The manufacturing AI rulebook: what actually applies to your plant

2. Machinery safety law: the EU Machinery Regulation (EU) 2023/1230, replacing the old Machinery Directive, effective January 2027, which governs physical safety of machines including those with AI-driven "safety functions."

3. Sector and technical standards, like ISO 10218 (industrial robot safety) and ISO/TS 15066 (collaborative robots), which are not laws themselves but are the technical benchmark regulators and courts point to when deciding if you met a legal "state of the art" duty.

In the US, there is no direct equivalent to the AI Act yet. Manufacturers there answer mainly to OSHA (Occupational Safety and Health Administration) general duty clauses, product liability law, and voluntary NIST AI Risk Management Framework guidance. If you export to the EU, though, EU rules follow the product, not just the factory location.

Where the EU AI Act actually bites in manufacturing

The AI Act sorts systems into four tiers: prohibited, high-risk, limited-risk (transparency duties), and minimal-risk. Most plant AI lands in the last bucket. The trap is the high-risk category, defined mainly by Annex III of the Act.

For manufacturing, two Annex III triggers matter most:

• AI used as a safety component of a product already covered by EU product safety law, including machinery. If your AI decides when a robot arm stops, slows, or changes path to avoid injuring a worker, that is a safety component. High-risk.
• AI used in worker management: systems that make or materially influence decisions on hiring, task allocation, performance monitoring, or termination. A shift-scheduling AI that also scores workers for layoffs qualifies.

What does *not* automatically qualify: predictive maintenance models forecasting bearing failure, quality-inspection vision systems flagging defects for human review, and demand-forecasting AI for production planning. These affect cost and quality, not physical safety or employment decisions directly, so they usually sit outside Annex III, though transparency duties may still apply if the system interacts with people (Article 50).

Worked example. A stamping press uses a vision model to detect hand intrusion and stop the press. That is a safety component of machinery: high-risk under the AI Act, and it must also satisfy Machinery Regulation essential health and safety requirements, likely demonstrated via conformity with ISO 13849 (safety-related control systems) or ISO 10218 for robotic cells. Two regulatory regimes, one system.

Compare: a vision model on the same line that photographs finished parts and scores paint-finish quality for a rework queue. No safety function, no worker-management scoring. Minimal-risk under the AI Act, though you should still document it for internal quality assurance and customer audits.

The machinery safety overlap: don't double-count, don't skip

The EU Machinery Regulation lists "safety functions" that, when performed partly or wholly by AI, force a third-party conformity assessment rather than manufacturer self-certification. This is the sharpest teeth in the whole stack for factory-floor robotics.

ISO 10218 (parts 1 and 2, industrial robots and robot systems) and ISO/TS 15066 (collaborative robot force and speed limits) are the reference standards insurers, auditors, and notified bodies use to judge whether your robotic cell meets the "state of the art." Following them does not exempt you from the AI Act, but it is strong evidence of compliance for the machinery side and generally accelerates a high-risk AI Act conformity assessment because your technical file already exists.

Practical rule of thumb for a plant engineer:

• AI touches motion, force, or stopping behavior near humans → machinery safety regime applies, likely + AI Act high-risk.
• AI touches inspection, forecasting, scheduling, logistics, without controlling physical hazard → usually AI Act minimal or limited-risk only.
• AI touches HR decisions about specific workers → AI Act high-risk regardless of physical safety.

A simple triage snippet

Teams can encode this logic into an intake checklist before any AI project starts. A simplified version:

This will not replace legal review, but it stops 80% of low-risk quality-control and forecasting projects from being routed through an expensive compliance process they don't need, and flags the 20% that genuinely do.

What high-risk classification actually costs you

If a system lands in Annex III high-risk, the AI Act obligations (mostly binding from August 2026) include:

• A risk management system maintained across the AI system's lifecycle
• Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète →: training data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.Voir la définition complète →, bias checks, relevant especially for vision-based defect detection trained on historic (possibly biased) reject samples
• Technical documentation and automatic logging (traceability of decisions)
• Human oversight design: a person must be able to intervene or override
• Conformity assessment and CE marking before market placement
• Post-market monitoring and incident reporting to national authorities

This is real engineering and paperwork overhead, not a checkbox. A mid-size automotive supplier deploying AI-controlled robotic welding cells across multiple lines should budget for a dedicated compliance owner, not a side task for the safety engineer.

For low-risk systems (most predictive maintenance and demand planning tools), the practical governance need is lighter: document intended use, monitor for model drift, keep a human-in-the-loop for high-cost decisions, and retain training data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète → in case you later need to prove non-bias or explain an error.

Cross-checking with real regulators, not just the text

Two useful anchors as you build internal policy:

• The European Commission's AI Act page tracks phased implementation dates and guidance documents as they are published.
• NIST's AI Risk Management Framework (US, voluntary but widely adopted) offers a practical structure for the risk-mapping step even if you are EU-only, because auditors and insurers increasingly expect to see one.

Key Takeaways

• Manufacturing AI is governed by at least three stacked regimes: the EU AI Act (risk-tiered), EU Machinery Regulation (physical safety), and technical standards like ISO 10218/15066 (the evidentiary bar for "state of the art").
• The real trigger for high-risk status is not "AI in a factory," it is AI controlling physical hazards near humans, or AI making employment decisions about specific workers.
• Most inspection, forecasting, and scheduling AI stays in the minimal or limited-risk tier, needing lighter governance (documentation, drift monitoring, human oversight for costly calls).
• Following ISO 10218/15066 for robotic cells builds the technical file that also supports AI Act conformity assessment: compliance work is not duplicated if planned jointly.
• Build a simple triage step (like the classifier above) into project intake so legal and compliance resources go to the 20% of projects that carry real regulatory exposure, not all of them.