EU AI Act for product manufacturers: what changes

Does the EU AI Act apply to my machine or regulated product, and when?

If your product contains AI that acts as a safety component of an Annex I product, that AI is high-risk under Article 6(1), and the high-rules for Annex I product systems apply from 2 August 2028. Conformity runs through the sectoral legislation that already governs your product, with the AI Act requirements and the Article 17 quality management system assessed as part of that route. Three questions decide how this lands for your organization: which section of Annex I your product falls under, whether the AI is a safety component or serves a non-safety purpose, and whether you place the product on the market under your own name or trademark. Start with the annex. After Regulation (EU) 2026/1744, Annex I Section A lists 11 New Legislative Framework acts, including toys, lifts, radio equipment, pressure equipment, personal protective equipment, and medical and in vitro diagnostic devices. Machinery moved to Section B, and under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply to high-risk systems related to Section B products. Confirm which section your sectoral law sits in and which provisions of the Act reach you, because the answer changes the documents you must produce and the real-world testing route available to you.

Next, test the safety question. Under Article 6(1a) to 6(1c), AI used solely for purposes such as user assistance, performance optimization, efficiency, automation, convenience or quality control is not a safety component unless its failure would endanger health and safety. Map every AI function in the product and record, for each one, what happens if it fails. Keep that analysis in your technical file, because it is the basis for either treating a function as high-risk or documenting why it is not. Where the Commission's draft classification guidelines of 19 May 2026 are relevant to your product, read them alongside the Act. Finally, establish your role. Article 25(3) makes the product manufacturer the provider of a high-risk safety component of an Annex I Section A product placed on the market under its name or trademark. If you source an AI component from a supplier and sell the finished product under your brand, you are likely the provider for compliance purposes, even if you did not build the model. Confirm the placing-on-market arrangements in your supply contracts now, since they determine which obligations and evidence sit with you before the 2 August 2028 date.

Which AI features in a product trigger high-risk status

Before any conformity work starts, a manufacturer has to decide whether AI in its product is high-risk at all. The cards below follow the order of those decisions, from the safety component test under Article 6(1) to the conformity route, and list the evidence to keep for each one.

Is the AI a safety component

Under Article 6(1), AI is high-risk when it is a safety component of a product covered by Annex I legislation, or is itself such a product. Ask whether the AI controls, monitors or triggers a function whose failure could cause injury or damage to health. Record the function map of the product, the AI's role in each safety function, and the risk assessment that supports the answer. Confirm the reading against the consolidated text and the draft Commission guidelines.

Is the AI the product itself

An AI system can also be high-risk when it is itself a product covered by Annex I legislation, not a component inside one. This matters for standalone devices, controllers and software sold as a regulated article. Record the product definition, the intended purpose in the instructions, and the sectoral legislation under which the product is placed on the market. Compare this with the component route before choosing a classification.

Does a non-safety purpose apply

Articles 6(1a) to 6(1c), added in 2026, state that AI used solely for user assistance, performance optimization, efficiency, automation, convenience or quality control is not a safety component. The exclusion is narrow: it depends on the AI's purpose and its design, not on how the marketing describes it. Record the intended purpose statement, the feature list, and the reasons each non-safety feature sits outside the safety functions.

Would failure endanger health and safety

The non-safety exclusion falls away where a failure of the AI would endanger health and safety. A quality control model that rejects a defective part is different from one that releases a machine's guard interlock. Record a failure mode analysis for each AI function, the harm each failure could cause, and the person or role who signed off the conclusion. Keep the analysis under version control so it can be shown to an assessor.

Annex I Section A or Section B

After Regulation (EU) 2026/1744, Annex I Section A lists New Legislative Framework acts such as toys, lifts, radio equipment, pressure equipment, personal protective equipment, and medical devices. Machinery moved to Section B, which changes which articles apply and when. Record the sectoral act that covers the product, the section it sits in, and the date the high-risk rules apply to it. Confirm the section placement against the consolidated text.

Does third-party conformity assessment apply

The high-risk route depends on whether the sectoral law requires third-party conformity assessment for the product. Under Article 43(3), the AI Act requirements, including the Article 17 quality management system, are assessed within that sectoral procedure, and a single set of technical documentation is kept under Article 11(2). Record which assessment route the sectoral law requires, the notified body or internal control option, and the evidence that the AI requirements are covered by it.

