EU AI Act Compliance for US Manufacturers: What the 2027 and 2028 Deadlines Demand
The Digital Omnibus moved the EU AI Act's high-risk deadlines to December 2027 and August 2028. Here is how US manufacturers can tell whether plant AI is in scope, what high-risk really covers, and how to use the extra time.
Many US manufacturers first heard about the EU AI Act as a 2 August 2026 deadline for high-risk AI. That date has changed. In July 2026 the EU published the Digital Omnibus on AI, which sets the application date for the main high-risk requirements at 2 December 2027 for systems that are high-risk under Annex III, and 2 August 2028 for systems that are high-risk because they are safety components of products covered by Annex I [1].
The extra time is useful, but the questions a plant needs to answer have not changed: is this AI system in scope at all, is it high-risk, and who in the organization owns the answer? This article gives a practical way to work through those questions for maintenance, quality, and operations AI.
What changed in 2026
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026 [1]. For manufacturers, the key change is the new timing for Chapter III, Sections 1 to 3, the core high-risk requirements:
| High-risk route | What it covers | Applies from |
|---|---|---|
| Article 6(2) and Annex III | Stand-alone systems in listed use cases, such as worker management and critical infrastructure safety components | 2 December 2027 [1] |
| Article 6(1) and Annex I | AI that is a safety component of a product covered by EU product legislation and needing third-party conformity assessment | 2 August 2028 [1] |
Other parts of the Act keep their own timelines, and the Omnibus also adjusted some transparency transition periods [1]. Treat the high-risk delay as more time to prepare, not as a reason to stop.
Does the Act reach a US manufacturer?
The scope article is broader than many teams expect. The Act applies to providers placing AI systems on the market in the EU irrespective of where they are established, and to providers and deployers located in a third country where the output produced by the AI system is used in the Union [2].
For a plant, three practical triggers follow:
| Situation | Why it may be in scope | First question to answer |
|---|---|---|
| You sell an AI-enabled product or software into the EU | You may be a provider placing a system on the EU market [2] | Is the AI part of the product, and is it a safety component? |
| Your EU sites or customers use your AI system's output | Output used in the Union can bring third-country providers and deployers in [2] | Who uses the output, and for what decision? |
| You run AI internally in the US only | Usually outside scope unless the output is used in the EU | Does any output, report, or decision flow to EU operations? |
Get legal advice on edge cases. The goal for the plant team is to know, system by system, which of these situations applies.
Is predictive maintenance high-risk?
Not automatically. An AI system is high-risk in one of two ways [3]:
1. Safety component of a regulated product (Article 6(1)). The AI is intended to be used as a safety component of a product covered by the EU harmonisation legislation listed in Annex I, and that product must undergo third-party conformity assessment. Both conditions must be met. 2. Listed use case (Article 6(2) and Annex III). The AI falls into one of the Annex III areas.
Two Annex III areas matter most in manufacturing. Point 2 covers AI used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating, or electricity [4]. Point 4 covers employment and worker management, including AI used to allocate tasks based on individual behaviour or traits, or to monitor and evaluate the performance and behaviour of workers [4].
For most plants, that gives a practical sorting:
| Plant AI system | Likely starting classification | Why |
|---|---|---|
| Predictive maintenance that recommends work orders | Usually not high-risk | Not a listed use case and not a product safety component, unless it controls a safety function |
| AI embedded in machinery you sell, acting as a safety component | Possibly high-risk via Article 6(1) | Depends on the product legislation and conformity assessment route |
| AI for utilities you operate as critical infrastructure | Possibly high-risk via Annex III point 2 | Only if used as a safety component in that supply |
| AI that scores technician performance or assigns work by personal traits | Possibly high-risk via Annex III point 4 | Worker monitoring and evaluation is a listed use case |
| Vision inspection of products | Usually not high-risk on its own | Unless it is a safety component of a regulated product |
Article 6(3) also allows an Annex III system not to be treated as high-risk where it does not pose a significant risk, for example when it performs a narrow procedural task, though systems that profile individuals are always high-risk [3]. Document the reasoning whichever way you decide.
The penalties, stated correctly
The headline figure is often misquoted. The highest fines, up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher, apply to the prohibited practices in Article 5 [5]. Non-compliance with most other obligations, including those for providers of high-risk systems, carries fines of up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher [5]. For SMEs, each fine is capped at the lower of the amount or the percentage [5].
