What are the dates?
- 27 July 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026, entered into force on the third day after publication. It moved the high-risk dates below and amended the Machinery Regulation.
- 14 October 2026. Implementing Decision (EU) 2026/2274 published EN 18286:2026, the first harmonised standard under the AI Act (Nemko), a quality management system for providers of high-risk AI.
- 20 January 2027. Regulation (EU) 2023/1230 on machinery applies. The printed text said 14 January 2027. The corrigendum in OJ L 169 of 4 July 2023 corrected it to 20 January 2027.
- 2 December 2027. Chapter III, Sections 1 to 3 of the AI Act apply to AI systems that are high-risk under Article 6(2) and Annex III, as amended by Regulation (EU) 2026/1744.
- 2 August 2028. The same obligations apply to AI systems that are high-risk under Article 6(1) and Annex I. Delegated acts adding AI requirements to the Machinery Regulation are to apply by the same date.
What is high-risk under the EU AI Act for an operator?
Two routes make an AI system high-risk. Under Article 6(2), it is listed in Annex III, which includes safety components in critical infrastructure. Under Article 6(1), it is a safety component of a product covered by the legislation in Annex I, where that product needs third-party conformity assessment. The deployer duties in Article 26 then apply to the operator that uses it (AI Act).
Is AI in a refinery, chemical plant or gas network high-risk critical infrastructure under the AI Act?
Annex III point 2 lists AI systems intended to be used “as safety components in the management and operation of critical digital infrastructure, road traffic, or in the supply of water, gas, heating or electricity”. It does not name refineries or chemical plants. Gas networks and power supply are in scope through this point.
A refinery or chemical site can still meet the AI Act through Article 6(1). That route covers AI that is a safety component of a product under the legislation in Annex I, where that product needs third-party conformity assessment. Section A of Annex I includes pressure equipment (Directive 2014/68/EU) and equipment for explosive atmospheres (Directive 2014/34/EU). The Digital Omnibus moved the Machinery Regulation to Section B, so AI in machinery will be governed through requirements added to the Machinery Regulation itself. Whether a given system qualifies is a classification question for the provider and your counsel.
What should change in the SMS before 20 January 2027?
Under Article 18 of the Machinery Regulation, whoever carries out a substantial modification is treated as the manufacturer. The definition covers modification “by physical or digital means”. An AI function added to a machine by the site can therefore make the operator a manufacturer.
- Add a screening question to the MOC form. Does this change alter a machine’s safety function by digital means?
- Put the Machinery Regulation into purchase specifications for machinery delivered from 20 January 2027.
- Treat safety components with self-evolving, machine learning behaviour as needing third-party conformity assessment, as recital 55 of the Machinery Regulation sets out.
What should change before 2 December 2027?
For an operator using a high-risk system as a deployer, Article 26 maps onto elements the SMS already has.
- Operating procedures. Use the system according to the provider’s instructions for use.
- Roles and competence. Assign human oversight to people with “the necessary competence, training and authority”. See operator competence.
- Management of change. Where the site controls input data, keep it relevant and sufficiently representative. See AI management of change.
- Incident reporting. Monitor operation, suspend the system where it presents a risk, and report a serious incident to the provider and the market surveillance authority. See after an AI-related incident.
- Records. Keep automatically generated logs for at least six months.
- Consultation. Inform workers’ representatives and affected workers before use at the workplace.
What should change before 2 August 2028?
For AI inside Annex I products and machinery, procurement carries most of the change. Ask each provider how its system is classified, which conformity route it follows and whether its quality management system follows EN 18286. The standard applies to providers, but its outputs, such as post-market monitoring, feed the operator’s own monitoring and MOC.
An autonomous operations briefing maps these dates against your own systems. The element-by-element view is in AI in process safety management.
Questions
Is AI in a gas network high-risk under the EU AI Act?
It can be. Annex III point 2 lists AI systems intended as safety components in the supply of gas, heating, water or electricity, so a safety component in a gas network is in principle high-risk, with obligations applying from 2 December 2027. Refineries and chemical plants are not named in Annex III; AI there can come in through Annex I product legislation, from 2 August 2028.