Why machinery moved to Section B and what that changes for scope

The 2026 amendment moved the Machinery Regulation (EU) 2023/1230 out of the Section A list of product acts and into Annex I Section B, and that single change alters which AI Act duties reach a machinery manufacturer. Under the amended Article 2(2), the high-risk systems linked to Section B products are subject only to Article 6(1), Article 60a and Articles 102 to 112. In practice, the classification test still applies, and the real-world testing framework in Article 60a is available, but the full set of high-risk requirements in Articles 8 to 15 and the provider obligations that sit behind them do not attach to these systems through the AI Act itself in the same way they do for Section A products such as toys or medical devices.

For a manufacturer, the practical question shifts from "which AI Act articles do I now implement" to "which of my AI-enabled machinery functions remain in scope and under which rules." A safety function that uses AI for a protective stop or for detecting a person in a hazard zone still needs to be assessed under Article 6(1). A non-safety feature such as predictive maintenance scheduling, operator assistance or performance tuning may fall outside the high-risk category under Article 6(1a) to 6(1c). The machinery conformity route under its own sectoral legislation stays the main compliance path, and the sector rules, not a separate AI Act technical file, determine most of the evidence you keep.

Because the amendment changes scope in both directions, treat the classification as a documented decision rather than an assumption. Ask counsel to confirm how Article 2(2) applies to each AI-enabled function in your product range, and ask the relevant market surveillance authority how it expects Article 60a testing plans to be run if you intend to test in the field. Record the rationale for each function, keep it under version control with the design file, and revisit it whenever the Commission's draft classification guidance or the machinery rules change.

How the sectoral conformity route runs from scoping to market placement

This sequence takes a manufacturer from identifying whether an AI component is a regulated safety component to placing a product on the market with one technical file and one conformity assessment covering both the AI Act and the sectoral law. Each phase produces a record that the next phase depends on.

Scope the AI component against Article 6
The manufacturer's product engineering and compliance leads list every AI function in the product and record what each one does. For each function they test whether it is a safety component, or the product itself, covered by Annex I legislation that requires third-party conformity assessment. Functions used solely for user assistance, performance optimization, efficiency, automation, convenience or quality control are not safety components unless their failure would endanger health and safety, so the reasoning for each one must be written down. The output is a scoping memo that names each AI function, the Article 6 reasoning and the outcome. The step is done when the memo is signed by the product owner and the compliance lead and every function has a stated classification.
Confirm the Annex I section and sectoral legislation
Once a function is classed as high-risk, the team identifies which Annex I legislation covers the product. Annex I Section A lists the New Legislative Framework acts, while machinery sits in Section B, which changes which articles of the AI Act apply. The team confirms the sectoral conformity assessment route, the notified body requirements where the sectoral law demands them, and any essential requirements that apply to the product. Legal or regulatory counsel should confirm the section and route, since the 2026 amendments changed the structure. The output is a classification record that names the Annex I section, the sectoral legislation, the conformity route and the date the product must comply, which is 2 August 2028 for Annex I product systems under the amended Act.
Build one technical documentation set
Under Article 11(2), the manufacturer keeps a single set of technical documentation that covers both the AI Act requirements and the sectoral legislation, so the team avoids maintaining two parallel files. The file typically includes the system description, design choices, data and training documentation, risk management records, testing results, instructions for use and the intended purpose. Engineering owns most of the content, while compliance checks that each AI Act requirement has a traceable section. The output is a single technical file with an index that maps each requirement and each sectoral essential requirement to the document that evidences it. The step is complete when an assessor can locate the evidence for every requirement without asking the team where it lives.
Operate a quality management system
The manufacturer runs a quality management system under Article 17 that covers the AI component across its lifecycle, from design and development through production, change control and supplier management. Under Article 43(3), the Article 17 system is assessed as part of the sectoral conformity assessment rather than as a separate audit, so the existing sectoral quality system is extended to cover AI-specific processes. Records include procedures, design reviews, verification and validation results, change logs and corrective actions. Teams should confirm with the notified body or the sectoral authority which evidence it will expect. The output is quality management evidence that shows the system operated during development, not only that it was written. The step is done when the records cover at least one full design and release cycle.
Run the third-party conformity assessment
The sectoral law determines who performs the assessment. For many Annex I products, a notified body reviews the technical file and the quality management system, and tests where the sectoral law requires it. The manufacturer prepares the file, answers assessor queries, provides access to the production site and supplies samples or test reports as requested. The notified body issues its findings, and where the product passes, it issues the certificate or statement that the sectoral legislation requires. The manufacturer should confirm the assessment scope in writing before submission, including whether the AI requirements are assessed under the sectoral route in the way described above. The output is the assessment outcome, which is the certificate or documented conformity decision, and the product can be placed on the market only after it is in hand.
Place the product on the market with its declaration
After a positive assessment, the manufacturer draws up the EU declaration of conformity required by the sectoral legislation, affixes the required marking and includes the instructions for use. Because the manufacturer is the provider of a high-risk safety component placed on the market under its name or trademark, it carries the provider obligations for the AI component. The team confirms that the version on the market matches the version in the technical file. The output is the signed declaration, the marking record and a release record that links the product version to its technical file and assessment outcome. The step is done when these records can be produced for a market surveillance authority on request.
Keep post-market obligations in place
Conformity does not end at release. The manufacturer maintains a post-market monitoring plan that collects field performance data, tracks incidents and malfunctions, and feeds findings back into the risk management process and the technical file. Changes to the AI component that affect compliance trigger a review of the classification and the assessment, and the manufacturer records each change and its outcome. Where real-world testing is used before release, Article 60a allows Member States to adopt frameworks that require a testing plan agreed with the relevant authority, so the team confirms whether such a framework applies in its markets. The output is a post-market plan with named owners, a log of field data and incidents, and a change record that links each update to a re-assessment decision.

