Is your AI a "safety component" under the EU AI Act?
Most writing about EU AI Act high-risk classification is really about Annex III — hiring, credit, education, biometrics. That is the door most software companies walk through. There is a second door, and it is the one that catches manufacturers: Article 6(1), the product route, which turns on whether your AI is a safety component.
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) narrowed that door twice. It wrote into the Act a definition of what a safety component is not, and it moved machinery out of the AI Act's full high-risk regime. Neither change got much attention outside specialist law-firm briefings, and the Commission's own article-by-article reference tool still displays pre-Omnibus text on several of the provisions involved.
This is an information service to help you plan, not legal advice. For the obligations tied to your own AI use, see which apply to your company.
The two conditions in Article 6(1)
An AI system is high-risk by the product route only where both conditions are met:
"(a) the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I;
(b) the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment, with a view to the placing on the market or the putting into service of that product pursuant to the Union harmonisation legislation listed in Annex I."
Both, cumulatively. An AI component inside a regulated product that does not require third-party conformity assessment is not high-risk by this route. This is the check teams most often skip: they see that the product is CE-marked and stop, without asking whether a notified body is actually in the loop.
What the Omnibus says is not a safety component
This is the substantive change, and it is new text. Article 6 now carries three inserted paragraphs:
"1a. For the purposes of this Regulation, including paragraph 1 of this Article, AI systems that are solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control shall not qualify as safety components.
1b. Notwithstanding paragraph 1a, AI systems the failure or malfunctioning of which would endanger health and safety shall qualify as safety components.
1c. A product that is required to undergo a third-party conformity assessment solely due to risks other than risks to health and safety, in particular risks relating to the distribution of radio spectrum or electromagnetic interference that do not affect health and safety, shall not be considered as fulfilling the condition in paragraph 1, point (b)."
Three distinct effects, worth separating:
| Provision | Effect | What it reaches in practice |
|---|---|---|
| 6(1a) | Carves out AI used solely for non-safety purposes | Predictive-maintenance scheduling, throughput optimisation, a convenience voice interface, cosmetic quality inspection |
| 6(1b) | Overrides 6(1a) wherever failure would endanger health and safety | Quality control that is the only barrier to a defective safety-critical part shipping |
| 6(1c) | Defeats condition (b) where third-party assessment is required only for non-safety risks | A connected device sent to a notified body purely for radio-spectrum or EMC reasons |
Read 6(1a) and 6(1b) together, never separately. The carve-out is written with the word solely, and 6(1b) reinstates the classification wherever failure would endanger health and safety. The label on the feature does not decide it. "Quality control" appears in the 6(1a) list, but quality control that is the last line of defence before an unsafe part reaches a customer sits squarely inside 6(1b). The operative test is the consequence of failure, not the function's name.
Paragraph 1c is narrower than it first reads. It removes products pulled into third-party assessment for reasons unrelated to health and safety — the drafters name radio spectrum and electromagnetic interference. Where a notified body is involved for a health-and-safety reason at all, 1c does not help.
The machinery move: out of Section A, into Section B
Annex I has two sections, and until the Omnibus most people never needed to know the difference. Now they do.
The Omnibus deleted Directive 2006/42/EC (the Machinery Directive) from Annex I Section A and inserted Regulation (EU) 2023/1230 on machinery as item 21 of Annex I Section B. In the consolidated text, Section A now begins at item 2, its deleted first entry marked by the amendment symbol.
That relocation is not cosmetic, because the amended Article 2(2) treats the two sections completely differently:
"For AI systems classified as high-risk AI systems in accordance with Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 shall apply. Articles 57, 58 and 59 shall apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation."
Side by side:
| Annex I Section A (toys, lifts, PPE, medical devices, radio equipment…) | Annex I Section B (transport, and now machinery) | |
|---|---|---|
| Article 6(1) classification | Applies | Applies |
| Chapter III Section 2 requirements (Articles 8–15) | Apply | Not via the AI Act |
| Article 16 provider obligations — QMS, technical documentation, conformity assessment, CE marking, registration | Apply | Not via the AI Act |
| Article 25(3), product manufacturer deemed the provider | Applies (written for Section A) | Not applicable |
| Real-world testing outside sandboxes | Article 60 | Article 60a (new) |
| Sandboxes (Articles 57–59) | Apply | Only in so far as the requirements have been integrated into the sectoral legislation |
The design intent is a single assessment: a machine builder should not run one conformity assessment under the Machinery Regulation and a second, parallel one under the AI Act for the same safety component. The AI-specific requirements are meant to reach machinery through the Machinery Regulation instead.