Key Statistics
2 Dec 2027 [1]
New application date for Annex III high-risk requirements under the Digital Omnibus
2 Aug 2028 [1]
New application date for high-risk AI that is a safety component of Annex I products
EUR 15M or 3% [5]
Maximum fine for most operator obligations, including high-risk provider duties
EUR 35M or 7% [5]
Maximum fine reserved for prohibited AI practices under Article 5
What regulators will expect from high-risk systems
If a system is high-risk, the provider obligations in Chapter III apply: a risk management system, data governance, technical documentation, automatic logging, transparency and instructions for use, human oversight, and accuracy, robustness, and cybersecurity, backed by a quality management system. Deployers have their own duties, including using the system according to its instructions and assigning human oversight.
Much of this maps to work a mature reliability organization already does:
| AI Act concept | Existing plant practice to build on |
|---|---|
| Risk management | FMEA and risk registers |
| Data governance | CMMS data quality rules, failure code standards, sensor calibration records |
| Logging and traceability | Work order history, alarm logs, historian records linked to recommendations |
| Human oversight | Planner approval of AI-drafted work orders, the ability to override or stop |
| Quality management | Existing ISO 9001 or asset management systems |
The NIST AI Risk Management Framework is a useful companion for US teams: it is intended for voluntary use to help organizations incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems [6].
Check the AI that evaluates people first
Maintenance analytics that rank technicians, track response times by person, or assign work based on individual behaviour can fall under Annex III point 4. Review those features before the equipment-focused systems, because they are the most likely to be high-risk.
A five-step inventory
1. List every AI system in maintenance, quality, operations, and HR, including AI features inside vendor software. 2. Map where outputs go. Note any output used by EU sites, customers, or products. 3. Classify each system against Article 6(1), Annex III, and the Article 6(3) exceptions, and record the reasoning. 4. Identify your role for each in-scope system: provider, deployer, importer, or distributor. 5. Gap-assess high-risk systems against the Chapter III requirements and plan the work to the 2027 or 2028 date that applies.
For plant AI governance more broadly, including tools staff use without approval, see our article on the shadow AI governance gap, and our trust scorecard for AI maintenance recommendations.
Use the extra time well
A realistic plan for the next year:
- Quarter 1: inventory, output mapping, and a documented classification for every system.
- Quarter 2: for anything high-risk, a gap assessment and an owner per requirement; for everything else, a short record of why it is not high-risk.
- Quarter 3: build the logging, oversight, and documentation that are missing, using existing CMMS and quality records wherever possible.
- Quarter 4: a dry-run review, with legal, of the technical documentation for each high-risk system.
Frequently asked questions
Does the EU AI Act apply if my AI model only runs in the US?
It can. The Act reaches providers and deployers in third countries where the output produced by the AI system is used in the Union [2]. Where the model runs does not settle the question.
Is predictive maintenance always high-risk?
No. It is high-risk only if it is a safety component of a product covered by Annex I that requires third-party conformity assessment, or if it falls into an Annex III use case [3][4].
When do the high-risk requirements apply now?
From 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product safety components, under Regulation (EU) 2026/1744 [1].
What are the maximum fines?
Up to EUR 35 million or 7% of turnover for prohibited practices, and up to EUR 15 million or 3% for most other obligations, whichever is higher, with lower caps for SMEs [5].
Do we need a representative in the EU?
Non-EU providers of high-risk systems placed on the EU market generally need an authorized representative established in the Union. Confirm your role and obligations with counsel.
References
[1] EUR-Lex, "Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI)," Official Journal L, 24 July 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32026R1744
[2] EU Artificial Intelligence Act (unofficial consolidated text, Future of Life Institute), "Article 2: Scope." https://artificialintelligenceact.eu/article/2/
[3] EU Artificial Intelligence Act (unofficial consolidated text, Future of Life Institute), "Article 6: Classification Rules for High-Risk AI Systems." https://artificialintelligenceact.eu/article/6/
[4] EU Artificial Intelligence Act (unofficial consolidated text, Future of Life Institute), "Annex III: High-Risk AI Systems Referred to in Article 6(2)." https://artificialintelligenceact.eu/annex/3/
[5] EU Artificial Intelligence Act (unofficial consolidated text, Future of Life Institute), "Article 99: Penalties." https://artificialintelligenceact.eu/article/99/
[6] NIST, "AI Risk Management Framework." https://www.nist.gov/itl/ai-risk-management-framework
Related articles
Ready to put this into practice?
See how Monitory helps manufacturing teams implement these strategies.