What the work costs and who gets paid for each part

This table separates the cost of machinery and regulated product compliance into its components, showing who is paid for each, whether the cost is one-time or recurring, and what moves it up or down. Use it to build a request for quote and to decide which parts to buy and which to keep in-house. No prices or durations are stated here, so the figures you need must come from written quotes and the assessing body.

Cost component	Who is paid and for what	One-time or recurring	What drives it up or down
Notified body or conformity assessment	The notified body or other conformity body named under the sectoral legislation, for third-party assessment where that law requires one. Only the assessing body issues certificates.	Mostly one-time per certificate, with recurring surveillance or re-assessment after significant changes	Number of AI safety components, number of product variants, and how many changes trigger re-assessment. Ask the body for its fee basis and the scope it will assess.
Implementation partner for the technical file and quality evidence	An implementation partner, such as DeployOpen, that prepares the single technical documentation, risk management records, data governance evidence and logging design. The partner does not issue any certificate.	One-time for initial preparation, with recurring updates as the product or model changes	Quality of existing documentation, number of AI components and their interfaces, and whether the quality management system already covers the machinery or product line. Request a fixed scope in writing.
Internal engineering and functional safety staff	Your own engineers, safety officers and software staff who define intended purpose, verify performance and own the risk assessment. This is internal payroll and time, not a vendor invoice.	Recurring, because every release and variant needs review	Number of product variants, release frequency, and how much safety analysis already exists. Estimate the internal hours in your own plan before requesting external quotes.
Testing, validation and tooling	Test laboratories, simulation or data tooling providers, and licence holders for monitoring and logging software. Some testing may also be run by the implementation partner under a written scope.	Mixed: one-time test campaigns and tool setup, plus recurring licences and regression testing	Number of operating conditions to validate, dataset coverage needs, and whether tools are self-hosted or licensed. Open-source tooling lowers licence cost but still needs internal or partner effort.
Legal review of classification and conformity route	Lawyers or regulatory specialists who confirm whether each AI component is a safety component under Article 6 and which sectoral conformity route applies. Some teams also use a regulatory advisor for market surveillance questions.	One-time for the initial classification, recurring when the intended purpose or the law changes	Number of AI components to classify, how much the safety role is documented, and whether the 2026 non-safety clarifications apply. Ask counsel to state the classification basis in writing.
Real-world testing plan and national authority engagement	Your organization and any implementation partner for a testing plan, where a Member State adopts a real-world testing framework under Article 60a. The relevant national authority agrees the plan.	One-time for plan agreement, with recurring reporting while testing runs	Whether your Member State has adopted a framework, the scope of field testing, and the number of sites or users involved. Confirm availability with the national authority before planning.
Post-market monitoring and incident handling	Internal operations and support teams, plus any partner who sets up monitoring, logging and incident procedures for the product fleet.	Recurring for the life of the product	Size of the installed base, number of AI functions in the field, and how well logs are designed at the outset. Ask for the monitoring scope and log retention design in the quote.

