The EU AI Act for machine builders: what actually applies, and when

Most writing about the EU AI Act is horizontal: written for HR departments, banks and public authorities. For machine building that reliably produces one of two wrong conclusions — "all of it applies to us" or "none of it does". Neither is right. For an industrial equipment manufacturer the honest answer is: one duty has applied since February 2025, most product duties bite in 2028 at the earliest, and the most important change of 2026 went almost uncommented — for machinery, the requirements are moving into the Machinery Regulation.

What already applies today: AI literacy (Art. 4)

Article 4 has applied since 2 February 2025 and was not deferred by the Digital Omnibus. It requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among the people who operate and use those systems — proportionate to their technical knowledge, experience, education and to the context of use.

Two things are usually missed. First, it bites you as a deployer: an organisation using AI professionally is covered, regardless of whether any product is high-risk. So it applies now, while the product duties are still years away. Second, the Act prescribes no curriculum, no exam and no certificate. "AI literacy" is a duty to take appropriate measures, not to hold a document. You evidence it with a policy, role-appropriate training, and records.

Is your AI even "high-risk"? Usually not

Here is the honest answer a consulting pitch rarely gives you: most AI in machine building is not high-risk. "High-risk" under Art. 6(1) requires a combination — the AI system must be a safety component of a product covered by the Machinery Regulation (or be that product itself), and that product must be subject to third-party conformity assessment under Annex I Part A of the Machinery Regulation.

If either condition is missing, the system is not high-risk by that route:

• Predictive maintenance forecasting downtime — no safety function, so as a rule not high-risk.
• Vision-based quality inspection rejecting scrap without triggering a protective function — likewise, as a rule not.
• Process optimisation, energy control, parameter suggestions — the same.
• An AI that triggers or supervises a protective function, in a machine subject to third-party assessment — that is the case that becomes high-risk.

So the distinction is not how advanced the model is, but what job it does in the machine and which assessment route that machine takes.

How to document a defensible "no"

Concluding that a system is not high-risk is one half. The other is being able to show it later — to a customer in a supplier audit, to a notified body, or to a market-surveillance authority. For each AI use, record what the system does, whether it performs a safety function, which conformity-assessment route the machine takes, who assessed that, and when. It is little effort while you are building; it is painful to reconstruct two years afterwards.

The deadlines — after the Digital Omnibus

The dates for high-risk systems moved in 2026. The governing act is Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026 (the Digital Omnibus on AI). It amends Art. 113 of the AI Act:

• 2 December 2027 — for standalone high-risk systems under Art. 6(2) and Annex III.
• 2 August 2028 — for product-embedded high-risk systems under Annex I, which is the route that covers machinery.

For machine builders, then, 2 August 2028 is the date that matters — not 2 August 2026, which still appears in a good deal of older writing.

The part almost nobody mentions: the requirements move into the Machinery Regulation

The same Digital Omnibus amends Machinery Regulation (EU) 2023/1230 in its Article 3 — structurally the most important news of the year for this industry. The Commission gains the power to adopt delegated acts adding health and safety requirements for high-risk AI to Annex III of the Machinery Regulation. Those requirements are to reflect the relevant provisions of Chapter III, Section 2 and Articles 17, 19, 72 and 73 of the AI Act, and they are to apply by 2 August 2028.

In practice: for machinery the substance does not disappear, it relocates. Chapter III Section 2 is precisely where Article 15 — accuracy, robustness, cybersecurity — sits. Work already done to prepare for the AI Act is not wasted; the proof will simply run through the Machinery Regulation rather than directly through the AI Act.

A bridge was added to Art. 20 of the Machinery Regulation as well: until dedicated harmonised standards for high-risk AI exist under the Machinery Regulation, compliance with the relevant harmonised standards or common specifications of the AI Act is presumed to satisfy the corresponding Annex III requirements. Reuse of evidence across the two regimes is no longer merely convenient — it is written into the legal text.

One limit belongs with this, and we hold to it: the delegated acts have not been adopted. Nobody knows today what Annex III will specifically say. What can responsibly be stated is the mechanism and the deadline — not the content.

Do the work once, prove it twice — with one precision

There is an explicit reuse between the CRA and the AI Act. Under Art. 12(1) of the Cyber Resilience Act, products with digital elements that are also high-risk AI systems are deemed to comply with the cybersecurity requirements of AI Act Art. 15 — where three conditions hold together: the products meet the essential cybersecurity requirements of Annex I Part I, the manufacturer’s processes meet Annex I Part II, and the level of protection achieved is demonstrated in the EU declaration of conformity issued under the CRA.

Two precisions routinely lost in marketing copy. First, the deeming expressly covers only Art. 15’s cybersecurity requirements — accuracy and robustness are excluded ("without prejudice"). Second, holding CRA evidence is not enough: it takes the declaration of conformity that demonstrates the protection level. So "the CRA takes care of the AI Act" is false. What is true: the cybersecurity work is done once and counts in both places.

What to do now

• Organise AI literacy under Art. 4 — the only duty already running, and it reaches you as a deployer.
• Keep a register of your AI uses, and record the classification with its reasoning for each — a documented "not high-risk" is worth as much as a "high-risk".
• Aim your cybersecurity work at the CRA — it is the part that also counts toward the AI Act via Art. 12, and its deadline is nearer.
• Watch the delegated acts to the Machinery Regulation; they decide what Annex III actually contains by 2 August 2028.

A note in passing, because it is reliably asked: the AI Act’s transparency duties for systems that interact directly with people or generate content rarely touch the machine control itself — they are more likely to touch a support chatbot or an assistant inside your software. Assess that separately from the product.

This article is explanatory and not legal advice, and Resilic does not certify compliance. If you want a quick, honest starting point: the free CRA scope check shows you in a few questions which deadlines apply to you — beginning with the nearest one, Article 14 readiness.