AI Act 2026: Industrial AI Compliance — The Complete Guide for European Manufacturers
The European AI Act applies its transparency obligations from 2 August 2026; the Digital Omnibus postponed high-risk systems to 2 December 2027. SMEs and mid-cap manufacturers using predictive maintenance, quality inspection, or document analysis must classify their AI systems by risk and document them. Here's the 5-step compliance methodology.
TL;DR: Since 2 August 2026, the transparency obligations of the European AI Act (Regulation EU 2024/1689) have been in application. The Digital Omnibus, in force since 27 July 2026, postponed high-risk systems to 2 December 2027. Every AI system deployed in industry — predictive maintenance, quality control, document analysis — must be classified by risk level and documented. Here is the 5-step compliance methodology.
Since 2 August 2026, the transparency obligations of the European regulation on artificial intelligence (AI Act, Regulation EU 2024/1689) have been in application. The Digital Omnibus on AI, in force since 27 July 2026, postponed the obligations for high-risk systems to 2 December 2027 (stand-alone systems) and 2 August 2028 (systems embedded in regulated products). It is the world's first legally binding framework for AI — and it directly concerns SMEs and mid-cap manufacturers using AI systems in production, maintenance, quality control, or document processing [artificialintelligenceact.eu].
Unlike the GDPR (which governs personal data), the AI Act regulates the AI systems themselves: their design, deployment, and oversight. In industry, this covers predictive maintenance algorithms, computer vision for quality inspection, conversational agents for technical support, and logistics recommendation engines.
This article provides the risk classification, obligations by category, and a concrete compliance methodology — with a focus on automation as an acceleration lever.
AI Act: Definition and Founding Principles
The AI Act is a directly applicable European regulation (like the battery passport regulation). It requires no national transposition and binds any company placing an AI system on the European market or using one on EU territory — even if the supplier is outside Europe [digital-strategy.ec.europa.eu].
Its objective: ensure that AI systems used in the EU are safe, transparent, ethical, and respectful of fundamental rights. It does not stifle innovation — it frames it.
Key Dates
| Date | Obligation |
|---|---|
| 1 August 2024 | Entry into force |
| 2 February 2025 | Prohibition of unacceptable AI practices |
| 2 August 2025 | Obligations for general-purpose AI models (GPAI) |
| 2 August 2026 | Transparency obligations (Art. 50): chatbots, AI-generated content |
| 2 December 2027 | Obligations for stand-alone high-risk systems (Annex III) — postponed by the Digital Omnibus |
| 2 August 2028 | Obligations for high-risk systems embedded in regulated products (Annex I) — postponed |
Source: [digital-strategy.ec.europa.eu], [europarl.europa.eu]
The Digital Omnibus Changed the Timeline
The Digital Omnibus on AI (proposed by the European Commission on 19 November 2025, adopted in June 2026, in force since 27 July 2026) postponed most of the AI Act's original timeline. The direct consequence for industry: obligations for stand-alone high-risk systems (predictive maintenance, quality inspection, control-command) move from 2 August 2026 to 2 December 2027, and those for systems embedded in regulated products (machinery, equipment) to 2 August 2028.
What has not changed: the transparency obligations (Art. 50) apply from 2 August 2026 — telling users they are interacting with an AI, marking AI-generated content. And postponing the high-risk deadlines removes no obligation: it buys time to prepare compliant documentation, it does not exempt you from getting there.
Risk Classification: Where Does Your Company Stand?
The AI Act classifies AI systems into 4 risk levels. Here is how to read this classification for your industrial context.
Unacceptable Risk (PROHIBITED)
- Subliminal behavioural manipulation
- Social scoring by public authorities
- Real-time biometric identification in public spaces (except strict exceptions)
- In industry: not relevant for standard manufacturing use cases
High Risk (STRICT OBLIGATIONS)
- AI for product safety components (machine parts, control systems)
- AI for critical infrastructure management (energy, water, transport)
- In industry: predictive maintenance systems coupled to safety, automated quality inspection validating product compliance, control-command systems with AI components
- Obligations: full technical documentation, risk management, human oversight, data quality, transparency, traceability
Limited Risk (TRANSPARENCY OBLIGATIONS)
- Chatbots, content generation systems
- In industry: internal conversational agents, automated report generation
- Obligations: inform the user that they are interacting with an AI
Minimal Risk (NO OBLIGATIONS)
- Spam filters, basic recommendation engines
- In industry: sorting algorithms, simple classification systems
- Obligations: no specific requirements
Compliance Methodology in 5 Steps
- Inventory all AI systems deployed in your company. Who uses them? For what purpose? With what data?