What usually delays manufacturers and inflates the project

Most delays in AI Act work for machinery and regulated products come from decisions made late or records kept in the wrong place. The cards below cover the six pitfalls that most often add rework, and each one names the record or check that prevents it. Read them as a sequence, since the classification decision at the start shapes everything after it.

Classifying the AI component late

Teams often decide whether an AI function is a safety component only after the design is frozen. Under Article 6(1a) to 6(1c), AI used solely for non-safety purposes such as user assistance, performance optimization, efficiency, automation, convenience or quality control is not a safety component unless its failure would endanger health and safety. Avoid the problem by writing a safety-function classification record for every AI function at the concept gate, signed by the safety engineer and the regulatory lead, and by reopening it at each design change.

Treating 2028 as the start date

The high-risk rules for Annex I product systems apply from 2 August 2028, but a conformity assessment, a quality management system and a technical file take far longer to build than the time left before that date. Waiting for the deadline pushes data collection, testing and supplier evidence into the final months of a product cycle. Avoid this by setting internal milestones backward from the date, starting with a gap analysis of existing sectoral documentation, and tracking the date as a deadline for the finished evidence set rather than a trigger for the work.

Keeping separate technical files

Manufacturers often maintain one technical file for the sectoral law and another for the AI Act, which then drift apart after each update. Under Article 11(2), a single set of technical documentation must cover both. Avoid duplicates by mapping each AI Act requirement to a section of the existing sectoral file, assigning one document owner per section, and keeping a cross-reference index that shows which evidence answers which requirement. Ask your notified body early whether it expects the combined structure.

Underestimating quality management evidence

The Article 17 quality management system is assessed as part of the sectoral conformity assessment, so the assessor will look for records, not policies alone. Teams often hold procedures for design, data and post-market work but cannot show dated outputs, reviews and corrective actions from the AI system itself. Avoid this by collecting, for each process, at least one completed record per release, such as a data review, a validation report, a management review minute and a nonconformity log, and by checking that each record can be traced to a product version.

Changing the model without change control

A retrained model, a new data source or an updated inference library can alter the behavior a conformity assessment examined. Without a documented change process, the manufacturer may not be able to show whether the change is substantial or whether the assessment still applies. Avoid this by keeping a model change register that records the trigger, the impact analysis, the test results, the approver and the version of the technical file affected, and by confirming with the notified body or conformity body which changes require re-assessment under the sectoral rules.

Assuming one product family covers variants

Product families often share a platform, but AI functions can differ between variants through configuration, software options or regional builds. A conformity assessment for one variant does not automatically cover another with a different model, sensor set or safety function. Avoid this by building a variant matrix that lists each configuration, its AI components, its test coverage and its technical file reference, and by confirming with the conformity body how it treats shared evidence across the family before the first variant is placed on the market.

Real-world testing frameworks under Article 60a

Article 60a, added in 2026, lets Member States adopt frameworks for real-world testing of AI-enabled products that fall under Annex I Section B legislation, such as the Machinery Regulation (EU) 2023/1230. Where a national framework applies, a mandatory testing plan agreed with the relevant authority must be in place before the product is tested in real-world conditions. The route is optional for Member States, so a manufacturer cannot assume it exists in every market where it wants to test. Confirm first whether the Member State where the testing will happen has adopted a framework, and which authority administers it.

Before any testing, ask the national authority what its framework requires, who the competent contact is, whether the framework is open to your product type, and how it treats testing that involves end users or workplaces where machinery is operated by employees. Ask whether the authority expects a fixed testing period or a staged approach, what records it wants kept during testing, and how it expects serious problems to be reported. Ask as well how testing results feed into the conformity assessment under the sectoral legislation, since Article 43(3) keeps a single assessment route and a single set of technical documentation under Article 11(2).

A testing plan usually needs to show the scope: the product version, the AI functions under test, the operating environment, the sites or users involved and the duration. It should set out safeguards that protect people and property, such as operator training, physical guarding, supervision by a qualified person and limits on operating conditions. It should describe monitoring: which performance and safety signals are logged, how often they are reviewed and who reviews them. It should define stop conditions that halt testing automatically, and an incident handling process that names who is informed, how quickly and through which channel. Treat the plan as a controlled document, because the authority will expect evidence that the plan was followed. The authoritative text is in the consolidated AI Act as amended in 2026.