This is a change of route, not an exemption. Article 6(1) still classifies the system as high-risk. Regulation (EU) 2023/1230 applies from 20 January 2027 and carries its own essential health and safety requirements, its own conformity assessment procedures, and its own treatment of software and of machinery with evolving behaviour. Reading the Omnibus as "machinery is out of scope" gets it backwards.
Article 60a is the other half of the change: a new article letting Member States allow real-world testing of Section B high-risk AI systems outside AI regulatory sandboxes, to assess and verify conformity with the Articles 8 to 15 requirements, under frameworks each Member State adopts and notifies to the Commission before implementing.
The dates
The product route has the longest runway in the Act. Article 113, third paragraph, point (c), as amended:
| Classification route | High-risk obligations apply from |
|---|---|
| Article 6(2) and Annex III — hiring, credit, education, biometrics and the rest | 2 December 2027 |
| Article 6(1) and Annex I — the product route | 2 August 2028 |
The runway is real, but it is not idle time. Conformity assessment against harmonised standards takes longer than most compliance work, and the standards are not finished: EN 18286, the first AI Act harmonised standard, has still not been cited in the Official Journal, so it confers no presumption of conformity yet. See also what the Digital Omnibus changed and the full AI Act timeline.
A caution about the sources you are reading
The Commission's AI Act Service Desk publishes an article-by-article view of the Regulation. On several provisions discussed here it still shows the pre-Omnibus text, under its own notice:
"This provision has been amended by the Digital Omnibus on AI. The text displayed on this page has not yet been updated to reflect those amendments."
That disclosure is honest, but it means the article page you land on from a search engine may not show you Article 6(1a) to (1c) at all. The same goes for secondary commentary: a great deal of AI Act writing published before 27 July 2026 describes machinery as a straightforward Annex I Section A high-risk case, which is no longer the position. Where a classification decision turns on this, read the consolidated text and look for the amendment markers.
What to do
- Test condition (b) before condition (a). If your product needs no third-party conformity assessment, the product route closes there — and Article 6(1c) closes it too where the only reason for assessment is radio spectrum or EMC.
- Classify each AI feature by consequence of failure, not by its name. Article 6(1a) lists functions; Article 6(1b) overrides the list. Write down, per feature, what happens to health and safety if it silently produces a wrong output.
- If you build machinery, fold your AI Act work into your Machinery Regulation work. The obligations did not vanish; the vehicle changed — and 2023/1230 applies from 20 January 2027, eighteen months ahead of the AI Act's own product-route date.
- Check whether Annex III catches you anyway. The two routes are independent and Annex III has the earlier date. Test both doors.
- Re-check any classification memo written before 27 July 2026. Article 6(1a) to (1c) did not exist then, and machinery sat in Section A.
To work out which obligations and which dates apply to your own systems, answer a few questions about your AI use. To be told when the Commission cites a harmonised standard or reissues guidance updated for the Omnibus, join the waitlist. If you are further upstream than this, start with which obligations apply to your company.
The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. This article is an information service to help you orient — it is not legal advice.
Frequently asked questions
What counts as a "safety component" under the EU AI Act?
The Digital Omnibus inserted Article 6(1a), which states that AI systems used solely for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components. Article 6(1b) then qualifies that: AI systems the failure or malfunctioning of which would endanger health and safety do qualify, regardless of the carve-out. The test is the consequence of failure, not the name of the feature.
Is AI in machinery still high-risk under the EU AI Act?
It can still be classified as high-risk under Article 6(1), but the consequences changed. The Digital Omnibus removed Directive 2006/42/EC from Annex I Section A and inserted Regulation (EU) 2023/1230 on machinery as item 21 of Annex I Section B. Under the amended Article 2(2), for Article 6(1) high-risk AI systems related to Section B products, only Article 6(1), Article 60a and Articles 102 to 112 of the AI Act apply. The substantive requirements are meant to reach machinery through the Machinery Regulation instead.
What is the difference between Annex I Section A and Section B?
Section A lists Union harmonisation legislation based on the New Legislative Framework — toys, recreational craft, lifts, equipment for explosive atmospheres, radio equipment, pressure equipment, cableways, personal protective equipment, gas appliances, medical devices and in vitro diagnostic medical devices. Section B lists other Union harmonisation legislation, largely transport, and since the Digital Omnibus also machinery. Both feed Article 6(1) classification, but the amended Article 2(2) applies only a narrow slice of the AI Act to Section B products, and Article 25(3), which deems a product manufacturer to be the provider, is written for Section A only.
When do the Article 6(1) high-risk obligations actually apply?
Under Article 113, third paragraph, point (c)(ii) as amended by the Digital Omnibus, Chapter III Sections 1, 2 and 3 apply from 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I. That is the latest application date in the Act. For Annex III systems the date is 2 December 2027.
See which obligations apply to your company → or join the waitlist
This is an information service, not legal advice.