- Classify each system according to the AI Act risk grid (unacceptable / high / limited / minimal)
- Document high-risk systems: technical notice, conformity assessment, human oversight measures
- Trace training and operational data — quality and governance requirements
- Supervise: implement continuous human oversight, an incident register, and an update procedure
To anchor these 5 steps in a recognised, auditable framework, ISO 42001 certification provides the matching management system: formalised roles, a systems inventory, 38 AI-specific controls and annual surveillance audits.
The same audit logic — inventory, qualify, prove, trace — applies to environmental claims: the Green Claims directive prohibits any claim without traced evidence from 27 September 2026.
The Blind Spot of Industry: Governance of Autonomous AI Agents
Most AI Act guides focus on general-purpose models (chatbots, image generation). But the real challenge for industry lies elsewhere: the governance of autonomous AI agents — systems that make production decisions without human intervention.
In a factory, an AI agent adjusting line parameters in real time is classified "high risk". It must be documented, supervised, and its decisions must be traceable and explainable. This is a level of rigour that traditional industrial systems (APIs, scripts, supervisors) have never had to satisfy.
This is precisely the layer that Taranis AI automates: agent mapping, regulatory classification, audit trails, and AI Act-compliant documentation. And to turn that mapping into a certifiable management system, ISO 42001 provides the reference framework: documented governance, per-system risk assessment and defensible audit evidence.
Comparison: Manual vs Automated Compliance
| Approach | Time for 10 AI Systems | Error Risk | Continuous Maintenance |
|---|---|---|---|
| Manual (consultant) | 4-8 weeks | 5-10% | Annual audit (expensive) |
| Internal (no tool) | 8-12 weeks | 10-15% | Time-consuming, rarely up to date |
| Automated (Taranis AI) | 1-2 weeks | <1% | Real-time continuous tracking |
Indicative orders of magnitude from Taranis AI project experience — results vary by scope.
The 3 Pitfalls for Industrial SMEs
Pitfall #1 — Thinking it does not concern you. The AI Act applies as soon as an AI system is used, regardless of company size. A predictive maintenance algorithm purchased from a vendor makes you a "deployer" with obligations.
Pitfall #2 — Confusing GDPR and AI Act. The GDPR protects personal data; the AI Act governs AI systems. A company compliant with GDPR is not automatically compliant with the AI Act. The two regulations are cumulative.
Pitfall #3 — Underestimating penalties. Fines can reach 7% of global annual turnover for the most serious violations — a deterrent level exceeding the GDPR (4%).
FAQ — AI Act and Industry
Does the AI Act concern industrial SMEs? Yes, with no minimum threshold. As soon as an AI system is deployed, the company is subject to transparency obligations (limited risk) or full compliance (high risk).
What is the difference between AI Act and GDPR? The GDPR governs personal data (consent, right of access, portability). The AI Act governs AI systems (risk classification, algorithmic transparency, human oversight). Both are cumulative: an AI system processing personal data is subject to both.
Which industrial systems are classified "high risk"? Control-command systems with AI components, safety-coupled predictive maintenance, automated quality inspection validating product compliance. If an AI system failure could cause harm, it is likely high risk.
What are the AI Act penalties? Up to 7% of global annual turnover for prohibited practices, up to 3% for non-compliance with high-risk system obligations, up to 1.5% for providing inaccurate information.
Do I need a DPO for the AI Act? The AI Act does not mandate a Data Protection Officer for all companies, but it requires documented governance. For industrial SMEs with high-risk systems, designating an AI compliance officer is strongly recommended.
Conclusion: Start by Mapping Your AI Usage
The transparency obligations have applied since 2 August 2026; the high-risk obligations arrive on 2 December 2027. The postponement granted by the Digital Omnibus is a preparation window — not an exemption. The urgency is not to document everything overnight, it is to know what you have. How many AI systems are deployed in your company? Who uses them? For what purpose?
Mapping is the first step — it requires no heavy tooling, just a method. Once your inventory is complete, you can prioritise: high-risk systems first, limited-risk systems second. Automating documentation and regulatory tracking transforms a multi-month project into a continuous process managed by your tools — as detailed on our Automated Regulatory Compliance page, with our sector guides on CSRD reporting, PPWR, battery passport and automotive CSRD compliance.
👉 Diagnose your AI Act compliance — Map your AI systems and receive an action plan within 48 hours.
Article updated 18 September 2026 — Incorporates the postponement of high-risk obligations by the Digital Omnibus (in force since 27 July 2026) and the Art. 50 transparency obligations (2 August 2026). Regulation EU 2024/1689.