Who does what: manufacturer, implementation partner and assessing body

The manufacturer is the legal person that places the product on the market under its name or trademark. Under the AI Act, that party is usually the provider of a high-risk AI safety component of an Annex I Section A product (Article 25(3)). For machinery, which now sits in Annex I Section B, the manufacturer still owns the product, the risk assessment and the conformity route under the Machinery Regulation, and must show how the AI system fits into that file. The manufacturer also owns the classification decision under Article 6, including whether the AI is merely a non-safety feature under Articles 6(1a) to 6(1c).

Classification decision: Record why each AI function is or is not a safety component, and keep that reasoning signed and dated.
Quality management system: Own the Article 17 QMS, and confirm it is integrated with the sectoral quality system rather than run as a parallel one.
Technical documentation: Hold the single technical file that Article 11(2) requires, covering both the AI requirements and the product law.
EU declaration of conformity: Sign the declaration and affix the marking only after the required assessment is complete.
Post-market duties: Monitor the product, handle corrective actions and keep the records for the period the sectoral law sets.

Before you engage anyone, confirm with your sector regulator and notified body which route applies to your product.

How to choose an assessor and an implementation partner

Machinery and regulated product manufacturers under the AI Act usually combine a conformity assessment body with an implementation partner who builds the evidence. Keep those roles separate and get each one's scope, qualifications and limits in writing before work starts.

Confirm the assessing body's designation

Under Article 43(3), AI Act requirements for an Annex I product are assessed as part of the sectoral conformity assessment. Ask the body to show that it is designated or notified under the sectoral legislation that covers your product, and that its scope explicitly includes the AI Act requirements and the Article 17 quality management system. Request the designation scope in writing, including the product categories and the legal acts it covers. A body without that scope cannot issue the conformity evidence you need.

Separate assessor from builder

The body that assesses conformity must stay independent of the firm that prepares your technical documentation, risk management records and monitoring evidence. Ask each party to name its role in writing and confirm that the implementation partner will not issue, sign or certify any conformity output. If one firm proposes to do both the building and the assessment, treat that as a conflict to resolve before signing.

Verify machinery and product experience

Ask for documented work under the specific sectoral law that governs your product, such as the Machinery Regulation (EU) 2023/1230 for machinery or the regime for toys, lifts, radio equipment or medical devices. Ask which named engineers have delivered that work, and for a redacted example of the technical file structure they produced. General AI experience does not show that the team knows how notified or designated bodies test a machine's safety function.

Fixed scope and deliverables

Require a written scope that lists each system in the assessment, each deliverable with its format, and the acceptance criteria for each one. Confirm that the partner works on a fixed scope and that changes go through a written change request. Ask what happens if the assessor requests additional evidence after the first submission, and who pays for rework. Vague statements of effort make budget overruns hard to prevent.

Keep the technical file in your environment

The single technical documentation set required by Article 11(2) contains design records, data governance details and logs that may be sensitive. Ask where the partner stores drafts, test data and logs during the engagement, and confirm that the final file lives in your own repositories and infrastructure. Request the access list, the retention rule after handover, and the process for deleting partner-side copies. Ask who holds administrator rights to each repository.

Exclusions and handover limits

Ask the partner to list in writing what it will not do. Common exclusions include signing the EU declaration of conformity, applying the CE marking, acting as your authorized representative, and making the final decision on whether a safety component is high-risk. Confirm who owns each open item at handover and who maintains the post-market monitoring duties after go-live. Clear exclusions prevent gaps that surface only during assessment.

Questions manufacturers ask before bringing in outside help

Does a machine with an AI safety function fall under the AI Act?

Possibly, and the answer depends on whether the AI is a safety component. Under Article 6(1), an AI system is high-risk when it is a safety component of a product covered by Annex I legislation that requires third-party conformity assessment. Since the 2026 amendment, machinery sits in Annex I Section B. Article 6(1a) to 6(1c) state that AI used solely for non-safety purposes, such as user assistance, performance optimization, efficiency, automation, convenience or quality control, is not a safety component unless its failure would endanger health and safety. Classify each AI function separately, document the reasoning, and check the classification against the consolidated text and the Commission's draft guidelines on high-risk classification before you rely on it.

When does the 2028 date apply to machinery and other product AI?

For AI systems that are high-risk because they are safety components of Annex I products, the high-risk rules apply from 2 August 2028, instead of 2 August 2027 as the original text provided. Article 113 sets this date after the 2026 amendment, and Annex III systems move separately to 2 December 2027. The general application date of 2 August 2026 still governs the rest of the Act, so obligations that are not high-risk rules, such as certain transparency duties, may apply earlier. Confirm which duties apply to each AI function in your product with your legal team, and track the delegated acts the Commission may adopt under Article 2(13) for Annex I Section A products.

