In this article (8 sections)
- When is AI built into a product high-risk?
- Which AI does the Omnibus exclude from being a safety component?
- AI quality inspection on the production line is not the same as AI built into the product
- How do radio equipment and the Cyber Resilience Act fit together?
- The most common assessment mistakes
- FAQ
- Next in the series
- Legal sources and references
“Our product uses AI. Does that make it high-risk?” This is the AI Act question Taiwanese electronics, equipment and medical device companies ask most often. The answer is usually narrower than expected: AI built into a product only becomes high-risk through the Annex I route if it meets two conditions at the same time. The Digital Omnibus has narrowed one of those conditions further. This article explains how to assess the two conditions, and the difference between “production line AI” and “product AI”, which are often confused.
Key takeaways
- Article 6(1): the AI is a safety component of an Annex I product (or is itself the product), and that product requires third-party conformity assessment under the product legislation. Only when both apply is it high-risk.
- The Omnibus adds Article 6(1a): AI used only for user assistance, performance optimisation, service efficiency, automation, convenience or quality control is not a safety component; but AI whose failure would endanger health and safety still counts (paragraph 1b).
- The Omnibus adds paragraph 1c: products that require third-party assessment only because of risks other than health and safety, such as radio spectrum or electromagnetic interference, do not meet the second condition.
- The high-risk rules for Annex I Section A products apply from 2 August 2028.
When is AI built into a product high-risk?
The two conditions in Article 6(1):
| Condition | Content | Common question when assessing |
|---|---|---|
| (a) Safety component | The AI is a safety component of a product covered by the product legislation listed in Annex I, or is itself such a product | If this AI fails, would it endanger people’s health and safety or property? |
| (b) Third-party assessment | Under the Annex I product legislation, the product must undergo third-party conformity assessment before being placed on the market | Does the assessment module for this product always require a notified body? |
“Safety component” is defined in Article 3(14): a component of a product or AI system that fulfils a safety function, or whose failure or malfunction endangers the health and safety of persons or property.
The product legislation listed in Annex I Section A covers toys, recreational craft, lifts, equipment for potentially explosive atmospheres, radio equipment, pressure equipment, cableway installations, personal protective equipment, gas appliances, medical devices and in vitro diagnostic medical devices. After the Omnibus, machinery moved to Section B; see Part 4.
Which AI does the Omnibus exclude from being a safety component?
The new Article 6(1a) to (1c) have a big impact on manufacturing:
Paragraph 1a: AI for non-safety purposes is not a safety component. AI used only for the following aspects is not a safety component:
- User assistance
- Performance optimisation
- Service efficiency
- Automation
- Convenience
- Quality control
Paragraph 1b: but AI whose failure would endanger health and safety still counts. The exclusion in paragraph 1a has a condition: the failure or malfunction of the AI must not endanger health and safety.
Paragraph 1c: the reason for third-party assessment must relate to health and safety. If a product requires third-party assessment only because of risks other than health and safety, in particular radio spectrum allocation or electromagnetic interference that does not affect health and safety, condition (b) is not met.
Where does your product fall?
- AI only for image enhancement, power saving, voice assistance or recommended settings: mostly the non-safety purposes in paragraph 1a
- AI responsible for fall detection, overheating protection, anti-pinch protection or obstacle avoidance: check paragraph 1b
- The product is radio equipment and goes to a notified body only for spectrum or EMC: check paragraph 1c
Annex I Section A high-risk AI: applies from 2 August 2028.
AI quality inspection on the production line is not the same as AI built into the product
When companies hear “quality control AI”, many first think of AOI defect detection or process parameter optimisation in the factory. This kind of AI is used in the production process; it is not part of the product placed on the EU market, so it is not within the scope of Article 6(1) at all.
| Situation | Article 6(1)? | Other provisions to check |
|---|---|---|
| A Taiwanese factory uses AI for visual inspection | Not applicable (not a product placed on the market) | Usually no AI Act high-risk obligations; if the AI is also used to evaluate operator performance, check point 4 of Annex III |
| Equipment sold in the EU has built-in AI for self-monitoring of quality, and failure does not affect safety | Excluded by paragraph 1a | Article 50 (if there is an interaction interface) |
| Equipment sold in the EU has built-in AI that detects people and triggers a stop | Safety component; then check whether the product legislation requires third-party assessment | Machinery has moved to Section B; see Part 4 |
| The AI software is itself a medical device requiring notified body assessment | May be high-risk | Medical Devices Regulation (EU) 2017/745 |
How do radio equipment and the Cyber Resilience Act fit together?
The Annex I product legislation Taiwanese electronics companies meet most often is the Radio Equipment Directive (RED). Paragraph 1c means that going to a notified body “only for spectrum or EMC” does not meet condition (b), so for most consumer and industrial connected products the scope of the Annex I route is narrower.
In addition, Article 42(3) provides that high-risk AI systems within the scope of the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) that meet the conditions of Article 12(1) of the CRA are presumed to comply with the cybersecurity requirements of AI Act Article 15. For connected products, the same cybersecurity work can serve both purposes.
The most common assessment mistakes
- Looking only at “whether there is AI”: the AI Act looks at use and risk, not technology.
- Checking condition (a) but not condition (b): even if it is a safety component, you still need to check whether the product legislation requires third-party assessment.
- Treating paragraph 1a as a universal exemption: if “quality control” or “automation” AI would endanger health and safety when it fails, paragraph 1b brings it back in.
- Forgetting Annex III: a product that is not high-risk does not mean the data it collects is not high-risk when used to evaluate employees or allocate work.
The Commission has published guidelines on high-risk classification and a list of practical examples under Article 6(5), available as “High-risk AI Systems Guidelines” on the AI Act Service Desk.
Keep a record of your assessment
Customers and authorities may both ask you what your conclusion that something "is not high-risk" is based on. How conditions (a) and (b) and paragraphs 1a to 1c map onto each product feature depends on the product design, intended purpose and assessment module.
FAQ
If a product has AI features, is it high-risk under the AI Act?
No. The Annex I route requires two conditions at the same time: the AI is a safety component of an Annex I product (or is itself the product), and the product must undergo third-party conformity assessment. The other route is the uses listed in Annex III.
Is AI quality inspection high-risk?
AI inspection on the production line is not a product placed on the market, so Article 6(1) does not apply. AI built into a product and used only for quality control is not a safety component under Article 6(1a), unless its failure would endanger health and safety.
When do the high-risk rules for AI built into products apply?
For Annex I Section A products, Chapter III, Sections 1 to 3 apply from 2 August 2028 (Article 113, third paragraph, point (c)(ii)). For Section B products, it depends on the amendments to each product law.
Next in the series
Previous: Part 4: AI in machinery now goes through the Machinery Regulation after the Omnibus
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and can help electronics, equipment and medical device companies confirm the AI Act applicability of AI built into their products.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 3(14), Article 6, Article 42(3) and Annex I: EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
- European Commission, AI Act Service Desk: ai-act-service-desk.ec.europa.eu
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · Regulation (EU) 2026/1744 (Digital Omnibus on AI) · AI Act consolidated text (27 July 2026) · European Commission, AI Act Service Desk: High-risk AI Systems Guidelines. This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI Actsafety componentArticle 6Annex IAI quality inspectionradio equipmentmedical devicesthird-party conformity assessment
