October 26, 2026
Our hypothesis for the industrial market is as simple as it is uncomfortable for production managers. When artificial intelligence in factories is discussed, attention instinctively turns to legislative calendars, EU compliance guidelines, and annexes that seem to set a regulatory framework that still lies ahead. Our estimate is that, for a manufacturer, the pressure may come not from a national authority that will carry out inspections in a few years, but directly from the supply chain, in the form of supplier qualification questionnaires sent by large customers before the legal obligations become enforceable.
The mechanism by which this requirement travels down the supply chain takes different legal forms depending on how the final product is classified. Under Article 25(4) of Regulation (EU) 2024/1689, the provider of a high-risk AI system and the third party that supplies an AI system, an AI model, tools, services, components, or processes used or integrated in that system are legally required to specify, by written agreement, the necessary information, capabilities, technical access, and assistance, based on the generally acknowledged state of the art, so that the provider can fully comply with the obligations of the Regulation. The obligation does not apply to third parties that make tools, services, processes, or components available to the public under a free and open-source licence. General-purpose AI models are, however, treated differently: even when they are made available under an open-source licence, they remain subject to the obligation. The AI Office may develop and recommend voluntary model contract terms for contracts between providers of high-risk systems and third parties. Breaching this obligation may lead to fines of up to EUR 15,000,000 or 3% of total worldwide annual turnover (whichever is higher), under Article 99(4)(da); for SMEs, the lower of the two amounts applies (Article 99(6)).
The provision creates a legal obligation for both parties: the provider of the stand-alone systems in Annex III or of the products regulated under Section A (such as medical devices), and the third party that supplies it with components or processes. It applies from December 2, 2027 for Annex III, and from August 2, 2028 for products in Annex I Section A. For these customers, requesting technical documentation from sub-assembly suppliers is the practical way to meet the obligation to specify in a written agreement the necessary information and access. The text does not define the notion of "components". In our interpretation, a supplier of purely mechanical parts, with no AI component, is not naturally covered, while hardware that feeds the AI system (sensors, actuators) is an ambiguous case. By contrast, for customers in Section B (manufacturers of industrial machinery or of vehicles and vehicle components), where Article 2(2) excludes the direct application of Article 25, the supply-chain requirement does not derive from Article 25 of the AI Act but, to the extent it will exist, from their sectoral safety legislation (the Machinery Regulation or the General Safety Regulation for vehicles). The manufacturer is responsible for the conformity of the entire product, which may lead it to ask suppliers for information.
We expect large industrial integrators to ask component suppliers for information on data origin, robustness testing, and traceability, because they answer for the final product. This is our estimate, since at this date we have not found published Commission guidelines on Article 25 (the Commission is preparing a guideline on responsibilities along the value chain) or any model contract terms published by the AI Office, so the form of these requests is not yet standardized. A supplier from Romania that cannot provide such information could face difficulties at the qualification stage.
The stakes of general legal requalification are clarified by Article 25 as well, in paragraph (1). A distributor, an importer, a deployer, or any other third party legally becomes the provider of a high-risk AI system in three explicit situations: it puts its name or trademark on a high-risk AI system already placed on the market (without prejudice to contractual arrangements that allocate the obligations otherwise), it makes a substantial modification to a system so that it remains a high-risk system, or it modifies the intended purpose of a system that was not classified as high-risk in such a way that it becomes a high-risk system.
The route by which these obligations actually reach a manufacturer depends directly on how its product is classified in Annex I. While paragraph (3) of Article 25 establishes that the manufacturer of the final product is considered the provider of the embedded AI system for products in Section A, such as medical devices governed by Regulation (EU) 2017/745, where the system is placed on the market together with the product under the manufacturer's name or trademark or is put into service under its name or trademark after the product has been placed on the market, the situation is different for manufacturers of machinery and vehicles, which sit in Section B.
For machinery governed by Regulation (EU) 2023/1230 (Section B, point 21, added by Regulation (EU) 2026/1744) and for vehicles and their components covered by Regulation (EU) 2019/2144 on the general safety of vehicles (Section B, point 19), the operation of the law is mediated by Article 2(2). Under it, for high-risk systems in Section B only Article 6(1), Article 60a, and Articles 102–112 apply directly, and the substantive requirements are to be integrated into the specific sectoral legislation through delegated or implementing acts. For machinery, Regulation (EU) 2023/1230 provides that the delegated acts on AI systems apply from August 2, 2028. The manufacturer of industrial machinery will not apply two parallel conformity systems, but will integrate the algorithmic safety requirements into the conformity assessment procedure for its equipment.
Determining high risk requires applying the dual test in Article 6(1). An AI system is classified as high-risk only if it meets two cumulative conditions: it functions as a safety component of a product covered by the legislation in Annex I (or is itself such a product), and the product is subject to a conformity assessment carried out by a third party, a notified body, with a view to placing it on the market. An automated module integrated into a machine for which the manufacturer can use self-certification does not pass this threshold and does not fall into the high-risk category. Regulation (EU) 2023/1230 does, however, require third-party assessment for safety components and for integrated systems with self-evolving behaviour based on machine learning that ensure safety functions (Annex I, Part A, points 5 and 6), and self-certification is permitted for the categories in Part B only if the product was designed in accordance with harmonised standards or common specifications. The test strictly limits applicability to safety-critical components assessed by third parties.
The structure of Annex I divides products into two conformity regimes. On the one hand, for products in Section A, such as medical devices, Article 43(3) provides that the assessment of the AI requirements is part of the conformity assessment procedure under the sectoral legislation (MDR) and that the quality management system under Article 17 is also assessed. The sectoral notified body may also assess the AI requirements if it meets the conditions in Article 31 and applies for designation by January 28, 2028. On the other hand, for manufacturers of machinery and vehicles in Section B, the AI safety requirements are to be integrated through the Machinery Regulation 2023/1230 or Regulation 2019/2144. The Digital Omnibus package (Regulation (EU) 2026/1744) set the application of the requirements in Chapter III, Sections 1–3, from August 2, 2028 for the systems in Annex I (Article 6(1)) and from December 2, 2027 for the stand-alone systems in Annex III (Article 113, third paragraph, point (c)). For Section B there is no direct application of these requirements.
In parallel with the high-risk calendars, the general transparency requirements under Article 50 became applicable on August 2, 2026. They require informing people who interact with an automated system and labelling synthetically generated content. The amendments made by Regulation (EU) 2026/1744 granted only a technical extension, until December 2, 2026, for the machine-readable marking requirement in Article 50(2), which applies to systems placed on the market earlier. The obligations depend on role and situation: providers of generative systems must mark the generated content (paragraph (2)), providers of systems intended to interact directly with people must ensure that those people are informed (paragraph (1)), and deployers must disclose deepfakes and texts published to inform the public on matters of public interest (paragraph (4)). Based on the Commission guidelines on the transparency of AI-generated content (C(2026) 5054, July 20, 2026), the internal use of a third-party generative model for technical documentation does not appear to fall under these obligations; if the company develops or modifies the system internally, it becomes a provider.
In our opinion, waiting for the 2027 or 2028 deadlines is a commercial strategy mistake. Whether the requirement reaches the chain as a legal obligation under Article 25(4) or through the manufacturer's responsibility under sectoral legislation, it is to be expected, and fair, that many European industrial customers will ask for traceability information before signing a contract. Completing a Readiness Audit and, for providers of high-risk AI systems, aligning the Quality Management System with the harmonised standard EN 18286 provides a technical reference point for such requirements; a component supplier can adopt it as a voluntary reference. In this way, compliance can turn from a future obligation into an instrument of market qualification.