Autonomous Agents in Manufacturing, Part 2: Three Industrial Routes and the Documents You Need

October 27, 2026

The first part of this analysis clarified the regulatory framework, and our view is that compliance pressure comes mostly through the commercial chain, from the large integrator to the manufacturer of sub-assemblies.

Supplier assessment forms do not yet seem to be standardized, or at least we have not identified a single public model for AI. Likewise, a contractual requirement must not be confused with a direct legal obligation.

For a production or operations director, the question is simple: what do I do when a customer asks me for proof of control over the IT and algorithmic systems I use?

The answer depends on where your product sits in the value chain. Instead of a single recipe, here is the path that applies to each of the three industrial situations.

Route 1: Manufacturer of machinery and equipment (Section B)

• Legal status: You fall under the Machinery Regulation (EU) 2023/1230 (Annex I, Section B, point 21 of the AI Act). Note: other industrial equipment, for example lifts, ATEX equipment, or pressure equipment, is in Section A.
• What the law requires: If the AI module is a safety function, the Machinery Regulation already requires, through Annex III point 1.2.1, specific controls for self-evolving behaviour, and these are demonstrated in the technical file (Annex IV, Part A). Assessment by a notified body is mandatory for safety components and for systems with self-evolving machine learning in Annex I, Part A, points 5 and 6. The Regulation applies from January 20, 2027, and the requirements that reflect the AI Act are to be added through subsequent acts that apply from August 2, 2028. Chapter III of the AI Act does not apply directly: under Article 2(2), only Article 6(1), Article 60a, and Articles 102–112 apply.
• What the customer asks for: The integrator may ask you for the EU declaration of conformity, the relevant technical file and, where the procedure provides for it, the EU type-examination certificate issued by the notified body. The CE marking on the final machine is affixed by its manufacturer.

Route 2: Manufacturer of sub-assemblies, parts, or components

• Legal status: If you supply purely mechanical components or parts that do not integrate AI systems, your delivery does not, as a rule, make you a provider or deployer of an AI system (the status may change if you develop or substantially modify a digital system in your process). Deployer status depends on using an AI system under your authority, not on what you supply. If your part contains an AI module or feeds a customer's AI system, see the first part (Article 25(4)).
• What the law requires: In production, AI can mean, for example, visual inspection of parts, predictive maintenance, production planning, or PLC programming assistants. If you use office applications or internal analytics, the main obligation under the AI Act is AI literacy (Article 4). Article 50 applies in other situations, for example text published to inform the public on matters of public interest, or deepfakes. The prohibitions in Article 5, the GDPR if you process personal data, and contractual obligations remain applicable.
• What the customer asks for: The customer's request does not, as a rule, derive from the AI Act for a supplier of components without AI. It is a contractual and commercial requirement, driven by the customer's responsibility for the final product and by its sectoral legislation (for example the Machinery Regulation). The customer may ask for guarantees on the confidentiality of your data and a ban on using it to train models; public procurement documents of some European manufacturers already contain clauses of this kind, as well as transparency requirements on AI in delivered products. In our opinion, it is worth being able to show a human validation point for automated processes as well.

Route 3: Manufacturer of medical devices or software with a medical purpose (Section A)

• Legal status: If your product is software with a declared medical purpose (a medical device under Article 2(1) of the MDR), you are in Section A (point 11 of Annex I; point 12 for in vitro diagnostic devices), under the Medical Devices Regulation (EU) 2017/745 (MDR).
• What the law requires: The requirements of Chapter III of the AI Act will apply from August 2, 2028, if the system is high-risk, that is, if the product is subject to assessment by a third party (Article 6(1)); for example, class I software, assessed without a notified body, is not high-risk. Their assessment will be part of the MDR procedure (Article 43(3)), through the notified body if it has also been designated for the AI Act (the application for designation is due by January 28, 2028). As a provider of a high-risk system you will need a quality management system, for which the harmonised standard EN 18286:2026 offers a presumption of conformity for the Article 17 requirements it covers. The system must also cover the MDR requirements (Article 10(9)), and Article 17(3) allows them to be integrated. You also need the Technical Documentation in Annex IV.
• What the customer (hospital or clinical network) asks for: The hospital, as a deployer, will have to demonstrate its own obligations: human oversight assigned to competent persons (Article 26(2)) and retention of logs for at least six months (Article 26(6)). From you, as the provider, it will require that the system allows logging (Article 12) and human oversight (Article 14), together with the instructions for use. These obligations apply from August 2, 2028. Keeping a record of medical staff training is good practice, not a requirement of Article 4.

Example: How to Answer a Supplier Assessment Questionnaire

To understand what the practical translation looks like, here is an illustrative example of questions from a technical qualification questionnaire, built by MAAS (not a real questionnaire), together with a possible answer and the supporting document you can attach.

Question 1 (Data security and intellectual property)

"Does your company use generative artificial intelligence models or external SaaS solutions in design, PLC programming, or order analysis processes? If so, what guarantees are there that our technical data is not used to train third-party models?"

• Operational answer: "The company uses the commercial solution [Software Name] connected through an enterprise API. Under the contractual clause on data (a confidentiality agreement and, if personal data is processed, a data processing agreement under the GDPR), the module operates in an isolated environment, and the third-party provider contractually undertakes not to use our process data to retrain public models."
• Supporting document: The extract from the confidentiality agreement or from the data processing agreement (DPA, for personal data) signed with the software provider (the annex on confidentiality and API security).

Question 2 (Human oversight and operational control)

"Do the automated visual inspection or defect detection systems used on the production line for our parts make autonomous decisions to reject batches without human intervention?"

• Operational answer: "The automated vision system works exclusively as a primary triage tool (decision support). Any decision to reject a production batch is subject to validation by an authorized quality engineer, who has the technical ability to override the algorithm's decision."
• Supporting document: The standard operating procedure (SOP) on quality control, which defines the human operator's role as the final approval point (human-in-the-loop).
• Note: There is no general legal requirement for human validation in quality inspection. Systems used solely for quality control are not safety components (Article 6(1a)), unless their failure would endanger health and safety (paragraph (1b)). The standard operating procedure is good practice.

Question 3 (Records and training)

"Do you keep a record of the AI-based software applications used in the organization and a training plan for the staff who operate them?"

• Operational answer: "The company maintains an internal register of active digital tools, classifying each application by role and risk level. The staff who operate these systems have completed training sessions on safe use and the limits of the technology, in line with the literacy requirements of Article 4 of Regulation (EU) 2024/1689."
• Supporting document: The internal register of software tools (an inventory table with applications, providers, and authorized users) and the employee training minutes.
• Note: The register of AI applications and the training records are good practice, not requirements of Article 4.

What Sets a Prepared Company Apart

In our opinion, commercial readiness in front of large customers does not mean obtaining certifications for everyday applications, but above all being able to show that you have control over your processes.