Is the machine manufacturer the provider under the AI Act?

Usually yes, when the manufacturer places the product on the market under its own name or trademark. Article 25(3) makes the product manufacturer the provider of a high-risk safety component of an Annex I Section A product placed on the market or put into service under its name or trademark. Section A and Section B are treated differently, so confirm which regime applies to your product line. Where you integrate a third-party AI model or component, read Article 25 on the value chain to see who takes on the provider duties, and write those responsibilities into supplier contracts.

How does the single technical file work for a product?

A single technical file covers both the sectoral product requirements and the AI Act requirements. Under Article 43(3), an AI system that is a product safety component follows the conformity assessment of the sectoral legislation, with the AI Act requirements and the Article 17 quality management system assessed as part of it. Article 11(2) requires one set of technical documentation rather than two parallel files. In practice, the file should hold the intended purpose, the risk management records, the data and model documentation, the validation results, the human oversight design, logging and instructions for use, mapped to each requirement. Ask your notified body or conformity body how it expects the file to be organized before you start writing it.

What does the work need from engineering and safety staff?

It needs their time on defined artifacts, not a new process layered on top of the existing one. Engineering staff document the AI system's design, data sources, training and validation methods, performance limits, logging and update controls. Safety staff review the hazard analysis, confirm how the AI function interacts with safety-related parts of the machine, and sign off on residual risks. Both groups should agree on the intended purpose and the non-safety classification argument early, because changes to either shift the scope. Expect these reviews to recur with every software release that changes the AI function.

Can our team do this work in-house?

Many teams can do the documentation and engineering work in-house, especially where they already run a machinery safety process and a quality management system. Outside help is most useful for independent gap analysis, structuring the single technical file, building the evidence pipeline, and testing the system's security and robustness. Note that the conformity assessment itself is carried out by an independent body, and no implementation partner can issue that outcome. Decide which parts you keep and which you buy by mapping your current skills against the requirements, then agree the boundaries in writing.

What drives the cost and timing of the work?

The main drivers are the number of AI functions that are safety components, how much existing documentation you can reuse, the maturity of your quality management system, and the conformity route your product requires. Costs split into internal staff time, external advisory or implementation work, testing, and the conformity assessment fees charged by the independent body, which recur with changes. Ask any provider for a fixed-scope quote that lists the AI functions covered, deliverables, assumptions about your existing documentation, and what is excluded. DeployOpen agrees scope, deliverables and timelines in writing before work starts, and it does not publish a price list.

What can an outside partner not do for us?

An outside partner cannot issue the certificate, the conformity assessment outcome or any audit report. Only an independent notified body or other authorised assessor issues those, and the organization owns its controls and its declaration of conformity. DeployOpen prepares systems, controls and evidence for assessment, and it does not issue audit reports, attestations or certifications. Ask any partner to state this boundary in its proposal, and confirm with your notified body which evidence it will review before the assessment starts.

How DeployOpen prepares AI systems and evidence for product conformity

DeployOpen works on the AI Act for manufacturers of machinery and regulated products as an implementation partner. We prepare the systems, controls and technical evidence that a manufacturer's sectoral conformity assessment will examine, while the manufacturer owns its controls and an independent notified body or assessor issues any conformity result.

How we scope

Engagements are fixed-scope, with the products, AI functions and sectoral legislation agreed in writing before work starts.
The written scope states which AI components count as safety components and which are non-safety functions under the 2026 clarifications.
The scope lists the Annex I Section B legislation, such as the Machinery Regulation, and the conformity route that applies to each product.

How we build

We help configure a single technical documentation set that covers both the AI Act requirements and the sectoral conformity file.
We implement logging, data governance and human oversight measures in the client's own infrastructure, based on the agreed scope.
We run security testing on the AI-enabled functions and document the findings, fixes and retest results for the conformity file.

How we hand over

Deliverables include the technical documentation, system configuration records, test reports and evidence mapped to each agreed requirement.
We document the quality management processes that the manufacturer must operate, so its own staff can run them after handover.
Handover covers the evidence index, open items and the decisions the manufacturer still needs to make before its assessor reviews the file.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer for AI-enabled products after release.
We can help track changes to the AI Act, delegated acts and harmonised standards, and confirm which changes affect the agreed scope.
Ask the assessor or notified body which evidence it expects before the handover, so the file matches its review process.