is a second change. The Machinery Regulation moves in Annex I of the AI Act from Section A to Section B. For AI systems in such products, only Article 6(1), Article 60a and Articles 102 to 112 then apply. The requirements for AI as a safety component of machinery are to come instead through delegated acts into the Machinery Regulation, to apply by 2 August 2028.

For operators that means: anyone now procuring plants with AI safety functions will find the requirements for them in the Machinery Regulation and not in the high-risk duties of the AI Act. The purchase contract should say what evidence the manufacturer provides for this and when the AI requirements that come later will be met.

Article 26 sets them out, and they apply to high-risk systems from the dates given above. Deployers must take appropriate technical and organizational measures to use the system in accordance with its instructions for use. They assign human oversight to natural persons who have the necessary competence, training and authority, and give them the support they need. To the extent the input data are under their control, they ensure that the data are relevant to the intended purpose and sufficiently representative.

Monitoring in operation comes on top. Deployers monitor the system on the basis of the instructions and, where relevant, inform the provider. If they have reason to consider that use in accordance with the instructions may present a risk within the meaning of the Regulation, they inform the provider or distributor and the market surveillance authority without undue delay and suspend use. After a serious incident, they notify without undue delay, first the provider. Logs generated automatically are kept, to the extent they are under the deployer's control, for at least six months.

A practical checklist follows: keep the instructions for use, name who is responsible for oversight, secure the logs and set a reporting route to the provider. Settling this in the service contract creates clarity once the high-risk duties for plants with AI functions start to apply in December 2027 and August 2028.

Under Article 25(1), distributors, importers, deployers and other third parties are considered providers of a high-risk AI system, subject to the provider obligations, in one of three cases. They put their name or trademark on a high-risk system already placed on the market, although contractual arrangements may allocate the obligations differently. They make a substantial modification to a high-risk system already on the market so that it remains high-risk. Or they modify the intended purpose of an AI system not classified as high-risk so that it becomes high-risk.

The third case matters to service companies. Anyone who repurposes an analysis tool so that it now controls safety functions can become the provider by doing so. For safety components of products under Annex I, Section A, such as lifts, Article 25(3) also applies: the product manufacturer is then considered the provider.

Two things are worth putting in a contract. First, a clause that fixes the purpose of the system and rules out operators repurposing it for safety-relevant functions without involving the provider. Second, where third parties supply AI components to a high-risk system: under Article 25(4), the provider and the supplier must specify in a written agreement which information, technical access and assistance the provider needs to meet its obligations.